Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2004-2571

Publication date:

31/12/2004

Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (2) parseQmailToRemoteLine, (3) parseQmailToLocalLine, (4) parseSendmailFromBytesLine, (5) parseSendmailToLine, (6) parseEximFromBytesLine, and (7) parseEximToLine functions in Parser.c; allow local users to execute arbitrary code via the (8) lowercase and (9) check_syslog_date functions in Parser.c, and (10) unspecified functions in Dir.c; and allow unspecified attackers to execute arbitrary code via the (11) loadconfig and (12) removespaces functions in loadconfig.c, the (13) loadLang function in LangCfg.c, and (14) unspecified functions in Html.c.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2572

Publication date:

31/12/2004

AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2576

Publication date:

31/12/2004

class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users&#39; home-directory files, which allows remote attackers to obtain sensitive information from these files.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2578

Publication date:

31/12/2004

phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2579

Publication date:

31/12/2004

ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with "overlong UTF-8 encoding."

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2580

Publication date:

31/12/2004

Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2581

Publication date:

31/12/2004

Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2582

Publication date:

31/12/2004

Novell iChain 2.3 includes the build number in the VIA line of the proxy server&#39;s HTTP headers, which allows remote attackers to obtain sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2583

Publication date:

31/12/2004

SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2584

Publication date:

31/12/2004

frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name with a null byte ("%00"). NOTE: it is not clear whether this issue poses a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2585

Publication date:

31/12/2004

Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2586

Publication date:

31/12/2004

Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities