Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-11371
Publication date:
20/04/2019
BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-11378
Publication date:
20/04/2019
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-11372
Publication date:
20/04/2019
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-11373
Publication date:
20/04/2019
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-11376
Publication date:
20/04/2019
SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2024

CVE-2019-11377
Publication date:
20/04/2019
wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function.
Severity CVSS v4.0: Pending analysis
Last modification:
22/04/2019

CVE-2019-11374
Publication date:
20/04/2019
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2019

CVE-2019-11375
Publication date:
20/04/2019
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2019

CVE-2019-11365
Publication date:
20/04/2019
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.
Severity CVSS v4.0: Pending analysis
Last modification:
28/09/2020

CVE-2019-11366
Publication date:
20/04/2019
An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.
Severity CVSS v4.0: Pending analysis
Last modification:
28/09/2020

CVE-2019-11362
Publication date:
20/04/2019
app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.
Severity CVSS v4.0: Pending analysis
Last modification:
22/04/2019

CVE-2019-11358
Publication date:
20/04/2019
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Severity CVSS v4.0: Pending analysis
Last modification:
16/02/2024
Subscribe to Vulnerabilities