Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-3891

Publication date:

15/09/2023

Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2022-20917

Publication date:

15/09/2023

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application.<br /> This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.

Severity CVSS v4.0: Pending analysis

Last modification:

25/01/2024

CVE-2023-4973

Publication date:

15/09/2023

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2024

CVE-2023-4977

Publication date:

15/09/2023

Code Injection in GitHub repository librenms/librenms prior to 23.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-4978

Publication date:

15/09/2023

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-4979

Publication date:

15/09/2023

Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2024

CVE-2023-4980

Publication date:

15/09/2023

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-4981

Publication date:

15/09/2023

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-4982

Publication date:

15/09/2023

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-39643

Publication date:

15/09/2023

Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-40984

Publication date:

15/09/2023

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-40985

Publication date:

15/09/2023

An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim&#39;s browser when any file is searched/replaced.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

Subscribe to Vulnerabilities