Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-2691

Publication date:

14/05/2023

A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/add_item.php of the component POST Parameter Handler. The manipulation of the argument item_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228972.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2023-2690

Publication date:

14/05/2023

A vulnerability, which was classified as critical, has been found in SourceCodester Personnel Property Equipment System 1.0. This issue affects some unknown processing of the file admin/returned_reuse_form.php of the component GET Parameter Handler. The manipulation of the argument client_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228971.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2023-2689

Publication date:

14/05/2023

A vulnerability classified as critical was found in SourceCodester Billing Management System 1.0. This vulnerability affects unknown code of the file editproduct.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-228970 is the identifier assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

07/09/2024

CVE-2023-25006

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-25007

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-25008

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-25009

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-20880

Publication date:

12/05/2023

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to &#39;root&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-32303

Publication date:

12/05/2023

Planet is software that provides satellite data. The secret file stores the user&#39;s Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user&#39;s group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

26/05/2023

CVE-2023-2181

Publication date:

12/05/2023

An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.

Severity CVSS v4.0: Pending analysis

Last modification:

26/05/2023

CVE-2023-25005

Publication date:

12/05/2023

A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to a resource injection vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-20878

Publication date:

12/05/2023

VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

Subscribe to Vulnerabilities