Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-36482

Publication date:

08/08/2023

An issue was discovered in Samsung NFC S3NRN4V, S3NSN4V, S3NSEN4, SEN82AB, and S3NRN82. A buffer copy without checking its input size can cause an NFC service restart.

Severity CVSS v4.0: Pending analysis

Last modification:

15/08/2023

CVE-2023-38180

Publication date:

08/08/2023

.NET and Visual Studio Denial of Service Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2025

CVE-2023-39533

Publication date:

08/08/2023

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2023

CVE-2023-38815

Publication date:

08/08/2023

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-40042. Reason: This candidate is a reservation duplicate of CVE-2023-40042. Notes: All CVE users should reference CVE-2023-40042 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-40041

Publication date:

08/08/2023

TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2023

CVE-2023-40042

Publication date:

08/08/2023

TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2023

CVE-2023-36899

Publication date:

08/08/2023

ASP.NET Elevation of Privilege Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2024

CVE-2023-36873

Publication date:

08/08/2023

.NET Framework Spoofing Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2024

CVE-2023-39518

Publication date:

08/08/2023

social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1.0.3 have a stored cross-site scripting vulnerability. The problem is patched in v1.0.3.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2023

CVE-2023-35391

Publication date:

08/08/2023

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

06/11/2023

CVE-2023-3894

Publication date:

08/08/2023

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

15/08/2023

CVE-2023-39342

Publication date:

08/08/2023

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-cli` command) logs output from the container where the file sanitization takes place, to the user&#39;s terminal. Prior to version 0.4.2, if the container is compromised and can return attacker-controlled strings, then the attacker may be able to spoof messages in the user&#39;s terminal or change the window title. Besides logging output from containers, it also logs the names of the files it sanitizes. If these files contain ANSI escape sequences, then the same issue applies. Dangerzone is predominantly a GUI application, so this issue should leave most of our users unaffected. Nevertheless, we always suggest updating to the newest version. This issue is fixed in Dangerzone 0.4.2.

Severity CVSS v4.0: Pending analysis

Last modification:

16/08/2023

Subscribe to Vulnerabilities