Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-18109

Publication date:

29/03/2019

The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2017-18110

Publication date:

29/03/2019

The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2017-18108

Publication date:

29/03/2019

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2017-18106

Publication date:

29/03/2019

The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user&#39;s session provided they can make their identifier hash collide with another user&#39;s session identifier hash.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2017-18105

Publication date:

29/03/2019

The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user&#39;s JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2017-18111

Publication date:

29/03/2019

The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2019-10477

Publication date:

29/03/2019

The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2019-6481

Publication date:

29/03/2019

Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app." approach, related to a "Multifactor Auth Bypass, Full Disk Encryption Bypass" issue affecting the Affected Chrome Plugin component.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-9695

Publication date:

29/03/2019

Norton Core prior to v278 may be susceptible to an arbitrary code execution issue, which is a type of vulnerability that has the potential of allowing an individual to execute arbitrary commands or code on a target machine or in a target process. Note that this exploit is only possible with direct physical access to the device.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-10276

Publication date:

29/03/2019

Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2019

CVE-2019-10269

Publication date:

29/03/2019

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2023

CVE-2019-10262

Publication date:

28/03/2019

A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in single quotes, resulting in injection around the escape of magic quotes.

Severity CVSS v4.0: Pending analysis

Last modification:

29/03/2019

Subscribe to Vulnerabilities