Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-22441

Publication date:

10/05/2023

Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting information of the product or execute some critical functions without authentication, e.g., rebooting the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-23578

Publication date:

10/05/2023

Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to connect to the product&#39;s ADB port.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-23901

Publication date:

10/05/2023

Improper following of a certificate&#39;s chain of trust exists in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, and SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, which may allow a remote unauthenticated attacker to eavesdrop on or alter the communication sent to the WebUI of the product.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-22361

Publication date:

10/05/2023

Improper privilege management vulnerability in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier allows a remote authenticated attacker to alter a WebUI password of the product.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2022-4008

Publication date:

10/05/2023

In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-32570

Publication date:

10/05/2023

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-32569

Publication date:

10/05/2023

An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web application is vulnerable to SQL Injection in some of the areas of the application. This allows attackers (who must have admin credentials) to submit arbitrary SQL commands on the back-end database to create, read, update, or delete any sensitive data stored in the database.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-32568

Publication date:

10/05/2023

An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level privileges can leverage this to read sensitive data stored on the servers, modify data or server configuration, and delete data or application configuration.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2023-2616

Publication date:

10/05/2023

Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

Severity CVSS v4.0: Pending analysis

Last modification:

12/05/2023

CVE-2023-26126

Publication date:

10/05/2023

All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-25833

Publication date:

10/05/2023

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2022-36330

Publication date:

10/05/2023

A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi devices. An attacker would require exploitation of another vulnerability to raise their privileges in order to exploit this buffer overflow vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191.

Severity CVSS v4.0: Pending analysis

Last modification:

22/05/2023

Subscribe to Vulnerabilities