Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-2416
Publication date:
02/08/2023
In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2023

CVE-2023-4016
Publication date:
02/08/2023
Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.
Severity CVSS v4.0: Pending analysis
Last modification:
15/12/2023

CVE-2022-2346
Publication date:
02/08/2023
In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.
Severity CVSS v4.0: Pending analysis
Last modification:
07/08/2023

CVE-2023-31926
Publication date:
02/08/2023
System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2025

CVE-2023-31927
Publication date:
02/08/2023
An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2025

CVE-2023-3500
Publication date:
02/08/2023
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2023

CVE-2023-3900
Publication date:
02/08/2023
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2024

CVE-2023-3994
Publication date:
02/08/2023
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2024

CVE-2023-3993
Publication date:
02/08/2023
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2024

CVE-2023-3364
Publication date:
02/08/2023
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2024

CVE-2023-3385
Publication date:
02/08/2023
An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in [`tar-1.35`](https://lists.gnu.org/archive/html/info-gnu/2023-07/msg00005.html).
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2023

CVE-2023-38990
Publication date:
02/08/2023
An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2023
Subscribe to Vulnerabilities