Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2016-1000117
Publication date:
21/10/2016
XSS & SQLi in HugeIT slideshow v1.0.4
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-1000116
Publication date:
21/10/2016
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-1000115
Publication date:
21/10/2016
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-2848
Publication date:
21/10/2016
ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-8666
Publication date:
16/10/2016
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-8660
Publication date:
16/10/2016
The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-8658
Publication date:
16/10/2016
Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-7425
Publication date:
16/10/2016
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-7097
Publication date:
16/10/2016
The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-7042
Publication date:
16/10/2016
The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-7039
Publication date:
16/10/2016
The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025

CVE-2016-6828
Publication date:
16/10/2016
The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2025
Subscribe to Vulnerabilities