Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-38311

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-38310

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-38309

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application&#39;s response, leading to the execution of arbitrary JavaScript code within the context of the victim&#39;s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-38308

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim&#39;s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-38307

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user&#39;s real name.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-38306

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-38305

Publication date:

31/07/2023

An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim&#39;s browser when the download link is accessed.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2021-31651

Publication date:

31/07/2023

Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the copyright field in copyright settings.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2023

CVE-2023-36092

Publication date:

31/07/2023

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-36091

Publication date:

31/07/2023

Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2024

CVE-2023-36090

Publication date:

31/07/2023

Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-36089

Publication date:

31/07/2023

Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

Subscribe to Vulnerabilities