Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-45866

Publication date:

08/12/2023

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2023-48928

Publication date:

08/12/2023

Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The &#39;path&#39; parameter of the prefs.asp resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2023-48929

Publication date:

08/12/2023

Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The &#39;sid&#39; parameter in the group_status.asp resource allows an attacker to escalate privileges and obtain sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-26158

Publication date:

08/12/2023

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). User controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability. Workaround By using a denylist of dangerous attributes, this weakness can be eliminated. Add the following line in the Util.extend function: js js if (["__proto__", "constructor", "prototype"].includes(name)) continue js // src/mock/handler.js Util.extend = function extend() { var target = arguments[0] || {}, i = 1, length = arguments.length, options, name, src, copy, clone if (length === 1) { target = this i = 0 } for (; i

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-48122

Publication date:

08/12/2023

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2023

CVE-2023-43305

Publication date:

08/12/2023

An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2023

CVE-2023-43742

Publication date:

08/12/2023

An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an unauthenticated attacker to obtain an administrative session via a protection mechanism failure in the authentication function. In normal operation, the Zultys MX Administrator Windows client connects to port 7505 and attempts authentication, submitting the administrator username and password to the server. Upon authentication failure, the server sends a login failure message prompting the client to disconnect. However, if the client ignores the failure message instead and attempts to continue, the server does not forcibly close the connection and processes all subsequent requests from the client as if authentication had been successful.

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2023

CVE-2023-43743

Publication date:

08/12/2023

A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to the /newapi/ endpoint in the Zultys MX web interface.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2023-43744

Publication date:

08/12/2023

An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an administrator to execute arbitrary OS commands via a file name parameter in a patch application function. The Zultys MX Administrator client has a "Patch Manager" section that allows administrators to apply patches to the device. The user supplied filename for the patch file is passed to a shell script without validation. Including bash command substitution characters in a patch file name results in execution of the provided command.

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2023

CVE-2023-6599

Publication date:

08/12/2023

Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-5008

Publication date:

08/12/2023

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the &#39;regno&#39; parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2023

CVE-2023-6061

Publication date:

08/12/2023

Rejected reason: This CVE ID has been rejected/withdrawn by its CVE Numbering Authority (Palo Alto Networks) based on discussions with Mitsubishi Electronics Corporation&#39;s PSIRT.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2024

Subscribe to Vulnerabilities