Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-3441
Publication date:
29/10/2021
A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS).
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2021-22038
Publication date:
29/10/2021
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus gaining Administrator privileges (if the original uninstaller was executed as Administrator). The vulnerability only affects Windows installers.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2021-3662
Publication date:
29/10/2021
Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS).
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2021

CVE-2021-22037
Publication date:
29/10/2021
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2021-31624
Publication date:
29/10/2021
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the urls parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2021

CVE-2021-31627
Publication date:
29/10/2021
Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arbitrary code via the index parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2021-31862
Publication date:
29/10/2021
SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-22079
Publication date:
29/10/2021
Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg.
Severity CVSS v4.0: Pending analysis
Last modification:
26/10/2022

CVE-2021-25742
Publication date:
29/10/2021
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
Severity CVSS v4.0: Pending analysis
Last modification:
15/12/2021

CVE-2020-23546
Publication date:
28/10/2021
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM file, related to a "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at FORMATS!ReadMosaic+0x0000000000000981.
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2021

CVE-2020-23549
Publication date:
28/10/2021
IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted .cr2 file, related to a "Data from Faulting Address controls Branch Selection starting at FORMATS!GetPlugInInfo+0x00000000000047f6".
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2021

CVE-2021-36551
Publication date:
28/10/2021
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module.
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2021
Subscribe to Vulnerabilities