Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-31408

Publication date:
22/11/2024
OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command with root privileges by sending a specially crafted request.
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2024

CVE-2024-52056

Publication date:
21/11/2024
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file.
Severity CVSS v4.0: MEDIUM
Last modification:
21/11/2024

CVE-2024-52053

Publication date:
21/11/2024
Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts.
Severity CVSS v4.0: HIGH
Last modification:
21/11/2024

CVE-2024-52054

Publication date:
21/11/2024
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system.
Severity CVSS v4.0: MEDIUM
Last modification:
21/11/2024

CVE-2024-52055

Publication date:
21/11/2024
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file.
Severity CVSS v4.0: HIGH
Last modification:
21/11/2024

CVE-2024-52052

Publication date:
21/11/2024
Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.
Severity CVSS v4.0: CRITICAL
Last modification:
26/02/2025

CVE-2024-52616

Publication date:
21/11/2024
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
Severity CVSS v4.0: Pending analysis
Last modification:
24/03/2026

CVE-2024-52615

Publication date:
21/11/2024
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2026

CVE-2024-51364

Publication date:
21/11/2024
An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2024

CVE-2024-51365

Publication date:
21/11/2024
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Severity CVSS v4.0: Pending analysis
Last modification:
27/03/2025

CVE-2024-51366

Publication date:
21/11/2024
An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .conf file.
Severity CVSS v4.0: Pending analysis
Last modification:
04/12/2024

CVE-2024-51367

Publication date:
21/11/2024
An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2024