Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-26990
Publication date:
19/03/2021
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files.
Severity CVSS v4.0: Pending analysis
Last modification:
23/03/2021

CVE-2021-26991
Publication date:
19/03/2021
Cloud Manager versions prior to 3.9.4 contain an insecure Cross-Origin Resource Sharing (CORS) policy which could allow a remote attacker to interact with Cloud Manager.
Severity CVSS v4.0: Pending analysis
Last modification:
23/03/2021

CVE-2021-26992
Publication date:
19/03/2021
Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability which could allow a remote attacker to cause a Denial of Service (DoS).
Severity CVSS v4.0: Pending analysis
Last modification:
23/03/2021

CVE-2021-20077
Publication date:
19/03/2021
Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.
Severity CVSS v4.0: Pending analysis
Last modification:
28/10/2022

CVE-2021-27519
Publication date:
19/03/2021
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/12/2021

CVE-2021-27520
Publication date:
19/03/2021
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/12/2021

CVE-2019-10127
Publication date:
19/03/2021
A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.
Severity CVSS v4.0: Pending analysis
Last modification:
01/01/2022

CVE-2021-25278
Publication date:
19/03/2021
FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.
Severity CVSS v4.0: Pending analysis
Last modification:
22/03/2021

CVE-2021-25277
Publication date:
19/03/2021
FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.
Severity CVSS v4.0: Pending analysis
Last modification:
22/03/2021

CVE-2021-27906
Publication date:
19/03/2021
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-27807
Publication date:
19/03/2021
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-4635
Publication date:
19/03/2021
IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.
Severity CVSS v4.0: Pending analysis
Last modification:
24/03/2021
Subscribe to Vulnerabilities