Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-38257

Publication date:

18/07/2023

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-36669

Publication date:

18/07/2023

Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-34329

Publication date:

18/07/2023

AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-34330

Publication date:

18/07/2023

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-33312

Publication date:

18/07/2023

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2023-33329

Publication date:

18/07/2023

Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Hijiri Custom Post Type Generator plugin

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2023-28019

Publication date:

18/07/2023

Insufficient validation in Bigfix WebUI API App site version

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2021-37522

Publication date:

18/07/2023

SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db.js, /commands/mute.js, /modules/event/messageDelete.js.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2020-22159

Publication date:

18/07/2023

EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upload, allowing an authenticated attacker to upload a webshell or overwrite any critical system files.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-33231

Publication date:

18/07/2023

XSS attack was possible in DPA 2023.2 due to insufficient input validation

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2023

CVE-2023-0160

Publication date:

18/07/2023

A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-37259

Publication date:

18/07/2023

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

Subscribe to Vulnerabilities