Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-12062

Publication date:

01/08/2017

An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The &#39;filter&#39; field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11379

Publication date:

01/08/2017

Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11380

Publication date:

01/08/2017

Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12061

Publication date:

01/08/2017

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11381

Publication date:

01/08/2017

A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2015-5059

Publication date:

01/08/2017

The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11129

Publication date:

01/08/2017

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with access to the keystore can read the content out, for example the private key of the user.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11133

Publication date:

01/08/2017

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11130

Publication date:

01/08/2017

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product&#39;s protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackers can conduct replay attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11131

Publication date:

01/08/2017

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authentication. Moreover, only the first 32 bytes of the hash are used. This allows for easy dictionary and rainbow-table attacks if an attacker has access to the password hash.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11132

Publication date:

01/08/2017

An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-11134

Publication date:

01/08/2017

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

Subscribe to Vulnerabilities