Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-11489

Publication date:

26/05/2018

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-11490

Publication date:

26/05/2018

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2023

CVE-2018-11487

Publication date:

26/05/2018

PHPMyWind 5.5 has XSS via the cid parameter to newsshow.php, or the query string to news.php or about.php.

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2018

CVE-2018-11473

Publication date:

25/05/2018

Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).

Severity CVSS v4.0: Pending analysis

Last modification:

26/06/2018

CVE-2018-11472

Publication date:

25/05/2018

Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).

Severity CVSS v4.0: Pending analysis

Last modification:

26/06/2018

CVE-2018-11475

Publication date:

25/05/2018

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2018

CVE-2018-11474

Publication date:

25/05/2018

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not invalidate a session that is open in a different browser.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2018

CVE-2018-11471

Publication date:

25/05/2018

Cockpit 0.5.5 has XSS via a collection, form, or region.

Severity CVSS v4.0: Pending analysis

Last modification:

25/06/2018

CVE-2018-9091

Publication date:

25/05/2018

A critical vulnerability in the KEMP LoadMaster Operating System (LMOS) 6.0.44 through 7.2.41.2 and Long Term Support (LTS) LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated commands such as ls, ps, cat, etc., thereby compromising the system. Through this remote execution, in certain cases, exposure of sensitive system data such as certificates, private keys, and other information may be possible.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-11479

Publication date:

25/05/2018

The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that establishes a \\.\pipe\WindscribeService named pipe endpoint that allows the Windscribe VPN process to connect and execute an OpenVPN process or other processes (like taskkill, etc.). There is no validation of the program name before constructing the lpCommandLine argument for a CreateProcess call. An attacker can run any malicious process with SYSTEM privileges through this named pipe.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2020

CVE-2017-14185

Publication date:

25/05/2018

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal.

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2018

CVE-2018-8862

Publication date:

25/05/2018

In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially crafted malicious radio transmissions may allow an attacker to remotely trigger false alarms.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

Subscribe to Vulnerabilities