Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2015-6926

Publication date:

19/01/2018

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

Severity CVSS v4.0: Pending analysis

Last modification:

19/01/2021

CVE-2017-1693

Publication date:

19/01/2018

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out. IBM X-Force ID: 134164.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2018

CVE-2017-6142

Publication date:

19/01/2018

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server&#39;s identity on certain versions of BIG-IP.

Severity CVSS v4.0: Pending analysis

Last modification:

06/02/2018

CVE-2018-1362

Publication date:

19/01/2018

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user&#39;s submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-5784

Publication date:

19/01/2018

In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. This occurs because the declared number of directory entries is not validated against the actual number of directory entries.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2019

CVE-2018-5783

Publication date:

19/01/2018

In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-5785

Publication date:

19/01/2018

In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2021

CVE-2018-5786

Publication date:

19/01/2018

In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2022

CVE-2016-10707

Publication date:

18/01/2018

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2024

CVE-2015-9251

Publication date:

18/01/2018

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2012-6708

Publication date:

18/01/2018

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the &#39;

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023