Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-41860

Publication date:

27/09/2023

Unauth. Cross-Site Scripting (XSS) vulnerability in TravelMap plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2023-41335

Publication date:

27/09/2023

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be briefly held in the server database. While this doesn&#39;t grant the server any added capabilities—it already learns the users&#39; passwords as part of the authentication process—it does disrupt the expectation that passwords won&#39;t be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration. These temporarily stored passwords are automatically erased after a 48-hour window. This issue has been addressed in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2024

CVE-2023-41861

Publication date:

27/09/2023

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Restrict plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2023-41878

Publication date:

27/09/2023

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2023

CVE-2023-41332

Publication date:

27/09/2023

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium&#39;s Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-41333

Publication date:

27/09/2023

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted `endpointSelector` that uses the `DoesNotExist` operator on the `reserved:init` label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster. This includes potentially allowing or denying all traffic. This attack requires API server access, as described in the Kubernetes API Server Attacker section of the Cilium Threat Model. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. As a workaround an admission webhook can be used to prevent the use of `endpointSelectors` that use the `DoesNotExist` operator on the `reserved:init` label in CiliumNetworkPolicies.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2023

CVE-2023-41310

Publication date:

27/09/2023

Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the background.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2023-41311

Publication date:

27/09/2023

Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause an app to be activated automatically.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2024

CVE-2023-41312

Publication date:

27/09/2023

Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause several apps to be activated automatically.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2023

CVE-2023-41320

Publication date:

27/09/2023

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to takeover an administrator account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-41321

Publication date:

27/09/2023

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user can enumerate sensitive fields values on resources on which he has read access. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

CVE-2023-41322

Publication date:

27/09/2023

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter&#39;s password and then take control of their account. Users are advised to upgrade to version 10.0.10. There are no known work around for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2023

Subscribe to Vulnerabilities