Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-37532
Publication date:
20/06/2024
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.
Severity CVSS v4.0: Pending analysis
Last modification:
21/08/2024

CVE-2024-6186
Publication date:
20/06/2024
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit.php. The manipulation of the argument ad_log_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: MEDIUM
Last modification:
21/08/2025

CVE-2024-6187
Publication date:
20/06/2024
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: MEDIUM
Last modification:
21/08/2025

CVE-2023-49110
Publication date:
20/06/2024
When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web <br /> application (either on-premises or cloud/SaaS solution), the transmitted data <br /> consists of a ZIP archive containing several files, some of them in the <br /> XML file format. During Kiuwan&amp;#39;s server-side processing of these XML <br /> files, it resolves external XML entities, resulting in a XML external <br /> entity injection attack. An attacker with privileges to scan <br /> source code within the "Code Security" module is able to extract any <br /> files of the operating system with the rights of the application server <br /> user and is potentially able to gain sensitive files, such as <br /> configuration and passwords. Furthermore, this vulnerability also allows<br /> an attacker to initiate connections to internal systems, e.g. for port <br /> scans or accessing other internal functions / applications such as the <br /> Wildfly admin console of Kiuwan.<br /> <br /> This issue affects Kiuwan SAST:
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2025

CVE-2023-49111
Publication date:
20/06/2024
For Kiuwan installations with SSO (single sign-on) enabled, an <br /> unauthenticated reflected cross-site scripting attack can be performed <br /> on the login page "login.html". This is possible due to the request parameter "message" values<br /> being directly included in a JavaScript block in the response. This is <br /> especially critical in business environments using AD SSO <br /> authentication, e.g. via ADFS, where attackers could potentially steal <br /> AD passwords.<br /> <br /> <br /> <br /> This issue affects Kiuwan SAST:
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2025

CVE-2023-49112
Publication date:
20/06/2024
Kiuwan provides an API endpoint<br /> <br /> /saas/rest/v1/info/application<br /> <br /> to get information about any <br /> application, providing only its name via the "application" parameter. This endpoint lacks proper access <br /> control mechanisms, allowing other authenticated users to read <br /> information about applications, even though they have not been granted <br /> the necessary rights to do so.<br /> <br /> <br /> <br /> This issue affects Kiuwan SAST:
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2025

CVE-2023-49113
Publication date:
20/06/2024
The Kiuwan Local Analyzer (KLA) Java scanning application contains several <br /> hard-coded secrets in plain text format. In some cases, this can <br /> potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer.<br /> <br /> The<br /> JAR file "lib.engine/insight/optimyth-insight.jar" contains the file <br /> "InsightServicesConfig.properties", which has the configuration tokens <br /> "insight.github.user" as well as "insight.github.password" prefilled <br /> with credentials. At least the specified username corresponds to a valid<br /> GitHub account. The<br /> JAR file "lib.engine/insight/optimyth-insight.jar" also contains the <br /> file "es/als/security/Encryptor.properties", in which the key used for <br /> encrypting the results of any performed scan.<br /> <br /> <br /> <br /> <br /> This issue affects Kiuwan SAST:
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2025

CVE-2022-48771
Publication date:
20/06/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/vmwgfx: Fix stale file descriptors on failed usercopy<br /> <br /> A failing usercopy of the fence_rep object will lead to a stale entry in<br /> the file descriptor table as put_unused_fd() won&amp;#39;t release it. This<br /> enables userland to refer to a dangling &amp;#39;file&amp;#39; object through that still<br /> valid file descriptor, leading to all kinds of use-after-free<br /> exploitation scenarios.<br /> <br /> Fix this by deferring the call to fd_install() until after the usercopy<br /> has succeeded.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2025

CVE-2023-52883
Publication date:
20/06/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix possible null pointer dereference<br /> <br /> abo-&gt;tbo.resource may be NULL in amdgpu_vm_bo_update.
Severity CVSS v4.0: Pending analysis
Last modification:
24/03/2025

CVE-2024-6183
Publication date:
20/06/2024
A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2024

CVE-2024-6184
Publication date:
20/06/2024
A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/reboot/reboot_commit.php. The manipulation of the argument servicename leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: MEDIUM
Last modification:
21/08/2025

CVE-2024-6185
Publication date:
20/06/2024
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function get_ip_addr_details of the file /view/dhcp/dhcpConfig/commit.php. The manipulation of the argument ethname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2024
Subscribe to Vulnerabilities