Vulnerabilities | INCIBE-CERT | INCIBE

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (http://nvd.nist.gov/) (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used (http://cve.mitre.org/) with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others. Through RSS feeds (https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/feed) or Newsletters (https://www.incibe.es/en/incibe/suscripciones) we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-43014

Publication date:

Asset Management System v1.0 is vulnerable to<br /> <br /> an Authenticated SQL Injection vulnerability<br /> <br /> on the &#39;first_name&#39; and &#39;last_name&#39; parameters<br /> <br /> of user.php page, allowing an authenticated<br /> <br /> attacker to dump all the contents of the database<br /> <br /> contents.

Severity: Pending analysis

Last modification:

CVE-2023-5185

Publication date:

Gym Management System Project v1.0 is vulnerable to<br /> <br /> an Insecure File Upload vulnerability on the &#39;file&#39;<br /> <br /> parameter of profile/i.php page, allowing an<br /> <br /> authenticated attacker to obtain Remote Code Execution<br /> <br /> on the server hosting the application.

Severity: Pending analysis

Last modification:

CVE-2023-5053

Publication date:

Hospital management system version 378c157 allows to bypass authentication.<br /> <br /> This is possible because the application is vulnerable to SQLI.

Severity: Pending analysis

Last modification:

CVE-2023-5004

Publication date:

Hospital management system version 378c157 allows to bypass authentication.<br /> <br /> This is possible because the application is vulnerable to SQLI.

Severity: Pending analysis

Last modification:

CVE-2023-4316

Publication date:

Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails

Severity: Pending analysis

Last modification:

CVE-2023-44173

Publication date:

Online Movie Ticket Booking System v1.0 is vulnerable to<br /> <br /> an authenticated Reflected Cross-Site Scripting vulnerability.

Severity: Pending analysis

Last modification:

CVE-2023-43740

Publication date:

[PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]

Severity: Pending analysis

Last modification:

CVE-2023-43013

Publication date:

Asset Management System v1.0 is vulnerable to an<br /> <br /> unauthenticated SQL Injection vulnerability on the<br /> <br /> &#39;email&#39; parameter of index.php page, allowing an<br /> <br /> external attacker to dump all the contents of the<br /> <br /> database contents and bypass the login control.

Severity: Pending analysis

Last modification:

CVE-2023-41911

Publication date:

Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).

Severity: Pending analysis

Last modification:

CVE-2023-43323

Publication date:

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink].

Severity: Pending analysis

Last modification:

CVE-2023-43226

Publication date:

An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.

Severity: Pending analysis

Last modification:

CVE-2023-5256

Publication date:

In certain scenarios, Drupal&#39;s JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation.<br /> <br /> This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API.<br /> <br /> The core REST and contributed GraphQL modules are not affected.

Severity: Pending analysis

Last modification:

Subscribe to Vulnerabilities