Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-39063

Publication date:
11/09/2023
Buffer Overflow vulnerability in RaidenFTPD 2.4.4005 allows a local attacker to execute arbitrary code via the Server name field of the Step by step setup wizard.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2024

CVE-2023-39068

Publication date:
11/09/2023
Buffer Overflow vulnerability in NBD80S09S-KLC v.YK_HZXM_NBD80S09S-KLC_V4.03.R11.7601.Nat.OnvifC.20230414.bin and NBD80N32RA-KL-V3 v.YK_HZXM_NBD80N32RA-KL_V4.03.R11.7601.Nat.OnvifC.20220120.bin allows a remote attacker to casue a denial of service via a crafted request to the service.XM component.
Severity CVSS v4.0: Pending analysis
Last modification:
14/09/2023

CVE-2023-39780

Publication date:
11/09/2023
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the similar "check token module" issue, see CVE-2023-41347; and for the similar "code-authentication module" issue, see CVE-2023-41348.
Severity CVSS v4.0: Pending analysis
Last modification:
31/10/2025

CVE-2023-38829

Publication date:
11/09/2023
An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface.
Severity CVSS v4.0: Pending analysis
Last modification:
13/09/2023

CVE-2023-38743

Publication date:
11/09/2023
Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2025

CVE-2023-31468

Publication date:
11/09/2023
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM. 2024-1 is a fixed version.
Severity CVSS v4.0: Pending analysis
Last modification:
12/07/2024

CVE-2020-19559

Publication date:
11/09/2023
An issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a remote attacker to execute arbitrary code via a crafted payload to the ResolveMethod() parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
15/09/2023

CVE-2020-19323

Publication date:
11/09/2023
An issue was discovered in /bin/mini_upnpd on D-Link DIR-619L 2.06beta devices. There is a heap buffer overflow allowing remote attackers to restart router via the M-search request ST parameter. No authentication required
Severity CVSS v4.0: Pending analysis
Last modification:
13/09/2023

CVE-2023-31067

Publication date:
11/09/2023
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMFILES(X86)%\TSplus\Clients\www.
Severity CVSS v4.0: Pending analysis
Last modification:
13/09/2023

CVE-2020-19320

Publication date:
11/09/2023
Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the curTime parameter on login.
Severity CVSS v4.0: Pending analysis
Last modification:
13/09/2023

CVE-2020-19319

Publication date:
11/09/2023
Buffer overflow vulnerability in DLINK 619L version B 2.06beta via the FILECODE parameter on login.
Severity CVSS v4.0: Pending analysis
Last modification:
13/09/2023

CVE-2023-31069

Publication date:
11/09/2023
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML source code of the login page.
Severity CVSS v4.0: Pending analysis
Last modification:
03/03/2026