Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2016-10695

Publication date:

04/06/2018

The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10696

Publication date:

04/06/2018

windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10697

Publication date:

04/06/2018

react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-0928

Publication date:

04/06/2018

html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the &#39;_sanitized&#39; variable causing sanitization to be bypassed.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-0930

Publication date:

04/06/2018

augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-0931

Publication date:

04/06/2018

html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2019

CVE-2017-16005

Publication date:

04/06/2018

Http-signature is a "Reference implementation of Joyent&#39;s HTTP Signature Scheme". In versions

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-16006

Publication date:

04/06/2018

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-16007

Publication date:

04/06/2018

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-16008

Publication date:

04/06/2018

i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2017-16009

Publication date:

04/06/2018

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2023