Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-24576

Publication date:

03/02/2023

EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-23477

Publication date:

03/02/2023

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-20854

Publication date:

03/02/2023

VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim&#39;s machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2022-42909

Publication date:

03/02/2023

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2023

CVE-2022-42908

Publication date:

03/02/2023

WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2023

CVE-2022-31733

Publication date:

03/02/2023

Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2025

CVE-2023-23088

Publication date:

03/02/2023

Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2023-23087

Publication date:

03/02/2023

An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2023-0659

Publication date:

03/02/2023

A vulnerability was found in BDCOM 1704-WGL 2.0.6314. It has been classified as critical. This affects an unknown part of the file /param.file.tgz of the component Backup File Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The identifier VDB-220101 was assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2023-23086

Publication date:

03/02/2023

Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2021-37519

Publication date:

03/02/2023

Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2021-37518

Publication date:

03/02/2023

Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

Subscribe to Vulnerabilities