Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-31340
Publication date:
17/04/2025
A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.
Severity CVSS v4.0: CRITICAL
Last modification:
17/04/2025

CVE-2025-43715
Publication date:
17/04/2025
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-43717
Publication date:
17/04/2025
In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-31338
Publication date:
17/04/2025
A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality.
Severity CVSS v4.0: MEDIUM
Last modification:
17/04/2025

CVE-2025-1290
Publication date:
17/04/2025
A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure <br /> during an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-43708
Publication date:
17/04/2025
VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference=&amp;#39;../../../set/set[2]&amp;#39; is used, aka an "insecure deserialization" issue.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-24907
Publication date:
16/04/2025
Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &amp;#39;.../...//&amp;#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-24908
Publication date:
16/04/2025
Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &amp;#39;.../...//&amp;#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-24909
Publication date:
16/04/2025
Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim&amp;#39;s machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-24910
Publication date:
16/04/2025
Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Pentaho Data Integration MessageSourceCrawler against out-of-band XML External Entity Reference. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-24911
Publication date:
16/04/2025
Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of a URI. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g. in an error message), thereby exposing the file contents. (CWE-611) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.2, including 9.3.x and 8.3.x, do not correctly protect Data Access XMLParserFactoryProducer against out-of-band XML External Entity Reference. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. Using URIs with other schemes such as http://, the attacker can force the application to make outgoing requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions or hide the source of attacks such as port scanning.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-43704
Publication date:
16/04/2025
Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025
Subscribe to Vulnerabilities