Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-14652

Publication date:

31/10/2018

The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the &#39;features/index&#39; translator via the code handling the &#39;GF_XATTR_CLRLK_CMD&#39; xattr in the &#39;pl_getxattr&#39; function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2018-14653

Publication date:

31/10/2018

The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the &#39;__server_getspec&#39; function via the &#39;gf_getspec_req&#39; RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2018-16842

Publication date:

31/10/2018

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2019

CVE-2018-14654

Publication date:

31/10/2018

The Gluster file system through version 4.1.4 is vulnerable to abuse of the &#39;features/index&#39; translator. A remote attacker with access to mount volumes could exploit this via the &#39;GF_XATTROP_ENTRY_IN_KEY&#39; xattrop to create arbitrary, empty files on the target server.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2023

CVE-2018-14659

Publication date:

31/10/2018

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the &#39;GF_XATTR_IOSTATS_DUMP_KEY&#39; xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling &#39;setxattr(2)&#39; to trigger a state dump and create an arbitrary number of files in the server&#39;s runtime directory.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2023

CVE-2018-16839

Publication date:

31/10/2018

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-16840

Publication date:

31/10/2018

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an &#39;easy&#39; handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2025

CVE-2018-18874

Publication date:

31/10/2018

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=file_manager_upload URI.

Severity CVSS v4.0: Pending analysis

Last modification:

10/12/2018

CVE-2018-18873

Publication date:

31/10/2018

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2020

CVE-2018-13281

Publication date:

31/10/2018

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager (DSM) before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the file_path parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2025

CVE-2018-13282

Publication date:

31/10/2018

Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-15319

Publication date:

31/10/2018

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.6, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with the non-default "normalize URI" configuration options used in iRules and/or BIG-IP LTM policies.

Severity CVSS v4.0: Pending analysis

Last modification:

05/03/2019

Subscribe to Vulnerabilities