Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-11373
Publication date:
20/04/2019
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-11376
Publication date:
20/04/2019
SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2019-11377
Publication date:
20/04/2019
wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function.
Severity CVSS v4.0: Pending analysis
Last modification:
22/04/2019

CVE-2019-11374
Publication date:
20/04/2019
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2019

CVE-2019-11375
Publication date:
20/04/2019
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2019

CVE-2019-11365
Publication date:
20/04/2019
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.
Severity CVSS v4.0: Pending analysis
Last modification:
28/09/2020

CVE-2019-11366
Publication date:
20/04/2019
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
Severity CVSS v4.0: Pending analysis
Last modification:
28/09/2020

CVE-2019-11362
Publication date:
20/04/2019
app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.
Severity CVSS v4.0: Pending analysis
Last modification:
22/04/2019

CVE-2019-11358
Publication date:
20/04/2019
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Severity CVSS v4.0: Pending analysis
Last modification:
16/02/2024

CVE-2019-11359
Publication date:
20/04/2019
Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2025

CVE-2018-20817
Publication date:
19/04/2019
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.
Severity CVSS v4.0: Pending analysis
Last modification:
22/04/2019

CVE-2019-11354
Publication date:
19/04/2019
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2022
Subscribe to Vulnerabilities