Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-27152
Publication date:
06/11/2020
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.
Severity CVSS v4.0: Pending analysis
Last modification:
16/11/2020

CVE-2020-17490
Publication date:
06/11/2020
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-26521
Publication date:
06/11/2020
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-26892
Publication date:
06/11/2020
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-27616
Publication date:
06/11/2020
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
Severity CVSS v4.0: Pending analysis
Last modification:
01/01/2022

CVE-2020-27617
Publication date:
06/11/2020
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2022

CVE-2020-25592
Publication date:
06/11/2020
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-16846
Publication date:
06/11/2020
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2025

CVE-2020-28196
Publication date:
06/11/2020
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Severity CVSS v4.0: Pending analysis
Last modification:
03/12/2025

CVE-2020-28249
Publication date:
06/11/2020
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.
Severity CVSS v4.0: Pending analysis
Last modification:
12/11/2020

CVE-2020-28250
Publication date:
06/11/2020
Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2020

CVE-2020-28242
Publication date:
06/11/2020
An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.
Severity CVSS v4.0: Pending analysis
Last modification:
15/08/2024
Subscribe to Vulnerabilities