Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2003-0391

Publication date:

02/07/2003

Format string vulnerability in Magic WinMail Server 2.3, and possibly other 2.x versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the PASS command.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0392

Publication date:

02/07/2003

Directory traversal vulnerability in ST FTP Service 3.0 allows remote attackers to list arbitrary directories via a CD command with a DoS drive letter argument (e.g. E:).

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0393

Publication date:

02/07/2003

Privacyware Privatefirewall 3.0 does not block certain incoming packets when in "Filter Internet Traffic" or Deny Internet Traffic" modes, which allows remote attackers to identify running services via FIN scans or Xmas scans.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0394

Publication date:

02/07/2003

objects.inc.php4 in BLNews 2.1.3 allows remote attackers to execute arbitrary PHP code via a Server[path] parameter that points to malicious code on an attacker-controlled web site.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0397

Publication date:

02/07/2003

Buffer overflow in FastTrack (FT) network code, as used in Kazaa 2.0.2 and possibly other versions and products, allows remote attackers to execute arbitrary code via a packet containing a large list of supernodes, aka "Packet 0&#39; death."

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0398

Publication date:

02/07/2003

Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, with the SSI EXEC feature enabled, allows remote attackers to execute arbitrary code via a text variable to a Vignette Application that is later displayed.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0399

Publication date:

02/07/2003

Vignette StoryServer 4 and 5, Vignette V/5, and possibly other versions allows remote attackers to perform unauthorized SELECT queries by setting the vgn_creds cookie to an arbitrary value and directly accessing the save template.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0395

Publication date:

02/07/2003

Ultimate PHP Board (UPB) 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes admin_iplog.php.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0367

Publication date:

02/07/2003

znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0400

Publication date:

30/06/2003

Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using the "-->" string in a CookieName argument to the login template, referred to as a "memory leak" in some reports.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0401

Publication date:

30/06/2003

Vignette StoryServer and Vignette V/5 allows remote attackers to obtain sensitive information via a request for the /vgn/style template.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0402

Publication date:

30/06/2003

The default login template (/vgn/login) in Vignette StoryServer 5 and Vignette V/5 generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities