Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-46764
Publication date:
09/05/2023
Improper validation of DRAM addresses in SMU may<br /> allow an attacker to overwrite sensitive memory locations within the ASP<br /> potentially resulting in a denial of service.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-46763
Publication date:
09/05/2023
Insufficient input validation in the SMU may<br /> enable a privileged attacker to write beyond the intended bounds of a shared<br /> memory buffer potentially leading to a loss of integrity.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-46762
Publication date:
09/05/2023
Insufficient input validation in the SMU may<br /> allow an attacker to corrupt SMU SRAM potentially leading to a loss of<br /> integrity or denial of service.
Severity CVSS v4.0: Pending analysis
Last modification:
18/06/2024

CVE-2021-46753
Publication date:
09/05/2023
Failure to validate the length fields of the ASP<br /> (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a<br /> malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite<br /> data structures leading to a potential loss of confidentiality and integrity.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26356
Publication date:
09/05/2023
A TOCTOU in ASP bootloader may allow an attacker<br /> to tamper with the SPI ROM following data read to memory potentially resulting<br /> in S3 data corruption and information disclosure.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26379
Publication date:
09/05/2023
Insufficient input validation of mailbox data in the<br /> SMU may allow an attacker to coerce the SMU to corrupt SMRAM, potentially<br /> leading to a loss of integrity and privilege escalation.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26371
Publication date:
09/05/2023
A compromised or malicious ABL or UApp could<br /> send a SHA256 system call to the bootloader, which may result in exposure of<br /> ASP memory to userspace, potentially leading to information disclosure.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26354
Publication date:
09/05/2023
Insufficient bounds checking in ASP may allow an<br /> attacker to issue a system call from a compromised ABL which may cause<br /> arbitrary memory values to be initialized to zero, potentially leading to a<br /> loss of integrity.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26365
Publication date:
09/05/2023
Certain size values in firmware binary headers<br /> could trigger out of bounds reads during signature validation, leading to<br /> denial of service or potentially limited leakage of information about<br /> out-of-bounds memory contents.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26397
Publication date:
09/05/2023
Insufficient address validation, may allow an<br /> attacker with a compromised ABL and UApp to corrupt sensitive memory locations<br /> potentially resulting in a loss of integrity or availability.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-46749
Publication date:
09/05/2023
Insufficient bounds checking in ASP (AMD Secure<br /> Processor) may allow for an out of bounds read in SMI (System Management<br /> Interface) mailbox checksum calculation triggering a data abort, resulting in a<br /> potential denial of service.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2021-26406
Publication date:
09/05/2023
Insufficient validation in parsing Owner&amp;#39;s<br /> Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization)<br /> and SEV-ES user application can lead to a host crash potentially resulting in<br /> denial of service.<br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025
Subscribe to Vulnerabilities