Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-1718

Publication date:

31/07/2018

IBM Sterling B2B Integrator Standard Edition 5.2.0.1 - 5.2.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147166.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1638

Publication date:

31/07/2018

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-8020

Publication date:

31/07/2018

Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-14767

Publication date:

31/07/2018

In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "build_res_buf_from_sip_req" core function. This could result in denial of service and potentially the execution of arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2018

CVE-2018-3772

Publication date:

30/07/2018

Concatenating unsanitized user input in the `whereis` npm module

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-3773

Publication date:

30/07/2018

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2023

CVE-2018-10847

Publication date:

30/07/2018

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-10898

Publication date:

30/07/2018

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2021

CVE-2018-10883

Publication date:

30/07/2018

A flaw was found in the Linux kernel&#39;s ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2018-9064

Publication date:

30/07/2018

In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-9065

Publication date:

30/07/2018

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-9066

Publication date:

30/07/2018

In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA&#39;s underlying operating system.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

Subscribe to Vulnerabilities