Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-11036

Publication date:

31/05/2018

Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale) on vSZ, SZ-100, SZ-300, and SCG-200 devices allows remote attackers to obtain sensitive information or modify data.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2018

CVE-2018-11583

Publication date:

31/05/2018

SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

29/06/2018

CVE-2018-11579

Publication date:

31/05/2018

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin&#39;s setting by simply sending a request with a wbm_save_shop_page_banner_data action.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-11580

Publication date:

31/05/2018

An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-11572

Publication date:

31/05/2018

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2018

CVE-2018-11571

Publication date:

31/05/2018

ClipperCMS 1.3.3 allows Session Fixation.

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2018

CVE-2018-11576

Publication date:

31/05/2018

ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.

Severity CVSS v4.0: Pending analysis

Last modification:

28/06/2018

CVE-2018-11578

Publication date:

31/05/2018

GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.

Severity CVSS v4.0: Pending analysis

Last modification:

13/07/2018

CVE-2018-11577

Publication date:

31/05/2018

Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-11575

Publication date:

31/05/2018

ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-11567

Publication date:

30/05/2018

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device&#39;s hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2018-11568

Publication date:

30/05/2018

Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the &#39;&#39; characters have &lt; and &gt; representations.

Severity CVSS v4.0: Pending analysis

Last modification:

13/07/2018

Subscribe to Vulnerabilities