Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-10862

Publication date:

01/04/2020

An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to achieve Local Privilege Escalation (LPE) via RPC.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-10863

Publication date:

01/04/2020

An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to trigger a shutdown via RPC from a Low Integrity process via TempShutDownMachine.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-10860

Publication date:

01/04/2020

An issue was discovered in Avast Antivirus before 20. An Arbitrary Memory Address Overwrite vulnerability in the aswAvLog Log Library results in Denial of Service of the Avast Service (AvastSvc.exe).

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2020

CVE-2019-3942

Publication date:

01/04/2020

Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2020

CVE-2019-3945

Publication date:

01/04/2020

Web server running on Parrot ANAFI can be crashed due to the SDK command "Common_CurrentDateTime" being sent to control service with larger than expected date length.

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2020

CVE-2019-3944

Publication date:

01/04/2020

Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2020

CVE-2018-11106

Publication date:

01/04/2020

NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-11455

Publication date:

01/04/2020

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.

Severity CVSS v4.0: Pending analysis

Last modification:

30/07/2022

CVE-2020-11456

Publication date:

01/04/2020

LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).

Severity CVSS v4.0: Pending analysis

Last modification:

30/07/2022

CVE-2020-11457

Publication date:

01/04/2020

pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.

Severity CVSS v4.0: Pending analysis

Last modification:

06/04/2020

CVE-2020-11449

Publication date:

01/04/2020

An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2020

CVE-2020-10231

Publication date:

01/04/2020

TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_171205, NC250 through 1.3.0_Build_171205, NC260 through 1.5.1_Build_190805, and NC450 through 1.5.0_Build_181022 devices allow a remote NULL Pointer Dereference.

Severity CVSS v4.0: Pending analysis

Last modification:

12/05/2020

Subscribe to Vulnerabilities