Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2011-2902

Publication date:

30/01/2018

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2018-5441

Publication date:

30/01/2018

An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-6195

Publication date:

30/01/2018

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the &#39;session&#39; HTTP GET parameter to wp-admin/upload.php.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2017-1000141

Publication date:

30/01/2018

An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user&#39;s ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.

Severity CVSS v4.0: Pending analysis

Last modification:

13/06/2018

CVE-2017-1731

Publication date:

30/01/2018

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-6379

Publication date:

30/01/2018

In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2018-6380

Publication date:

30/01/2018

In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2018-6376

Publication date:

30/01/2018

In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2018-6377

Publication date:

30/01/2018

In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2014-4705

Publication date:

30/01/2018

Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, AR160, AR200, AR1200, AR2200, AR3200, AR530, NetEngine16EX, SRG1300, SRG2300, and SRG3300 series routers; and WLAN AC6005, AC6605, and ACU2 access controllers allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2018

CVE-2018-6355

Publication date:

30/01/2018

/goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

21/02/2018

CVE-2017-17969

Publication date:

30/01/2018

Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds write) or potentially execute arbitrary code via a crafted ZIP archive.

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

Subscribe to Vulnerabilities