Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-30383

Publication date:

18/07/2023

TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to contain a buffer overflow which may lead to a Denial of Service (DoS) when parsing crafted data.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-35763

Publication date:

18/07/2023

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-35189

Publication date:

18/07/2023

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2023-33871

Publication date:

18/07/2023

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the webroot.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-38257

Publication date:

18/07/2023

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-36669

Publication date:

18/07/2023

Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the IDU/ODU system. Any attacker with layer-3 network access to the IDU can impersonate the Touch Panel Unit (TPU) within the IDU by sending crafted TCP requests to the IDU.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2023

CVE-2023-34329

Publication date:

18/07/2023

AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-34330

Publication date:

18/07/2023

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-33312

Publication date:

18/07/2023

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wppal Easy Captcha plugin

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2023-33329

Publication date:

18/07/2023

Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Hijiri Custom Post Type Generator plugin

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2023-28019

Publication date:

18/07/2023

Insufficient validation in Bigfix WebUI API App site version

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

CVE-2021-37522

Publication date:

18/07/2023

SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db.js, /commands/mute.js, /modules/event/messageDelete.js.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2023

Subscribe to Vulnerabilities