Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-37899

Publication date:

19/07/2023

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: &#39;&#39; }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit(&#39;find&#39;, { toString: &#39;&#39; })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-3674

Publication date:

19/07/2023

A flaw was found in the keylime attestation verifier, which fails to flag a device&#39;s submitted TPM quote as faulty when the quote&#39;s signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Severity CVSS v4.0: Pending analysis

Last modification:

25/04/2024

CVE-2023-3467

Publication date:

19/07/2023

Privilege Escalation to root administrator (nsroot)

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-3466

Publication date:

19/07/2023

Reflected Cross-Site Scripting (XSS)

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-37733

Publication date:

19/07/2023

An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.

Severity CVSS v4.0: Pending analysis

Last modification:

26/07/2023

CVE-2023-3519

Publication date:

19/07/2023

Unauthenticated remote code execution

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2025

CVE-2023-37748

Publication date:

19/07/2023

ngiflib commit 5e7292 was discovered to contain an infinite loop via the function DecodeGifImg at ngiflib.c.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-25838

Publication date:

19/07/2023

There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2024

CVE-2023-32263

Publication date:

19/07/2023

A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login certificate if an authenticated user is duped into using an attacker-controlled Dimensions CM server. This vulnerability only applies when the Jenkins plugin is configured to use login certificate credentials. https://www.jenkins.io/security/advisory/2023-06-14/

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-32262

Publication date:

19/07/2023

A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-32261

Publication date:

19/07/2023

A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. See the following Jenkins security advisory for details: * https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2024

CVE-2023-25839

Publication date:

19/07/2023

There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

Subscribe to Vulnerabilities