Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-16268

Publication date:

29/12/2020

The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM (MST) with the option to disable the installation of the Nomad module. An attacker may craft a .reg file in a specific location that will be able to write to any registry key as an elevated user.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-27644

Publication date:

29/12/2020

The Inventory module of the 1E Client 5.0.0.745 doesn&#39;t handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges by placing a malicious cryptbase.dll file in %WINDIR%\Temp\.

Severity CVSS v4.0: Pending analysis

Last modification:

03/01/2021

CVE-2020-27645

Publication date:

29/12/2020

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2021

CVE-2020-27643

Publication date:

29/12/2020

The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories (where they would not normally have access to create or modify files) via the creation of a junction point to a system directory. This leads to partial privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2020-35735

Publication date:

29/12/2020

Vidyo 02-09-/D allows clickjacking via the portal/ URI.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2021

CVE-2020-9093

Publication date:

29/12/2020

There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specific message properly, which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would compromise normal service.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-9223

Publication date:

29/12/2020

There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2020

CVE-2020-9207

Publication date:

29/12/2020

There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not verify the input file properly. Attackers can exploit this vulnerability by crafting malicious files to bypass current verification mechanism. This can compromise normal service.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2020

CVE-2020-9125

Publication date:

29/12/2020

There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2). An attacker with specific permission can exploit this vulnerability by sending crafted packet with specific parameter to the target device. Due to insufficient validation of the parameter, successful exploit can cause the device to behave abnormally.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2020

CVE-2020-9094

Publication date:

29/12/2020

There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. A module does not deal with specific message properly. Attackers can exploit this vulnerability by sending malicious packet. This can lead to denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2020

CVE-2020-35774

Publication date:

29/12/2020

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.

Severity CVSS v4.0: Pending analysis

Last modification:

19/07/2022

CVE-2020-9124

Publication date:

29/12/2020

There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause memory leak.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

Subscribe to Vulnerabilities