Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-38992

Publication date:

28/07/2023

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2023

CVE-2023-37754

Publication date:

28/07/2023

PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2023

CVE-2023-37467

Publication date:

28/07/2023

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to bypass CSP and execute successfully. This vulnerability isn&#39;t applicable to logged-in users. Version 3.1.0.beta7 contains a patch. The stable branch doesn&#39;t have this vulnerability. A workaround to prevent the vulnerability is to disable Google Tag Manager, i.e., unset the `gtm container id` setting.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2023

CVE-2023-31932

Publication date:

28/07/2023

Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-enquiry.php file.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-31933

Publication date:

28/07/2023

Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-pass-detail.php file.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-31934

Publication date:

28/07/2023

Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the adminname parameter of admin-profile.php.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-31935

Publication date:

28/07/2023

Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the emial parameter of admin-profile.php.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-31936

Publication date:

28/07/2023

Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-pass-detail.php file.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-31937

Publication date:

28/07/2023

Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-cateogry-detail.php file.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-39190

Publication date:

28/07/2023

Rejected reason: CVE-2023-39190 was found to be a duplicate of CVE-2023-31436. Please see https://access.redhat.com/security/cve/CVE-2023-31436 for information about affected products and security errata.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-2685

Publication date:

28/07/2023

A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, potential attackers could possibly call up another application than the AO-OPC server by starting the service. The service might be started with system user privileges which could cause a shift in user access privileges. It is unlikely to exploit the vulnerability in well maintained Windows installations since the attacker would need write access to system folders. An update is available that resolves the vulnerability found during an internal review in the product AO-OPC = 3.2.1

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-3670

Publication date:

28/07/2023

In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2023

Subscribe to Vulnerabilities