Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-3973
Publication date:
08/07/2020
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.
Severity CVSS v4.0: Pending analysis
Last modification:
15/07/2020

CVE-2020-3931
Publication date:
08/07/2020
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.
Severity CVSS v4.0: Pending analysis
Last modification:
16/07/2020

CVE-2020-15600
Publication date:
07/07/2020
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
Severity CVSS v4.0: Pending analysis
Last modification:
04/01/2022

CVE-2020-8916
Publication date:
07/07/2020
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to restrict access in your debug environments.
Severity CVSS v4.0: Pending analysis
Last modification:
16/07/2020

CVE-2020-15599
Publication date:
07/07/2020
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2020

CVE-2020-15008
Publication date:
07/07/2020
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user supplied table name with little validation, the table name can be modified to allow arbitrary update commands to be run. Usage of other SQL injection techniques such as timing attacks, it is possible to perform full data extraction as well. Patched in 2020.7 and in a hotfix for 2019.12.
Severity CVSS v4.0: Pending analysis
Last modification:
16/07/2020

CVE-2020-12821
Publication date:
07/07/2020
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
Severity CVSS v4.0: Pending analysis
Last modification:
15/07/2020

CVE-2020-8521
Publication date:
07/07/2020
SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2020

CVE-2020-8519
Publication date:
07/07/2020
SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2020

CVE-2020-8520
Publication date:
07/07/2020
SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2020

CVE-2020-12736
Publication date:
07/07/2020
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-15095
Publication date:
07/07/2020
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023
Subscribe to Vulnerabilities