Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-4075

Publication date:

03/08/2023

Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity CVSS v4.0: Pending analysis

Last modification:

31/01/2024

CVE-2023-33368

Publication date:

03/08/2023

Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-1437

Publication date:

02/08/2023

All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2023-1935

Publication date:

02/08/2023

ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-39113

Publication date:

02/08/2023

ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the program gif2tga.

Severity CVSS v4.0: Pending analysis

Last modification:

06/06/2024

CVE-2023-39114

Publication date:

02/08/2023

ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif.

Severity CVSS v4.0: Pending analysis

Last modification:

06/06/2024

CVE-2023-3329

Publication date:

02/08/2023

SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI&#39;s upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2024

CVE-2023-36081

Publication date:

02/08/2023

Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code via a crafted script to the web application dashboard.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2023

CVE-2023-3978

Publication date:

02/08/2023

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-29407

Publication date:

02/08/2023

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-29408

Publication date:

02/08/2023

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-29409

Publication date:

02/08/2023

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

Subscribe to Vulnerabilities