Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-30124

Publication date:

30/07/2021

The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitrary code via a crafted phpmd.command value in a workspace folder.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2022

CVE-2021-31799

Publication date:

30/07/2021

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

Severity CVSS v4.0: Pending analysis

Last modification:

15/10/2024

CVE-2021-30483

Publication date:

30/07/2021

isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2021

CVE-2021-31878

Publication date:

30/07/2021

An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2021

CVE-2021-28093

Publication date:

30/07/2021

OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-28094

Publication date:

30/07/2021

OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-28095

Publication date:

30/07/2021

OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, due to use of CRC32.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-28674

Publication date:

30/07/2021

The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the attacker&#39;s perimeter) via an account with write permissions. This occurs because node IDs are predictable (with incrementing numbers) and the access control on Services/NodeManagement.asmx/DeleteObjNow is incorrect. To exploit this, an attacker must be authenticated and must have node management rights associated with at least one valid group on the platform.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-32558

Publication date:

30/07/2021

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

Severity CVSS v4.0: Pending analysis

Last modification:

28/11/2021

CVE-2021-28966

Publication date:

30/07/2021

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2022

CVE-2021-25200

Publication date:

30/07/2021

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\student_avatar.php.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2021