Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2014-9755
Publication date:
20/01/2017
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows remote attackers to perform a replay attack.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-5316
Publication date:
20/01/2017
Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-5317
Publication date:
20/01/2017
Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-5323
Publication date:
20/01/2017
The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-5321
Publication date:
20/01/2017
The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-9436
Publication date:
20/01/2017
parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a tag.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-9435
Publication date:
20/01/2017
The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to tags.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-5012
Publication date:
20/01/2017
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-2578
Publication date:
20/01/2017
In Moodle 3.x, there is XSS in the assignment submission page.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-10143
Publication date:
20/01/2017
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2017-5543
Publication date:
20/01/2017
includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025

CVE-2016-5014
Publication date:
20/01/2017
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2025
Subscribe to Vulnerabilities