Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-6472
Publication date:
31/01/2018
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C40204c.
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2018

CVE-2018-6471
Publication date:
31/01/2018
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402078.
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2018

CVE-2018-6475
Publication date:
31/01/2018
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2018

CVE-2018-5701
Publication date:
31/01/2018
In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x00226003.
Severity CVSS v4.0: Pending analysis
Last modification:
15/02/2018

CVE-2018-6465
Publication date:
31/01/2018
The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.
Severity CVSS v4.0: Pending analysis
Last modification:
15/02/2018

CVE-2018-5996
Publication date:
31/01/2018
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
Severity CVSS v4.0: Pending analysis
Last modification:
10/01/2025

CVE-2018-6462
Publication date:
31/01/2018
Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2019

CVE-2018-6464
Publication date:
31/01/2018
Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.
Severity CVSS v4.0: Pending analysis
Last modification:
03/02/2020

CVE-2014-1632
Publication date:
31/01/2018
htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2019

CVE-2014-1631
Publication date:
31/01/2018
Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php.
Severity CVSS v4.0: Pending analysis
Last modification:
26/04/2019

CVE-2018-6460
Publication date:
31/01/2018
Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including configuration. User controlled input is not sufficiently filtered: an unauthenticated attacker can send a POST request to /status.js with the parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including whether the user is connected to a VPN, to which VPN he/she is connected, and what is their real IP address.
Severity CVSS v4.0: Pending analysis
Last modification:
28/02/2018

CVE-2017-8916
Publication date:
31/01/2018
In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.
Severity CVSS v4.0: Pending analysis
Last modification:
24/02/2018
Subscribe to Vulnerabilities