Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2005-2104

Publication date:

07/10/2005

sysreport before 1.3.7 allows local users to obtain sensitive information via a symlink attack on a temporary directory.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3178

Publication date:

07/10/2005

Buffer overflow in xloadimage 4.1 and earlier, and xli, might allow user-assisted attackers to execute arbitrary code via a long title name in a NIFF file, which triggers the overflow during (1) zoom, (2) reduce, or (3) rotate operations.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3117

Publication date:

06/10/2005

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2005-3150. Reason: This candidate was privately assigned by a CNA to an issue, but the issue was published through separate channels and assigned a new identifier by the MITRE CNA, so it is a duplicate of CVE-2005-3150. Notes: All CVE users should reference CVE-2005-3150 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2005-3118

Publication date:

06/10/2005

Mason before 1.0.0 does not install the init script after the user uses Mason to configure a firewall, which causes the system to run without a firewall after a reboot.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3160

Publication date:

06/10/2005

Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3163

Publication date:

06/10/2005

Unspecified vulnerability in Polipo 0.9.8 and earlier allows attackers to read files outside of the web root.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3165

Publication date:

06/10/2005

Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 allow remote attackers to inject arbitrary web script or HTML via (1) tags or (2) Extension or sections that "bypass HTML style attribute restrictions" that are intended to protect against XSS vulnerabilities in Internet Explorer clients.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3166

Publication date:

06/10/2005

Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service (corruption of the previous submission) via a crafted URL.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3167

Publication date:

06/10/2005

Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs (HTML inline style attributes) that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting (XSS) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3168

Publication date:

06/10/2005

The SECEDIT command on Microsoft Windows 2000 before Update Rollup 1 for SP4, when using a security template to set Access Control Lists (ACLs) on folders, does not apply ACLs on folders that are listed after a long folder entry, which could result in less secure permissions than specified by the template.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3169

Publication date:

06/10/2005

Microsoft Windows 2000 before Update Rollup 1 for SP4, when the "audit directory service access" policy is enabled, does not record a 565 event message for File Delete Child operations on an Active Directory object in the security event log, which could allow attackers to conduct unauthorized activities without detection.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2005-3170

Publication date:

06/10/2005

The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates using LDAP Secure Sockets Layer (LDAPS) even when the Certificate Authority (CA) is not trusted, which could allow attackers to trick users into believing that they are accessing a trusted site.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities