Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-15987

Publication date:

31/10/2017

Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-15984

Publication date:

31/10/2017

Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-15979

Publication date:

31/10/2017

Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-15985

Publication date:

31/10/2017

Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-15986

Publication date:

31/10/2017

CPA Lead Reward Script allows SQL Injection via the username parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-15983

Publication date:

31/10/2017

MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-15988

Publication date:

31/10/2017

Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-14373

Publication date:

31/10/2017

EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2015-9245

Publication date:

31/10/2017

Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via port 20931.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-1000255

Publication date:

30/10/2017

On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-10151

Publication date:

30/10/2017

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Supported versions that are affected are 11.1.1.7, 11.1.2.3 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2012-4449

Publication date:

30/10/2017

Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

Subscribe to Vulnerabilities