Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-41055

Publication date:

04/09/2023

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery (SSRF) vulnerability in the `engines/google/text.php` and `engines/duckduckgo/text.php` files in versions before commit be59098abd119cda70b15bf3faac596dfd39a744. This vulnerability allows remote attackers to request the server to send HTTP GET requests to arbitrary targets and conduct Denial-of-Service (DoS) attacks via the `wikipedia_language` cookie. Remote attackers can request the server to download large files to reduce the performance of the server or even deny access from legitimate users. This issue has been patched in https://github.com/Ahwxorg/LibreY/pull/9. LibreY hosters are advised to use the latest commit. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-41054

Publication date:

04/09/2023

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery (SSRF) vulnerability in the `image_proxy.php` file of LibreY before commit 8f9b9803f231e2954e5b49987a532d28fe50a627. This vulnerability allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks via the `url` parameter. Remote attackers can use the server as a proxy to send HTTP GET requests and retrieve information in the internal network. Remote attackers can also request the server to download large files or chain requests among multiple instances to reduce the performance of the server or even deny access from legitimate users. This issue has been addressed in https://github.com/Ahwxorg/LibreY/pull/31. LibreY hosters are advised to use the latest commit. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-41052

Publication date:

04/09/2023

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-40015

Publication date:

04/09/2023

Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (deprecated), raw_call, , =, ==, !=, in, not in (when lhs and rhs are enums)`. This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect: state modifying external call , state modifying internal call, `raw_call`, `pop()` when used on a Dynamic Array stored in the storage, `create_minimal_proxy_to`, `create_copy_of`, `create_from_blueprint`. This issue has not yet been patched. Users are advised to make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-4758

Publication date:

04/09/2023

Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV.

Severity CVSS v4.0: Pending analysis

Last modification:

06/09/2023

CVE-2023-28072

Publication date:

04/09/2023

<br /> Dell Alienware Command Center, versions prior to 5.5.51.0, contain a deserialization of untrusted data vulnerability. A local malicious user could potentially send specially crafted requests to the .NET Remoting server to run arbitrary code on the system.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-4750

Publication date:

04/09/2023

Use After Free in GitHub repository vim/vim prior to 9.0.1857.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2023-4755

Publication date:

04/09/2023

Use After Free in GitHub repository gpac/gpac prior to 2.3-DEV.

Severity CVSS v4.0: Pending analysis

Last modification:

06/09/2023

CVE-2023-4752

Publication date:

04/09/2023

Use After Free in GitHub repository vim/vim prior to 9.0.1858.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2023-4733

Publication date:

04/09/2023

Use After Free in GitHub repository vim/vim prior to 9.0.1840.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2023-3222

Publication date:

04/09/2023

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-3221

Publication date:

04/09/2023

User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the password recovery function to enumerate all users in the database.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

Subscribe to Vulnerabilities