Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-34985

Publication date:

10/10/2023

A improper neutralization of special elements used in an os command (&#39;os command injection&#39;) in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34986

Publication date:

10/10/2023

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34987

Publication date:

10/10/2023

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34988

Publication date:

10/10/2023

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34989

Publication date:

10/10/2023

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34993

Publication date:

10/10/2023

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-36478

Publication date:

10/10/2023

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to<br /> exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295<br /> will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2024

CVE-2023-36547

Publication date:

10/10/2023

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34992

Publication date:

10/10/2023

A improper neutralization of special elements used in an os command (&#39;os command injection&#39;) vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

CVE-2020-27213

Publication date:

10/10/2023

An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. While the ISN generator seems to adhere to RFC 793 (where a global 32-bit counter is incremented roughly every 4 microseconds), proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.

Severity CVSS v4.0: Pending analysis

Last modification:

27/10/2023