Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-34188

Publication date:

23/06/2023

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2025

CVE-2023-35759

Publication date:

23/06/2023

In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim&#39;s browser, aka XSS.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2024

CVE-2023-35931

Publication date:

23/06/2023

Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.

Severity CVSS v4.0: Pending analysis

Last modification:

04/07/2023

CVE-2023-36345

Publication date:

23/06/2023

A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

30/06/2023

CVE-2023-36346

Publication date:

23/06/2023

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.

Severity CVSS v4.0: Pending analysis

Last modification:

04/07/2023

CVE-2023-36348

Publication date:

23/06/2023

POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

04/07/2023

CVE-2023-34203

Publication date:

23/06/2023

In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before 12.7, a remote user (who has any OEM or OEE role) could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and 12.3.x through 12.6.x before 12.7.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2023

CVE-2023-34460

Publication date:

23/06/2023

Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2023

CVE-2023-35167

Publication date:

23/06/2023

Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2023

CVE-2023-27908

Publication date:

23/06/2023

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2023

CVE-2023-34672

Publication date:

23/06/2023

Improper Access Control leads to adding a high-privilege user affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user&#39;s role within the admin profile. An attack could occur over the public Internet in some cases.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2024

CVE-2023-35157

Publication date:

23/06/2023

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It&#39;s possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.

Severity CVSS v4.0: Pending analysis

Last modification:

30/06/2023

Subscribe to Vulnerabilities