Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-11323

Publication date:

19/08/2017

Stack-based buffer overflow in ESTsoft ALZip 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted MS-DOS device file, as demonstrated by use of "AUX" as the initial substring of a filename.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12955

Publication date:

18/08/2017

There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12956

Publication date:

18/08/2017

There is an illegal address access in Exiv2::FileIo::path[abi:cxx11]() in basicio.cpp of libexiv2 in Exiv2 0.26 that will lead to remote denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12963

Publication date:

18/08/2017

There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor&#39;s CVE-2017-11555 fix (available from GitHub after 2017-07-24).

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12958

Publication date:

18/08/2017

There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12961

Publication date:

18/08/2017

There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12957

Publication date:

18/08/2017

There is a heap-based buffer over-read in libexiv2 in Exiv2 0.26 that is triggered in the Exiv2::Image::io function in image.cpp. It will lead to remote denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12959

Publication date:

18/08/2017

There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a remote denial of service attack.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12960

Publication date:

18/08/2017

There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12962

Publication date:

18/08/2017

There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of open parenthesis characters, leading to a remote denial of service attack.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025

CVE-2017-12964

Publication date:

18/08/2017

There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2025