Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2005-0016

Publication date:

14/04/2005

Buffer overflow in the exported_display function in xatitv in gatos before 0.0.5 allows local users to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0020

Publication date:

14/04/2005

Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0112

Publication date:

14/04/2005

The web-based administrative interface for 3Com OfficeConnect Wireless 11g Access Point (AP) 1.00.08, and possibly earlier versions before 1.03.07A, allows remote attackers to bypass authentication and obtain sensitive information by directly accessing the (1) config.bin (2) profile.wlp?PN=ggg or (3) event.logs URLs.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0129

Publication date:

14/04/2005

The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, which are recursively expanded by the Server::parseWildcards function when the Part Button is selected.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0130

Publication date:

14/04/2005

Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC scripts.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0131

Publication date:

14/04/2005

The Quick Connection dialog in Konversation 0.15 inadvertently uses the user-provided password as the nickname instead of the user-provided nickname when connecting to the IRC server, which could leak the password to other users.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-1118

Publication date:

14/04/2005

Cross-site scripting (XSS) vulnerability in IISWebAgentIF.dll in the RSA Authentication Agent for Web 5.2 allows remote attackers to inject arbitrary web script or HTML via the postdata parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-1136

Publication date:

14/04/2005

Simple PHP Blog (sphpBlog) 0.4.0 stores the (1) password.txt and (2) config.txt files under the web document root, which allows remote attackers to obtain sensitive information and crack passwords via a direct request to these files.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-1175

Publication date:

14/04/2005

fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0081

Publication date:

14/04/2005

MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via an HTTP request with invalid headers.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-0082

Publication date:

14/04/2005

The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0, and other versions before 7.5.0.21, allows remote attackers to cause a denial of service (crash) via invalid parameters to the WebDAV handler code, which triggers a null dereference that causes the SAP DB Web Agent to crash.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-1043

Publication date:

14/04/2005

exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities