Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-26139

Publication date:

01/08/2023

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-34960

Publication date:

01/08/2023

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-36983

Publication date:

01/08/2023

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-36984

Publication date:

01/08/2023

LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2020-10962

Publication date:

01/08/2023

In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default configuration may allow an authenticated user to potentially enable escalation of privilege via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-4033

Publication date:

01/08/2023

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-37772

Publication date:

01/08/2023

Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2023-37496

Publication date:

01/08/2023

HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim&#39;s web browser to perform operations as the victim and/or steal the victim&#39;s cookies, session tokens, or other sensitive information.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-3825

Publication date:

31/07/2023

<br /> PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption. KEPServerEX uses OPC UA, a protocol which defines various object types that can be nested to create complex arrays. It does not implement a check to see if such an object is recursively defined, so an attack could send a maliciously created message that the decoder would try to decode until the stack overflowed and the device crashed.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-3462

Publication date:

31/07/2023

HashiCorp&#39;s Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023

CVE-2023-39122

Publication date:

31/07/2023

BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2023