Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-37131

Publication date:

27/10/2021

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2021

CVE-2011-4126

Publication date:

27/10/2021

Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2021-26610

Publication date:

27/10/2021

The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2021

CVE-2021-37122

Publication date:

27/10/2021

There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Affected product versions include:CloudEngine 12800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 5800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 6800 V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800;CloudEngine 7800 V200R005C10SPC800,V200R019C00SPC800.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-37124

Publication date:

27/10/2021

There is a path traversal vulnerability in Huawei PC product. Because the product does not filter path with special characters,attackers can construct a file path with special characters to exploit this vulnerability. Successful exploitation could allow the attacker to transport a file to certain path.Affected product versions include:PC Smart Full Scene 11.1 versions PCManager 11.1.1.97.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-35236

Publication date:

27/10/2021

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2022

CVE-2021-38450

Publication date:

27/10/2021

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2023

CVE-2011-4124

Publication date:

27/10/2021

Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2011-4125

Publication date:

27/10/2021

A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2021-23877

Publication date:

26/10/2021

Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of the trial version of MTP.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-41866

Publication date:

26/10/2021

MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP&#39;s theme management is not escaped properly.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2020-22864

Publication date:

26/10/2021

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary web scripts or HTML.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2022

Subscribe to Vulnerabilities