Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-26112

Publication date:

03/04/2023

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\).<br /> <br /> **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-28674

Publication date:

02/04/2023

A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28675

Publication date:

02/04/2023

A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28678

Publication date:

02/04/2023

Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28679

Publication date:

02/04/2023

Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2025

CVE-2023-28680

Publication date:

02/04/2023

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28676

Publication date:

02/04/2023

A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28684

Publication date:

02/04/2023

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

20/02/2025

CVE-2023-28683

Publication date:

02/04/2023

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

21/02/2025

CVE-2023-28682

Publication date:

02/04/2023

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28681

Publication date:

02/04/2023

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

CVE-2023-28677

Publication date:

02/04/2023

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects&#39; Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2025

Subscribe to Vulnerabilities