Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-6194

Publication date:

30/01/2018

A cross-site scripting (XSS) vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2018

CVE-2016-6598

Publication date:

30/01/2018

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web root and achieve code execution as NETWORK SERVICE or SYSTEM.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2018

CVE-2016-6599

Publication date:

30/01/2018

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2018

CVE-2011-2902

Publication date:

30/01/2018

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2018-5441

Publication date:

30/01/2018

An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard devices rely on internal checksums for verification of the internal integrity of the update packages. Verification may not always be performed correctly, allowing an attacker to modify firmware update packages.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-6195

Publication date:

30/01/2018

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the &#39;session&#39; HTTP GET parameter to wp-admin/upload.php.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2017-1000141

Publication date:

30/01/2018

An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user&#39;s ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.

Severity CVSS v4.0: Pending analysis

Last modification:

13/06/2018

CVE-2017-1731

Publication date:

30/01/2018

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-6379

Publication date:

30/01/2018

In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2018-6380

Publication date:

30/01/2018

In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2018-6376

Publication date:

30/01/2018

In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

CVE-2018-6377

Publication date:

30/01/2018

In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2018

Subscribe to Vulnerabilities