Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-47155

Publication date:

14/03/2023

Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-47162

Publication date:

14/03/2023

Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH – Anti AdBlocker plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-47163

Publication date:

14/03/2023

Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-47595

Publication date:

14/03/2023

Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in WP Go Maps (formerly WP Google Maps) plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-27500

Publication date:

14/03/2023

An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2023-27501

Publication date:

14/03/2023

SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

CVE-2023-27893

Publication date:

14/03/2023

An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

CVE-2023-27894

Publication date:

14/03/2023

SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

CVE-2023-27895

Publication date:

14/03/2023

SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

CVE-2023-27896

Publication date:

14/03/2023

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

CVE-2023-27271

Publication date:

14/03/2023

In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

CVE-2023-27498

Publication date:

14/03/2023

SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a crafted request which results in a memory corruption error. This error can be used to reveal but not modify any technical information about the server. It can also make a particular service temporarily unavailable

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2023

Subscribe to Vulnerabilities