Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-27920
Publication date:
25/03/2022
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-27906
Publication date:
25/03/2022
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
Severity CVSS v4.0: Pending analysis
Last modification:
01/04/2022

CVE-2022-27919
Publication date:
25/03/2022
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-27887
Publication date:
25/03/2022
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2022-27886
Publication date:
25/03/2022
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2022-27885
Publication date:
25/03/2022
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2022-27884
Publication date:
25/03/2022
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2022-0759
Publication date:
25/03/2022
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
Severity CVSS v4.0: Pending analysis
Last modification:
07/04/2022

CVE-2022-0983
Publication date:
25/03/2022
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-25606
Publication date:
25/03/2022
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2022-25590
Publication date:
25/03/2022
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.
Severity CVSS v4.0: Pending analysis
Last modification:
31/03/2022

CVE-2022-0988
Publication date:
25/03/2022
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.
Severity CVSS v4.0: Pending analysis
Last modification:
01/04/2022
Subscribe to Vulnerabilities