Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-40188

Publication date:

11/10/2021

PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the server.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2021

CVE-2020-27372

Publication date:

11/10/2021

A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run_interpreter function.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2021

CVE-2021-40189

Publication date:

11/10/2021

PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2021

CVE-2021-40617

Publication date:

11/10/2021

An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.

Severity CVSS v4.0: Pending analysis

Last modification:

16/04/2025

CVE-2021-40239

Publication date:

11/10/2021

A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do_retr function in ftpproto.c

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2021

CVE-2021-25738

Publication date:

11/10/2021

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2022

CVE-2021-42252

Publication date:

11/10/2021

An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2021

CVE-2021-32028

Publication date:

11/10/2021

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

31/01/2023

CVE-2021-26588

Publication date:

11/10/2021

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2021

CVE-2021-25633

Publication date:

11/10/2021

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2021

CVE-2021-20121

Publication date:

11/10/2021

The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated user with physical access to the device can read arbitrary files from the device by preparing and connecting a specially prepared USB drive to the device, and making a series of crafted requests to the device&#39;s web interface.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2021

CVE-2021-22263

Publication date:

11/10/2021

An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with &#39;external&#39; status which is granted &#39;Maintainer&#39; role on any project on the GitLab instance where &#39;project tokens&#39; are allowed may elevate its privilege to &#39;Internal&#39; and access Internal projects.

Severity CVSS v4.0: Pending analysis

Last modification:

18/10/2021

Subscribe to Vulnerabilities