Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-24707
Publication date:
28/10/2020
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2020

CVE-2020-24713
Publication date:
28/10/2020
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2020

CVE-2020-24710
Publication date:
28/10/2020
Gophish before 0.11.0 allows SSRF attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2020

CVE-2020-24712
Publication date:
28/10/2020
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2020

CVE-2020-24708
Publication date:
28/10/2020
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
Severity CVSS v4.0: Pending analysis
Last modification:
29/10/2020

CVE-2020-24709
Publication date:
28/10/2020
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
Severity CVSS v4.0: Pending analysis
Last modification:
29/10/2020

CVE-2020-25374
Publication date:
28/10/2020
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-27742
Publication date:
28/10/2020
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2020

CVE-2020-27980
Publication date:
28/10/2020
Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2020

CVE-2020-24990
Publication date:
28/10/2020
An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request, as demonstrated by reading /etc/passwd or /proc/version.
Severity CVSS v4.0: Pending analysis
Last modification:
17/11/2020

CVE-2020-27741
Publication date:
28/10/2020
Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2020

CVE-2020-27740
Publication date:
28/10/2020
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2020
Subscribe to Vulnerabilities