Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-8287

Publication date:

27/04/2017

FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-3161

Publication date:

26/04/2017

The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-3162

Publication date:

26/04/2017

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8962

Publication date:

26/04/2017

IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8924

Publication date:

26/04/2017

IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user&#39;s session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user&#39;s session. IBM X-Force ID: 118537.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-1170

Publication date:

26/04/2017

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user&#39;s session. IBM X-Force ID: 123230.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-6054

Publication date:

26/04/2017

A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption password to protect sensitive user information.

Severity CVSS v4.0: Pending analysis

Last modification:

06/04/2026

CVE-2017-6052

Publication date:

26/04/2017

A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verified, which may allow a remote attacker to access or influence communications between the identified endpoints.

Severity CVSS v4.0: Pending analysis

Last modification:

06/04/2026

CVE-2017-7720

Publication date:

26/04/2017

Buffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service (SEH overwrite) or possibly have unspecified other impact via a long password.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-8284

Publication date:

26/04/2017

The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-8283

Publication date:

26/04/2017

dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2017-7293

Publication date:

26/04/2017

The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 (DAX2) 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1, 1.4.2, 1.4.3, and 1.4.4 and Dolby Audio X3 (DAX3) 1.0 and 1.1. An example affected driver is Realtek Audio Driver 6.0.1.7898 on a Lenovo P50.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

Subscribe to Vulnerabilities