Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-38951

Publication date:

03/08/2023

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2026

CVE-2023-38952

Publication date:

03/08/2023

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2026

CVE-2023-37501

Publication date:

03/08/2023

A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. An attacker could hijack a user&#39;s session and perform other attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2023

CVE-2023-38949

Publication date:

03/08/2023

An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2026

CVE-2023-37500

Publication date:

03/08/2023

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. An attacker could hijack a user&#39;s session and perform other attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2023

CVE-2023-37499

Publication date:

03/08/2023

A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user&#39;s session and perform other attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2023

CVE-2023-37498

Publication date:

03/08/2023

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2023-37497

Publication date:

03/08/2023

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2023-30958

Publication date:

03/08/2023

A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry&#39;s CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-30952

Publication date:

03/08/2023

A security defect was discovered in Foundry Issues that enabled users to create convincing phishing links by editing the request sent when creating an Issue. This defect was resolved in Frontend release 6.228.0 .

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-20216

Publication date:

03/08/2023

A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a user with the BWORKS or BWSUPERADMIN role and issuing crafted commands on an affected system. A successful exploit could allow the attacker to execute commands beyond the sphere of their intended access level, including initiating installs or running operating system commands with elevated permissions. There are workarounds that address this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

25/01/2024

CVE-2023-20218

Publication date:

03/08/2023

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user&#39;s browser. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco will not release software updates that address this vulnerability. {{value}} ["%7b%7bvalue%7d%7d"])}]]

Severity CVSS v4.0: Pending analysis

Last modification:

25/01/2024

Subscribe to Vulnerabilities