Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-37164

Publication date:

02/08/2021

A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. In the tcpTxThread function, the received data is copied to a stack buffer. An off-by-3 condition can occur, resulting in a stack-based buffer overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-37166

Publication date:

02/08/2021

A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When HMI3 starts up, it binds a local service to a TCP port on all interfaces of the device, and takes extensive time for the GUI to connect to the TCP socket, allowing the connection to be hijacked by an external attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-37216

Publication date:

02/08/2021

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24504

Publication date:

02/08/2021

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-33527

Publication date:

02/08/2021

In MB connect line mbDIALUP versions

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2022

CVE-2021-34574

Publication date:

02/08/2021

In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2023

CVE-2021-24503

Publication date:

02/08/2021

The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24498

Publication date:

02/08/2021

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the &#39;start&#39; and &#39;end&#39; GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-37165

Publication date:

02/08/2021

A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When a message is sent to the HMI TCP socket, it is forwarded to the hmiProcessMsg function through the pendingQ, and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-34575

Publication date:

02/08/2021

In MB connect line mymbCONNECT24, mbCONNECT24 in versions

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-33526

Publication date:

02/08/2021

In MB connect line mbDIALUP versions

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24472

Publication date:

02/08/2021

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2021

Subscribe to Vulnerabilities