Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-27755

Publication date:

21/02/2022

"Sametime Android potential path traversal vulnerability when using File class"

Severity CVSS v4.0: Pending analysis

Last modification:

02/03/2022

CVE-2021-26256

Publication date:

21/02/2022

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2022

CVE-2022-0708

Publication date:

21/02/2022

Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2022

CVE-2021-27797

Publication date:

21/02/2022

Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the system.

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2022

CVE-2022-0564

Publication date:

21/02/2022

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.<br /> <br /> The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.

Severity CVSS v4.0: Pending analysis

Last modification:

25/04/2025

CVE-2021-44141

Publication date:

21/02/2022

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

Severity CVSS v4.0: Pending analysis

Last modification:

17/09/2023

CVE-2021-44142

Publication date:

21/02/2022

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2022-0692

Publication date:

21/02/2022

Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2022

CVE-2021-45008

Publication date:

21/02/2022

Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

CVE-2022-24553

Publication date:

21/02/2022

An issue was found in Zfaka

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2022

CVE-2021-4208

Publication date:

21/02/2022

The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2022

CVE-2022-0134

Publication date:

21/02/2022

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2022

Subscribe to Vulnerabilities