Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-24166
Publication date:
26/01/2023
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/formWifiBasicSet.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2023-24165
Publication date:
26/01/2023
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/initIpAddrInfo.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2023-24164
Publication date:
26/01/2023
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via /goform/FUN_000c2318.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2023-24423
Publication date:
26/01/2023
A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24424
Publication date:
26/01/2023
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24425
Publication date:
26/01/2023
Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24426
Publication date:
26/01/2023
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-24022
Publication date:
26/01/2023
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.) <br />
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-24057
Publication date:
26/01/2023
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).
Severity CVSS v4.0: Pending analysis
Last modification:
01/04/2025

CVE-2023-23949
Publication date:
26/01/2023
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2023-23619
Publication date:
26/01/2023
Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue has been partially mitigated in version 1.0.0, with the maintainer&amp;#39;s GitHub Security Advisory (GHSA) noting "It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior." The suggested workaround from the maintainers is "Fully custom presets that change the entire rendering process which can then escape the user input."
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2023

CVE-2023-23951
Publication date:
26/01/2023
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025
Subscribe to Vulnerabilities