Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-31046

Publication date:

19/10/2023

A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server&#39;s filesystem, because requests beginning with "GET /ui/static/..//.." reach getStaticContent in UIContentResource.class in the static-content-files servlet.

Severity CVSS v4.0: Pending analysis

Last modification:

26/10/2023

CVE-2023-43252

Publication date:

19/10/2023

XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2023-45379

Publication date:

19/10/2023

In the module "Rotator Img" (posrotatorimg) in versions at least up to 1.1 from PosThemes for PrestaShop, a guest can perform SQL injection.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2023-45384

Publication date:

19/10/2023

KnowBand supercheckout > 5.0.7 and

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2023-45883

Publication date:

19/10/2023

A privilege escalation vulnerability exists within the Qumu Multicast Extension v2 before 2.0.63 for Windows. When a standard user triggers a repair of the software, a pop-up window opens with SYSTEM privileges. Standard users may use this to gain arbitrary code execution as SYSTEM.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2024

CVE-2022-37830

Publication date:

19/10/2023

Interway a.s WebJET CMS 8.6.896 is vulnerable to Cross Site Scripting (XSS).

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2022-27813

Publication date:

19/10/2023

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the firmwares, an adversary with control over either core can trivially gain code execution on the other, by overwriting code located in shared RAM or DDR2 memory regions.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-46227

Publication date:

19/10/2023

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can use \t to bypass. Users are advised to upgrade to Apache InLong&#39;s 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8814

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2024

CVE-2022-24401

Publication date:

19/10/2023

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-24402

Publication date:

19/10/2023

The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-24404

Publication date:

19/10/2023

Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-25332

Publication date:

19/10/2023

The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by an adversary with non-secure supervisor privileges by managing cache contents and collecting timing information for different ciphertext inputs. Using this side channel, the SK_LOAD secure kernel routine can be used to recover the Customer Encryption Key (CEK).

Severity CVSS v4.0: Pending analysis

Last modification:

16/02/2024

Subscribe to Vulnerabilities