Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-45845
Publication date:
25/01/2022
The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd document.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2022

CVE-2022-23223
Publication date:
25/01/2022
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Severity CVSS v4.0: Pending analysis
Last modification:
16/10/2023

CVE-2021-45029
Publication date:
25/01/2022
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2022

CVE-2021-45803
Publication date:
25/01/2022
MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is added to the SQL query without additional verification when viewing reservation.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2022

CVE-2021-45802
Publication date:
25/01/2022
MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone parameter values are added to the SQL query without any verification at the time of membership registration.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2022

CVE-2021-45844
Publication date:
25/01/2022
Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2022

CVE-2021-45342
Publication date:
25/01/2022
A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-45343
Publication date:
25/01/2022
In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-45340
Publication date:
25/01/2022
In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a denial of service (DOS) via a crafted PICT file.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2022

CVE-2021-45341
Publication date:
25/01/2022
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-0268
Publication date:
25/01/2022
Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2022

CVE-2022-0338
Publication date:
25/01/2022
Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
02/08/2023
Subscribe to Vulnerabilities