Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2016-8720

Publication date:

13/04/2017

An exploitable HTTP Header Injection vulnerability exists in the Web Application functionality of the Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted HTTP request can inject a payload in the bkpath parameter which will be copied in to Location header of the HTTP response.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8722

Publication date:

13/04/2017

An exploitable Information Disclosure vulnerability exists in the Web Application functionality of Moxa AWK-3131A Series Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client. Retrieving a specific URL without authentication can reveal sensitive information to an attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8723

Publication date:

13/04/2017

An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an &#39;/&#39; will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially unexpected HTTP get requests to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8724

Publication date:

13/04/2017

An exploitable information disclosure vulnerability exists in the serviceAgent functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted TCP query will allow an attacker to retrieve potentially sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8725

Publication date:

13/04/2017

An exploitable information disclosure vulnerability exists in the Web Application functionality of the Moxa AWK-3131A wireless access point running firmware 1.1. Retrieving a specific URL without authentication can reveal sensitive information to an attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-8726

Publication date:

13/04/2017

An exploitable null pointer dereference vulnerability exists in the Web Application /forms/web_runScript iw_filename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web server.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2013-6662

Publication date:

13/04/2017

Google Chrome caches TLS sessions before certificate validation occurs.

Severity CVSS v4.0: Pending analysis

Last modification:

23/02/2026

CVE-2016-4898

Publication date:

13/04/2017

The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-4899

Publication date:

13/04/2017

The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2014-3887

Publication date:

13/04/2017

Cross-site scripting (XSS) vulnerability in I-O DATA DEVICE RockDisk with firmware before 1.05e1-2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-4713.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026

CVE-2016-1155

Publication date:

13/04/2017

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2026