Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-25265

Publication date:

02/12/2020

AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file that contains Name= with path components.

Severity CVSS v4.0: Pending analysis

Last modification:

08/12/2020

CVE-2020-29389

Publication date:

02/12/2020

The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2020

CVE-2020-13956

Publication date:

02/12/2020

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-28273

Publication date:

02/12/2020

Prototype pollution vulnerability in &#39;set-in&#39; versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/12/2020

CVE-2020-28272

Publication date:

02/12/2020

Prototype pollution vulnerability in &#39;keyget&#39; versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/12/2020

CVE-2020-25638

Publication date:

02/12/2020

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2020-12524

Publication date:

02/12/2020

Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-14369

Publication date:

02/12/2020

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-29458

Publication date:

02/12/2020

Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2020

CVE-2020-29456

Publication date:

02/12/2020

Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document&#39;s filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2020

CVE-2020-5423

Publication date:

02/12/2020

CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.

Severity CVSS v4.0: Pending analysis

Last modification:

04/12/2020