Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18928

Publication date:

04/11/2018

International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.

Severity CVSS v4.0: Pending analysis

Last modification:

16/01/2019

CVE-2018-18926

Publication date:

04/11/2018

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2019

CVE-2018-18925

Publication date:

04/11/2018

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2019

CVE-2018-18919

Publication date:

04/11/2018

The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2018

CVE-2018-18927

Publication date:

04/11/2018

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has &#39;class="icon-globe icon-large"&#39; in its value), as demonstrated by an &#39;UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"&#39; statement.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2018

CVE-2018-18924

Publication date:

04/11/2018

The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-18909

Publication date:

03/11/2018

xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor&#39;s source-code view.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2018

CVE-2018-18903

Publication date:

03/11/2018

Vanilla 2.6.x before 2.6.4 allows remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2018

CVE-2018-18915

Publication date:

03/11/2018

There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-11062

Publication date:

02/11/2018

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named &#39;support&#39; and &#39;admin&#39; that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default passwords may potentially log in to the system and gain read and write access to certain system files.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2019

CVE-2018-16847

Publication date:

02/11/2018

An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.

Severity CVSS v4.0: Pending analysis

Last modification:

14/05/2020

CVE-2018-15762

Publication date:

02/11/2018

Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

Subscribe to Vulnerabilities