Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2014-10066

Publication date:

31/05/2018

Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2020

CVE-2015-9236

Publication date:

31/05/2018

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2015-9238

Publication date:

31/05/2018

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2015-9239

Publication date:

31/05/2018

ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10518

Publication date:

31/05/2018

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn&#39;t do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10519

Publication date:

31/05/2018

A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10520

Publication date:

31/05/2018

jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10521

Publication date:

31/05/2018

jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10523

Publication date:

31/05/2018

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-10524

Publication date:

31/05/2018

i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.

Severity CVSS v4.0: Pending analysis

Last modification:

06/04/2022

CVE-2016-10526

Publication date:

31/05/2018

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019