Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2003-0649

Publication date:

27/08/2003

Buffer overflow in xpcd-svga for xpcd 2.08 and earlier allows local users to execute arbitrary code via a long HOME environment variable.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0653

Publication date:

27/08/2003

The OSI networking kernel (sys/netiso) in NetBSD 1.6.1 and earlier does not use a BSD-required "PKTHDR" mbuf when sending certain error responses to the sender of an OSI packet, which allows remote attackers to cause a denial of service (kernel panic or crash) via certain OSI packets.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0654

Publication date:

27/08/2003

Buffer overflow in autorespond may allow remote attackers to execute arbitrary code as the autorespond user via qmail.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0670

Publication date:

27/08/2003

Sustworks IPNetSentryX and IPNetMonitorX allow local users to sniff network packets via the setuid helper applications (1) RunTCPDump, which calls tcpdump, and (2) RunTCPFlow, which calls tcpflow.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0671

Publication date:

27/08/2003

Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0672

Publication date:

27/08/2003

Format string vulnerability in pam-pgsql 0.5.2 and earlier allows remote attackers to execute arbitrary code via the username that isp rovided during authentication, which is not properly handled when recording a log message.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0677

Publication date:

27/08/2003

Cisco CSS 11000 routers on the CS800 chassis allow remote attackers to cause a denial of service (CPU consumption or reboot) via a large number of TCP SYN packets to the circuit IP address, aka "ONDM Ping failure."

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0679

Publication date:

27/08/2003

Unknown vulnerability in the libcpr library for the Checkpoint/Restart (cpr) system on SGI IRIX 6.5.21f and earlier allows local users to truncate or overwrite certain files.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0421

Publication date:

27/08/2003

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0426

Publication date:

27/08/2003

The installation of Apple QuickTime / Darwin Streaming Server before 4.1.3f starts the administration server with a "Setup Assistant" page that allows remote attackers to set the administrator password and gain privileges before the real administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0599

Publication date:

27/08/2003

Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown implications, related to the VFS path being under the web document root.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2003-0602

Publication date:

27/08/2003

Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1) multiple default German and Russian HTML templates or (2) ALT and NAME attributes in AREA tags as used by the GraphViz graph generation feature for local dependency graphs.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities