Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-30545

Publication date:

15/06/2021

Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-30546

Publication date:

15/06/2021

Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-30548

Publication date:

15/06/2021

Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-30549

Publication date:

15/06/2021

Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24037

Publication date:

15/06/2021

A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Severity CVSS v4.0: Pending analysis

Last modification:

23/06/2021

CVE-2021-28857

Publication date:

15/06/2021

TP-Link&#39;s TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie.

Severity CVSS v4.0: Pending analysis

Last modification:

23/06/2021

CVE-2021-28858

Publication date:

15/06/2021

TP-Link&#39;s TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and other sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

23/06/2021

CVE-2021-3595

Publication date:

15/06/2021

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the &#39;tftp_t&#39; structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3592

Publication date:

15/06/2021

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the &#39;bootp_t&#39; structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3593

Publication date:

15/06/2021

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the &#39;udphdr&#39; structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-3594

Publication date:

15/06/2021

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the &#39;udphdr&#39; structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023