Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-25268
Publication date:
23/03/2022
Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
Severity CVSS v4.0: Pending analysis
Last modification:
29/03/2022

CVE-2022-25269
Publication date:
23/03/2022
Passwork On-Premise Edition before 4.6.13 has multiple XSS issues.
Severity CVSS v4.0: Pending analysis
Last modification:
29/03/2022

CVE-2022-22819
Publication date:
23/03/2022
NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-24934
Publication date:
23/03/2022
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
Severity CVSS v4.0: Pending analysis
Last modification:
31/03/2022

CVE-2022-27254
Publication date:
23/03/2022
The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.
Severity CVSS v4.0: Pending analysis
Last modification:
31/03/2022

CVE-2022-25041
Publication date:
23/03/2022
OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.
Severity CVSS v4.0: Pending analysis
Last modification:
29/03/2022

CVE-2022-24768
Publication date:
23/03/2022
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications.
Severity CVSS v4.0: Pending analysis
Last modification:
07/08/2024

CVE-2022-27192
Publication date:
23/03/2022
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2020-20094
Publication date:
23/03/2022
Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2020-20093
Publication date:
23/03/2022
The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2020-20095
Publication date:
23/03/2022
iMessage (Messages app) iOS 12.4 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2020-20096
Publication date:
23/03/2022
Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022
Subscribe to Vulnerabilities