Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-4782

Publication date:

08/09/2023

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-28010

Publication date:

08/09/2023

In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2023-4843

Publication date:

08/09/2023

Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-39321

Publication date:

08/09/2023

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2023-39322

Publication date:

08/09/2023

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39320

Publication date:

08/09/2023

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39319

Publication date:

08/09/2023

The html/template package does not apply the proper rules for handling occurrences of "

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39318

Publication date:

08/09/2023

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39676

Publication date:

08/09/2023

FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-40924

Publication date:

08/09/2023

SolarView Compact

Severity CVSS v4.0: Pending analysis

Last modification:

19/09/2023

CVE-2023-39076

Publication date:

08/09/2023

Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software. 2021.03.26 (build version) vehicle causes a Denial of Service (DoS) in the in-car infotainment system.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2023