Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-5553

Publication date:

23/01/2017

Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-5554

Publication date:

23/01/2017

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform&#39;s SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-5556

Publication date:

23/01/2017

The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-5563

Publication date:

23/01/2017

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-5574

Publication date:

23/01/2017

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-5575

Publication date:

23/01/2017

SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2017-5545

Publication date:

21/01/2017

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2014-2045

Publication date:

20/01/2017

Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when (1) logging in or (2) creating an account in the old interface, (3) username when creating an account in the new interface, (4) hostname in the old interface, (5) inspect parameter in the config module, (6) commands parameter in the atcommands tool, or (7) host parameter in the ping tool.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2014-9754

Publication date:

20/01/2017

The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint&#39;s SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2014-9755

Publication date:

20/01/2017

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2016-5316

Publication date:

20/01/2017

Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2016-5317

Publication date:

20/01/2017

Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

Subscribe to Vulnerabilities