Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-36356
Publication date:
22/06/2023
TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the component /userRpm/VirtualServerRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2023

CVE-2023-36357
Publication date:
22/06/2023
An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2024

CVE-2023-36355
Publication date:
22/06/2023
TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2023

CVE-2023-36239
Publication date:
22/06/2023
libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function at parser.c.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2023

CVE-2023-36243
Publication date:
22/06/2023
FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2023

CVE-2023-34923
Publication date:
22/06/2023
XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider (IP) to impersonate any TOPdesk user via SAML Response manipulation.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2023

CVE-2023-34796
Publication date:
22/06/2023
Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2023

CVE-2023-2611
Publication date:
22/06/2023
Advantech R-SeeNet <br /> versions 2.4.22 <br /> <br /> is installed with a hidden root-level user that is not available in the <br /> users list. This hidden user has a password that cannot be changed by <br /> users.<br /> <br /> <br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2023

CVE-2023-3256
Publication date:
22/06/2023
Advantech R-SeeNet <br /> versions 2.4.22 <br /> allows low-level users to access and load the content of local files.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2023

CVE-2023-3326
Publication date:
22/06/2023
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2023

CVE-2023-34028
Publication date:
22/06/2023
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2023

CVE-2023-34170
Publication date:
22/06/2023
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2023
Subscribe to Vulnerabilities