Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-24450
Publication date:
26/01/2023
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24449
Publication date:
26/01/2023
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24448
Publication date:
26/01/2023
A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24447
Publication date:
26/01/2023
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24446
Publication date:
26/01/2023
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24444
Publication date:
26/01/2023
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24443
Publication date:
26/01/2023
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24445
Publication date:
26/01/2023
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24456
Publication date:
26/01/2023
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24455
Publication date:
26/01/2023
Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24454
Publication date:
26/01/2023
Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24453
Publication date:
26/01/2023
A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025
Subscribe to Vulnerabilities