Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-1766

Publication date:

22/03/2019

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 12.5(1)SR1.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9649

Publication date:

22/03/2019

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-4035

Publication date:

22/03/2019

IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X-Force ID: 156001.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-4052

Publication date:

22/03/2019

IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9648

Publication date:

22/03/2019

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9923

Publication date:

22/03/2019

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9924

Publication date:

22/03/2019

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9925

Publication date:

22/03/2019

S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9927

Publication date:

22/03/2019

Caret before 2019-02-22 allows Remote Code Execution.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9936

Publication date:

22/03/2019

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9937

Publication date:

22/03/2019

In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-9938

Publication date:

22/03/2019

The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The attacker must be authenticated as a "recognized device."

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

Subscribe to Vulnerabilities