Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-10502

Publication date:
06/11/2019
Possible stack overflow when an index equal to io buffer size is accessed in camera module in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDX24
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2010-2247

Publication date:
06/11/2019
makepasswd 1.10 default settings generate insecure passwords
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2011-4627

Publication date:
06/11/2019
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2011-4626

Publication date:
06/11/2019
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2011-4628

Publication date:
06/11/2019
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2011-4631

Publication date:
06/11/2019
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2011-4630

Publication date:
06/11/2019
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2011-4629

Publication date:
06/11/2019
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2010-2446

Publication date:
06/11/2019
Rbot Reaction plugin allows command execution
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2015-7276

Publication date:
06/11/2019
Technicolor C2000T and C2100T uses hard-coded cryptographic keys.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-18639

Publication date:
06/11/2019
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-18797

Publication date:
06/11/2019
LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026