Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-4853

Publication date:

20/09/2023

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2023

CVE-2022-45447

Publication date:

20/09/2023

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2023

CVE-2023-41375

Publication date:

20/09/2023

Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2023

CVE-2023-41374

Publication date:

20/09/2023

Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2023

CVE-2023-22644

Publication date:

20/09/2023

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Severity CVSS v4.0: CRITICAL

Last modification:

15/10/2024

CVE-2022-47561

Publication date:

20/09/2023

The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2024

CVE-2022-47562

Publication date:

20/09/2023

Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2024

CVE-2022-47560

Publication date:

20/09/2023

The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2024

CVE-2023-2163

Publication date:

20/09/2023

Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe<br /> code paths being incorrectly marked as safe, resulting in arbitrary read/write in<br /> kernel memory, lateral privilege escalation, and container escape.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2024

CVE-2023-43617

Publication date:

20/09/2023

An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2024

CVE-2023-43618

Publication date:

20/09/2023

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2023

CVE-2023-43619

Publication date:

20/09/2023

An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2024

Subscribe to Vulnerabilities