Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-42460

Publication date:

27/09/2023

Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-42453

Publication date:

27/09/2023

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2024

CVE-2023-42487

Publication date:

27/09/2023

Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;)

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-42461

Publication date:

27/09/2023

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-42462

Publication date:

27/09/2023

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-42486

Publication date:

27/09/2023

Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2023-42657

Publication date:

27/09/2023

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-41986

Publication date:

27/09/2023

The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to modify protected parts of the file system.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2023-41995

Publication date:

27/09/2023

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2023-41996

Publication date:

27/09/2023

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6. Apps that fail verification checks may still launch.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2023-41904

Publication date:

27/09/2023

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2023-41888

Publication date:

27/09/2023

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to transmit a malicious URL of login page that can be used to attempt a phishing attack on user credentials. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

Subscribe to Vulnerabilities