Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-7649

Publication date:

11/09/2017

The network enabled distribution of Kura before 2.1.0 takes control over the device&#39;s firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-7650

Publication date:

11/09/2017

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to &#39;#&#39; or &#39;+&#39;. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14238

Publication date:

11/09/2017

SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14239

Publication date:

11/09/2017

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14240

Publication date:

11/09/2017

There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14241

Publication date:

11/09/2017

Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14242

Publication date:

11/09/2017

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14247

Publication date:

11/09/2017

SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2017-1000060.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14248

Publication date:

11/09/2017

A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service via a crafted file.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14249

Publication date:

11/09/2017

ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allowing remote attackers to cause a denial of service via a crafted file.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-14251

Publication date:

11/09/2017

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026