Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-7715

Publication date:

01/09/2020

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7716

Publication date:

01/09/2020

All versions of package deeps are vulnerable to Prototype Pollution via the set function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7717

Publication date:

01/09/2020

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7718

Publication date:

01/09/2020

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7719

Publication date:

01/09/2020

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7720

Publication date:

01/09/2020

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7721

Publication date:

01/09/2020

All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7722

Publication date:

01/09/2020

All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7723

Publication date:

01/09/2020

All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7724

Publication date:

01/09/2020

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-7713

Publication date:

01/09/2020

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2020-12776

Publication date:

01/09/2020

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

Subscribe to Vulnerabilities