Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-7535
Publication date:
07/02/2019
index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology.
Severity CVSS v4.0: Pending analysis
Last modification:
08/02/2019

CVE-2019-4008
Publication date:
07/02/2019
API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files. IBM X-Force ID: 155626.
Severity CVSS v4.0: Pending analysis
Last modification:
03/12/2022

CVE-2018-1666
Publication date:
07/02/2019
IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-7578
Publication date:
07/02/2019
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-7559
Publication date:
07/02/2019
In btor2parser/btor2parser.c in Boolector Btor2Tools before 2019-01-15, opening a specially crafted input file leads to an out of bounds write in pusht_bfr.
Severity CVSS v4.0: Pending analysis
Last modification:
08/02/2019

CVE-2019-7566
Publication date:
07/02/2019
CSZ CMS 1.1.8 has CSRF via admin/users/new/add.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7560
Publication date:
07/02/2019
In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7567
Publication date:
07/02/2019
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7570
Publication date:
07/02/2019
A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7568
Publication date:
07/02/2019
An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7569
Publication date:
07/02/2019
An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). There is a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7572
Publication date:
07/02/2019
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023
Subscribe to Vulnerabilities