Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-34690

Publication date:

11/06/2024

SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2024

CVE-2024-2473

Publication date:

11/06/2024

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the &#39;action=postpass&#39; parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2024

CVE-2024-33001

Publication date:

11/06/2024

SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2024

CVE-2024-34683

Publication date:

11/06/2024

An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2024

CVE-2024-34684

Publication date:

11/06/2024

On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read or modify the remote server files.

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2024

CVE-2023-6745

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;cpt&#39; shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2025

CVE-2023-6748

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the &#39;cft&#39; shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2025

CVE-2024-0627

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2025

CVE-2024-0653

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2025

CVE-2024-28164

Publication date:

11/06/2024

SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2024

CVE-2024-37177

Publication date:

11/06/2024

SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

11/06/2024

CVE-2024-37178

Publication date:

11/06/2024

SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

11/06/2024

Subscribe to Vulnerabilities