Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-5245

Publication date:

24/02/2020

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.<br /> <br /> The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2024

CVE-2019-10798

Publication date:

24/02/2020

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

Severity CVSS v4.0: Pending analysis

Last modification:

05/03/2020

CVE-2019-10799

Publication date:

24/02/2020

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2019-10796

Publication date:

24/02/2020

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2020-9366

Publication date:

24/02/2020

A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2012-0785

Publication date:

24/02/2020

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2020-9365

Publication date:

24/02/2020

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-9362

Publication date:

24/02/2020

The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Security, Total Security Multi-Device, Internet Security, Total Security for Mac, AntiVirus Pro, AntiVirus for Server, and Total Security for Android.

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2022

CVE-2020-9363

Publication date:

24/02/2020

The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2022

CVE-2019-4595

Publication date:

24/02/2020

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 167878.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2020

CVE-2020-4222

Publication date:

24/02/2020

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175091.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2020-4210

Publication date:

24/02/2020

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

Subscribe to Vulnerabilities