Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-21835

Publication date:

25/08/2021

An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when decoding the atom associated with the “csgp” FOURCC can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2022

CVE-2021-21836

Publication date:

25/08/2021

An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input using the “ctts” FOURCC code can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2022

CVE-2021-1523

Publication date:

25/08/2021

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause a queue wedge on a leaf switch, which could result in critical control plane traffic to the device being dropped. This could result in one or more leaf switches being removed from the fabric. This vulnerability is due to mishandling of ingress TCP traffic to a specific port. An attacker could exploit this vulnerability by sending a stream of TCP packets to a specific port on a Switched Virtual Interface (SVI) configured on the device. A successful exploit could allow the attacker to cause a specific packet queue to queue network buffers but never process them, leading to an eventual queue wedge. This could cause control plane traffic to be dropped, resulting in a denial of service (DoS) condition where the leaf switches are unavailable. Note: This vulnerability requires a manual intervention to power-cycle the device to recover.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-39160

Publication date:

25/08/2021

nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2022

CVE-2021-39136

Publication date:

25/08/2021

baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2021

CVE-2020-18972

Publication date:

25/08/2021

Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via &#39;IsNextToken&#39; in the component &#39;src/base/PdfToenizer.cpp&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-18974

Publication date:

25/08/2021

Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via &#39;crc64i&#39; in the component &#39;nasmlib/crc64&#39;. This issue is different than CVE-2019-7147.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-18976

Publication date:

25/08/2021

Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the &#39;do_checksum&#39; function in &#39;checksum.c&#39;. It can be triggered by sending a crafted pcap file to the &#39;tcpreplay-edit&#39; binary. This issue is different than CVE-2019-8381.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-18971

Publication date:

25/08/2021

Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component &#39;src/base/PdfDictionary.cpp:65&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2018-10790

Publication date:

25/08/2021

The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2021-33605

Publication date:

25/08/2021

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2021

CVE-2021-33886

Publication date:

25/08/2021

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

Subscribe to Vulnerabilities