Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-17326

Publication date:
30/10/2019
ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2019-17323

Publication date:
30/10/2019
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with modified XML document. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2019

CVE-2019-17321

Publication date:
30/10/2019
ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, could leak username via session file path of HTTP response data. No authentication is required.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2019

CVE-2013-1391

Publication date:
30/10/2019
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2019

CVE-2019-17322

Publication date:
30/10/2019
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2010-0206

Publication date:
30/10/2019
xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objects.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2010-0207

Publication date:
30/10/2019
In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2019-18207

Publication date:
30/10/2019
In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page.
Severity CVSS v4.0: Pending analysis
Last modification:
06/11/2019

CVE-2019-18204

Publication date:
30/10/2019
Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2019

CVE-2019-18205

Publication date:
30/10/2019
Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2019

CVE-2019-18206

Publication date:
30/10/2019
A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload.
Severity CVSS v4.0: Pending analysis
Last modification:
05/11/2019

CVE-2018-18678

Publication date:
30/10/2019
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
19/09/2024