Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-31794

Publication date:

31/10/2023

MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-5861

Publication date:

31/10/2023

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-5862

Publication date:

31/10/2023

Missing Authorization in GitHub repository hamza417/inure prior to Build95.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-5863

Publication date:

31/10/2023

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-5864

Publication date:

31/10/2023

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-5865

Publication date:

31/10/2023

Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.

Severity CVSS v4.0: Pending analysis

Last modification:

09/11/2023

CVE-2023-5866

Publication date:

31/10/2023

Sensitive Cookie in HTTPS Session Without &#39;Secure&#39; Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-46138

Publication date:

31/10/2023

JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an email. Currently, the domain `mycompany.com` has not been registered. However, if it is registered in the future, it may affect the password reset functionality. This issue has been patched in version 3.8.0 by changing the default email domain to `example.com`. Those who cannot upgrade may change the default email domain to `example.com` manually.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

CVE-2023-46139

Publication date:

31/10/2023

KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a malware whose app signing block specially constructed, it can take over root privileges on the device. The vulnerable verification logic actually obtains the signature of the last block with an id of `0x7109871a`, while the verification logic during Android installation is to obtain the first one. In addition to the actual signature upgrade that has been fixed (KSU thought it was V2 but was actually V3), there is also the problem of actual signature downgrading (KSU thought it was V2 but was actually V1). Find a condition in the signature verification logic that will cause the signature not to be found error, and KernelSU does not implement the same conditions, so KSU thinks there is a V2 signature, but the APK signature verification actually uses the V1 signature. This issue is fixed in version 0.7.0. As workarounds, keep the KernelSU manager installed and avoid installing unknown apps.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2023-46129

Publication date:

31/10/2023

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library&#39;s `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. <br /> FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2026

CVE-2023-43797

Publication date:

30/10/2023

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-43798

Publication date:

30/10/2023

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2023

Subscribe to Vulnerabilities