Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-1503

Publication date:

04/06/2021

A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-1517

Publication date:

04/06/2021

A vulnerability in the multimedia viewer feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to bypass security protections. This vulnerability is due to unsafe handling of shared content within the multimedia viewer feature. An attacker could exploit this vulnerability by sharing a file through the multimedia viewer feature. A successful exploit could allow the attacker to bypass security protections and prevent warning dialogs from appearing before files are offered to other users.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-1502

Publication date:

04/06/2021

A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. The vulnerability is due to insufficient validation of values within Webex recording files formatted as either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit the vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-1527

Publication date:

04/06/2021

A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory state information that is related to the vulnerable application. The vulnerability is due to insufficient validation of values in Webex recording files that are stored in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a malicious WRF file to a user as a link or email attachment and then persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the affected software and view memory state information.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-1525

Publication date:

04/06/2021

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability by persuading a user to follow a specially crafted URL that is designed to cause Cisco Webex Meetings to include a remote file in the web UI. A successful exploit could allow the attacker to cause the application to offer a remote file to a user, which could allow the attacker to conduct further phishing or spoofing attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-36139

Publication date:

04/06/2021

BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the &#39;fileurl&#39; parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2020-36140

Publication date:

04/06/2021

BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via &#39;mode=settings&page=editor&#39;, as demonstrated by use of &#39;mode=settings&page=editor&#39; to change any file content (Locally/Remotely).

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2020-36141

Publication date:

04/06/2021

BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting &#39;image/jpeg&#39; within the &#39;Content-Type&#39; header.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2020-36142

Publication date:

04/06/2021

BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting &#39;../&#39; payloads within the &#39;fileurl&#39; parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024

CVE-2021-33054

Publication date:

04/06/2021

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2022

CVE-2021-28091

Publication date:

04/06/2021

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-27657

Publication date:

04/06/2021

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2021

Subscribe to Vulnerabilities