Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-36853

Publication date:

19/07/2023

In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. The attacker could abuse this to load a DLL with SYSTEM privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34429

Publication date:

19/07/2023

Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.

Severity CVSS v4.0: Pending analysis

Last modification:

26/07/2023

CVE-2023-35134

Publication date:

19/07/2023

Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.

Severity CVSS v4.0: Pending analysis

Last modification:

26/07/2023

CVE-2023-37362

Publication date:

19/07/2023

Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.

Severity CVSS v4.0: Pending analysis

Last modification:

06/03/2025

CVE-2023-34394

Publication date:

19/07/2023

In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2023-32657

Publication date:

19/07/2023

Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.

Severity CVSS v4.0: Pending analysis

Last modification:

26/07/2023

CVE-2023-3782

Publication date:

19/07/2023

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2023

CVE-2023-26217

Publication date:

19/07/2023

The Data Exchange Add-on component of TIBCO Software Inc.&#39;s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.&#39;s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-3722

Publication date:

19/07/2023

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-37276

Publication date:

19/07/2023

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn&#39;t vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

22/11/2023

CVE-2023-37899

Publication date:

19/07/2023

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: &#39;&#39; }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit(&#39;find&#39;, { toString: &#39;&#39; })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-3674

Publication date:

19/07/2023

A flaw was found in the keylime attestation verifier, which fails to flag a device&#39;s submitted TPM quote as faulty when the quote&#39;s signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Severity CVSS v4.0: Pending analysis

Last modification:

25/04/2024

Subscribe to Vulnerabilities