Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-7565

Publication date:

07/03/2018

CSRF exists on Polycom QDX 6000 devices.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2018

CVE-2017-15367

Publication date:

07/03/2018

Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2018

CVE-2018-7204

Publication date:

07/03/2018

inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-5452

Publication date:

07/03/2018

A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v.4.01.280] firmware: CWM v.05.78.00 and prior. A stack-based buffer overflow vulnerability caused by sending crafted packets on Port 20547 could force the PLC to change its state into halt mode.

Severity CVSS v4.0: Pending analysis

Last modification:

18/09/2020

CVE-2018-7745

Publication date:

07/03/2018

An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/installation/createuserinfo requests, resulting in account creation.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2021

CVE-2018-7746

Publication date:

07/03/2018

An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2021

CVE-2014-5044

Publication date:

07/03/2018

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2018

CVE-2014-8780

Publication date:

07/03/2018

Cross-site scripting (XSS) vulnerability in Jease 2.11 allows remote authenticated users to inject arbitrary web script or HTML via a content section note.

Severity CVSS v4.0: Pending analysis

Last modification:

25/04/2019

CVE-2018-7473

Publication date:

07/03/2018

Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2021

CVE-2018-1000118

Publication date:

07/03/2018

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.

Severity CVSS v4.0: Pending analysis

Last modification:

20/04/2018

CVE-2018-1000116

Publication date:

07/03/2018

NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-1000117

Publication date:

07/03/2018

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2022

Subscribe to Vulnerabilities