Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18924

Publication date:

04/11/2018

The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-18909

Publication date:

03/11/2018

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor&#39;s source-code view.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2018

CVE-2018-18903

Publication date:

03/11/2018

Vanilla 2.6.x before 2.6.4 allows remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2018

CVE-2018-18915

Publication date:

03/11/2018

There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-11062

Publication date:

02/11/2018

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named &#39;support&#39; and &#39;admin&#39; that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default passwords may potentially log in to the system and gain read and write access to certain system files.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2019

CVE-2018-16847

Publication date:

02/11/2018

An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.

Severity CVSS v4.0: Pending analysis

Last modification:

14/05/2020

CVE-2018-15762

Publication date:

02/11/2018

Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-16849

Publication date:

02/11/2018

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor&#39;s filesystem.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-7799

Publication date:

02/11/2018

A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbitrary code on the targeted system when placing a specific DLL file.

Severity CVSS v4.0: Pending analysis

Last modification:

27/12/2018

CVE-2018-3920

Publication date:

02/11/2018

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2023

CVE-2018-3934

Publication date:

02/11/2018

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2023

CVE-2018-3935

Publication date:

02/11/2018

An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can allocate unlimited memory, resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2023

Subscribe to Vulnerabilities