Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-41866

Publication date:

26/10/2021

MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP&#39;s theme management is not escaped properly.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2020-22864

Publication date:

26/10/2021

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary web scripts or HTML.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2022

CVE-2019-3556

Publication date:

26/10/2021

HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2021

CVE-2021-35499

Publication date:

26/10/2021

The Web Reporting component of TIBCO Software Inc.&#39;s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim&#39;s local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.&#39;s TIBCO Nimbus: versions 10.4.0 and below.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-41182

Publication date:

26/10/2021

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

Severity CVSS v4.0: Pending analysis

Last modification:

31/08/2023

CVE-2021-41183

Publication date:

26/10/2021

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

Severity CVSS v4.0: Pending analysis

Last modification:

31/08/2023

CVE-2021-41188

Publication date:

26/10/2021

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-41185

Publication date:

26/10/2021

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2021

CVE-2021-41184

Publication date:

26/10/2021

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2021-41175

Publication date:

26/10/2021

Pi-hole&#39;s Web interface (based on AdminLTE) provides a central location to manage one&#39;s Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-41173

Publication date:

26/10/2021

Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-41172

Publication date:

26/10/2021

AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is patched in version 0.5.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2021

Subscribe to Vulnerabilities