Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-13313

Publication date:

24/02/2020

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2020

CVE-2020-5244

Publication date:

24/02/2020

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2020

CVE-2020-9369

Publication date:

24/02/2020

Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-5245

Publication date:

24/02/2020

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature.<br /> <br /> The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2024

CVE-2019-10798

Publication date:

24/02/2020

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

Severity CVSS v4.0: Pending analysis

Last modification:

05/03/2020

CVE-2019-10799

Publication date:

24/02/2020

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2019-10796

Publication date:

24/02/2020

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2020-9366

Publication date:

24/02/2020

A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2012-0785

Publication date:

24/02/2020

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2020-9365

Publication date:

24/02/2020

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-9362

Publication date:

24/02/2020

The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Security, Total Security Multi-Device, Internet Security, Total Security for Mac, AntiVirus Pro, AntiVirus for Server, and Total Security for Android.

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2022

CVE-2020-9363

Publication date:

24/02/2020

The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2022

Subscribe to Vulnerabilities