Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-6913

Publication date:

19/12/2023

A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

28/12/2023

CVE-2023-1514

Publication date:

19/12/2023

A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.

Severity CVSS v4.0: Pending analysis

Last modification:

28/12/2023

CVE-2023-43870

Publication date:

19/12/2023

When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content.

Severity CVSS v4.0: Pending analysis

Last modification:

28/12/2023

CVE-2023-6869

Publication date:

19/12/2023

A `&lt;dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2023-6870

Publication date:

19/12/2023

Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This issue only affects Android versions of Firefox and Firefox Focus.* This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-6871

Publication date:

19/12/2023

Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-6872

Publication date:

19/12/2023

Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-6873

Publication date:

19/12/2023

Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-6931

Publication date:

19/12/2023

A heap out-of-bounds write vulnerability in the Linux kernel&#39;s Performance Events system component can be exploited to achieve local privilege escalation. A perf_event&#39;s read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

Severity CVSS v4.0: Pending analysis

Last modification:

12/05/2026

CVE-2023-6932

Publication date:

19/12/2023

A use-after-free vulnerability in the Linux kernel&#39;s ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

Severity CVSS v4.0: Pending analysis

Last modification:

12/05/2026

CVE-2023-6856

Publication date:

19/12/2023

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-6857

Publication date:

19/12/2023

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

Subscribe to Vulnerabilities