Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-34808

Publication date:

18/06/2021

Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

23/06/2021

CVE-2021-34809

Publication date:

18/06/2021

Improper neutralization of special elements used in a command (&#39;Command Injection&#39;) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2021

CVE-2021-34810

Publication date:

18/06/2021

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2021

CVE-2021-34553

Publication date:

18/06/2021

Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.

Severity CVSS v4.0: Pending analysis

Last modification:

22/06/2021

CVE-2021-32693

Publication date:

17/06/2021

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2021

CVE-2021-32426

Publication date:

17/06/2021

In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router&#39;s web interface via the "echo" command.

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2021

CVE-2021-32424

Publication date:

17/06/2021

In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router.

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2021

CVE-2021-32694

Publication date:

17/06/2021

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2021

CVE-2021-32695

Publication date:

17/06/2021

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose the malicious app. The shared preferences contain some limited private data such as push tokens and the account name. The vulnerability is patched in version 3.16.1.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2022

CVE-2021-33557

Publication date:

17/06/2021

An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2021

CVE-2021-32575

Publication date:

17/06/2021

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

Severity CVSS v4.0: Pending analysis

Last modification:

22/06/2021