Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-35151
Publication date:
21/12/2020
The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection.
Severity CVSS v4.0: Pending analysis
Last modification:
14/11/2023

CVE-2020-11717
Publication date:
21/12/2020
An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020

CVE-2018-7580
Publication date:
21/12/2020
Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of the hub's functionality will be unresponsive. The cloud service also won't work with the hub.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2022

CVE-2020-35606
Publication date:
21/12/2020
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2022

CVE-2020-35605
Publication date:
21/12/2020
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2020-21378
Publication date:
21/12/2020
SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020

CVE-2020-21377
Publication date:
21/12/2020
SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020

CVE-2020-35604
Publication date:
21/12/2020
An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020

CVE-2020-6881
Publication date:
21/12/2020
ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device to deny service. This affects:
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020

CVE-2020-4843
Publication date:
21/12/2020
IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048.
Severity CVSS v4.0: Pending analysis
Last modification:
21/12/2020

CVE-2020-4840
Publication date:
21/12/2020
IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 190044.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020

CVE-2020-4842
Publication date:
21/12/2020
IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190046.
Severity CVSS v4.0: Pending analysis
Last modification:
22/12/2020
Subscribe to Vulnerabilities