Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-6521
Publication date:
05/02/2019
WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-6523
Publication date:
05/02/2019
WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8791
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8792
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault).
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8793
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8794
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8795
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8796
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of Service (segfault).
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8797
Publication date:
05/02/2019
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-20250
Publication date:
05/02/2019
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-20251
Publication date:
05/02/2019
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-20252
Publication date:
05/02/2019
In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026
Subscribe to Vulnerabilities