Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-13249

Publication date:

20/05/2020

libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-13241

Publication date:

20/05/2020

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.

Severity CVSS v4.0: Pending analysis

Last modification:

22/05/2020

CVE-2020-9484

Publication date:

20/05/2020

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-13246

Publication date:

20/05/2020

An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository&#39;s ownership from one organization to another.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2020

CVE-2020-11078

Publication date:

20/05/2020

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-13239

Publication date:

20/05/2020

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2022

CVE-2020-13240

Publication date:

20/05/2020

The DMS/ECM module in Dolibarr 11.0.4 allows users with the &#39;Setup documents directories&#39; permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2022

CVE-2020-11716

Publication date:

20/05/2020

Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. NOTE: the vendor states that all affected products are at "End-of-software-support."

Severity CVSS v4.0: Pending analysis

Last modification:

03/03/2023

CVE-2020-10725

Publication date:

20/05/2020

A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-10726

Publication date:

20/05/2020

A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-13230

Publication date:

20/05/2020

In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs).

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023