Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-45219
Publication date:
10/10/2023
<br /> Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2023

CVE-2023-45226
Publication date:
10/10/2023
<br /> The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only exposed when ssh debug is enabled.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2023

CVE-2023-5450
Publication date:
10/10/2023
<br /> An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2023

CVE-2023-41085
Publication date:
10/10/2023
<br /> When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2023

CVE-2023-41253
Publication date:
10/10/2023
<br /> When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2023

CVE-2023-41373
Publication date:
10/10/2023
<br /> A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2023

CVE-2023-41964
Publication date:
10/10/2023
<br /> The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2023

CVE-2023-42768
Publication date:
10/10/2023
<br /> When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user&amp;#39;s role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2023

CVE-2023-43485
Publication date:
10/10/2023
<br /> When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2023

CVE-2023-43611
Publication date:
10/10/2023
<br /> The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  This vulnerability is due to an incomplete fix for CVE-2023-38418.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2023

CVE-2023-43746
Publication date:
10/10/2023
<br /> When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2023

CVE-2023-43785
Publication date:
10/10/2023
A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.
Severity CVSS v4.0: Pending analysis
Last modification:
16/09/2024
Subscribe to Vulnerabilities