Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-34370

Publication date:

09/06/2021

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2024

CVE-2021-3532

Publication date:

09/06/2021

Rejected reason: This CVE is marked as INVALID and not a bug

Severity CVSS v4.0: Pending analysis

Last modification:

15/01/2024

CVE-2021-33842

Publication date:

09/06/2021

Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located.

Severity CVSS v4.0: Pending analysis

Last modification:

23/11/2023

CVE-2021-26314

Publication date:

09/06/2021

Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-33829

Publication date:

09/06/2021

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-33841

Publication date:

09/06/2021

SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

22/11/2023

CVE-2021-26313

Publication date:

09/06/2021

Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data leakage.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2022

CVE-2021-34364

Publication date:

09/06/2021

The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2021

CVE-2020-11304

Publication date:

09/06/2021

Possible out of bound read in DRM due to improper buffer length check. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2021

CVE-2021-1937

Publication date:

09/06/2021

Reachable assertion is possible while processing peer association WLAN message from host and nonstandard incoming packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2021

CVE-2020-11306

Publication date:

09/06/2021

Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2021

CVE-2021-1900

Publication date:

09/06/2021

Possible use after free in Display due to race condition while creating an external display in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2021

Subscribe to Vulnerabilities