Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-5724

Publication date:

30/03/2020

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server&#39;s websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2020

CVE-2020-5723

Publication date:

30/03/2020

The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2020

CVE-2020-5255

Publication date:

30/03/2020

In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response&#39;s content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-5275

Publication date:

30/03/2020

In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule&#39;s attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-5274

Publication date:

30/03/2020

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2020

CVE-2016-11024

Publication date:

30/03/2020

odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2020

CVE-2016-11023

Publication date:

30/03/2020

odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2020

CVE-2020-7610

Publication date:

30/03/2020

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object&#39;s _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2020

CVE-2020-7599

Publication date:

30/03/2020

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2020

CVE-2019-17560

Publication date:

30/03/2020

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2023

CVE-2019-17561

Publication date:

30/03/2020

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/04/2022

CVE-2020-8509

Publication date:

30/03/2020

Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

06/04/2022

Subscribe to Vulnerabilities