Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-6247

Publication date:

12/05/2020

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-6248

Publication date:

12/05/2020

SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-6250

Publication date:

12/05/2020

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop the server like an administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-6251

Publication date:

12/05/2020

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-6252

Publication date:

12/05/2020

Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact system availability.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-6262

Publication date:

12/05/2020

Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-12823

Publication date:

12/05/2020

OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-12825

Publication date:

12/05/2020

libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2022

CVE-2020-6241

Publication date:

12/05/2020

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection.

Severity CVSS v4.0: Pending analysis

Last modification:

14/05/2020

CVE-2020-6244

Publication date:

12/05/2020

SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2020-6240

Publication date:

12/05/2020

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2022

CVE-2020-6242

Publication date:

12/05/2020

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2022

Subscribe to Vulnerabilities