Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-12971

Publication date:

29/06/2018

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users.

Severity CVSS v4.0: Pending analysis

Last modification:

20/08/2018

CVE-2018-12982

Publication date:

29/06/2018

Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file.

Severity CVSS v4.0: Pending analysis

Last modification:

20/08/2018

CVE-2018-12984

Publication date:

29/06/2018

Hycus CMS 1.0.4 allows Authentication Bypass via "&#39;=&#39; &#39;OR&#39;" credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

20/08/2018

CVE-2018-12988

Publication date:

29/06/2018

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI.

Severity CVSS v4.0: Pending analysis

Last modification:

20/08/2018

CVE-2018-12973

Publication date:

29/06/2018

An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter &#39;json&#39; to the /q URI.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2018

CVE-2018-12938

Publication date:

28/06/2018

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-17833. Reason: This candidate is a duplicate of CVE-2017-17833. Notes: All CVE users should reference CVE-2017-17833 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-8016

Publication date:

28/06/2018

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-1351

Publication date:

28/06/2018

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI commands by viewing the remote device CLI config installation log.

Severity CVSS v4.0: Pending analysis

Last modification:

22/01/2020

CVE-2018-12931

Publication date:

28/06/2018

ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2019

CVE-2018-12930

Publication date:

28/06/2018

ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2019

CVE-2018-12929

Publication date:

28/06/2018

ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2019

CVE-2018-11510

Publication date:

28/06/2018

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the &#39;script&#39; parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

Subscribe to Vulnerabilities