Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24029

Publication date:

15/03/2021

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2021

CVE-2021-20279

Publication date:

15/03/2021

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20282

Publication date:

15/03/2021

When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-26987

Publication date:

15/03/2021

Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2022

CVE-2021-20283

Publication date:

15/03/2021

The web service responsible for fetching other users&#39; enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20281

Publication date:

15/03/2021

It was possible for some users without permission to view other users&#39; full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-20280

Publication date:

15/03/2021

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-27278

Publication date:

15/03/2021

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical access to obtain admin privileges for the device’s configuration interface.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2021

CVE-2020-29553

Publication date:

15/03/2021

The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2021

CVE-2021-23879

Publication date:

15/03/2021

Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3150

Publication date:

15/03/2021

A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2021

CVE-2021-28363

Publication date:

15/03/2021

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn&#39;t given via proxy_config) doesn&#39;t verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2024

Subscribe to Vulnerabilities