Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-15988
Publication date:
31/10/2017
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15989
Publication date:
31/10/2017
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15991
Publication date:
31/10/2017
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15992
Publication date:
31/10/2017
Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15993
Publication date:
31/10/2017
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2015-9245
Publication date:
31/10/2017
Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-14373
Publication date:
31/10/2017
EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15981
Publication date:
31/10/2017
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15982
Publication date:
31/10/2017
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-15990
Publication date:
31/10/2017
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-10699
Publication date:
31/10/2017
D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-1000255
Publication date:
30/10/2017
On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025
Subscribe to Vulnerabilities