Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-28332
Publication date:
23/03/2023
If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Severity CVSS v4.0: Pending analysis
Last modification:
19/04/2024

CVE-2023-28334
Publication date:
23/03/2023
Authenticated users were able to enumerate other users' names via the learning plans page.
Severity CVSS v4.0: Pending analysis
Last modification:
08/07/2024

CVE-2023-28611
Publication date:
23/03/2023
Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended access restrictions.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-28335
Publication date:
23/03/2023
The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2024

CVE-2023-28336
Publication date:
23/03/2023
Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.
Severity CVSS v4.0: Pending analysis
Last modification:
19/04/2024

CVE-2023-1252
Publication date:
23/03/2023
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.
Severity CVSS v4.0: Pending analysis
Last modification:
23/04/2025

CVE-2023-1513
Publication date:
23/03/2023
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-20861
Publication date:
23/03/2023
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-24788
Publication date:
23/03/2023
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.
Severity CVSS v4.0: Pending analysis
Last modification:
11/05/2023

CVE-2023-0056
Publication date:
23/03/2023
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-1249
Publication date:
23/03/2023
A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2025

CVE-2023-1402
Publication date:
23/03/2023
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Severity CVSS v4.0: Pending analysis
Last modification:
19/04/2024
Subscribe to Vulnerabilities