Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16154

Publication date:

07/01/2020

An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2020

CVE-2018-10465

Publication date:

07/01/2020

Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API (UAPI), regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges could be used to perform CRUD actions (GET, POST, PUT, DELETE) on UAPI endpoints, which could result in unauthorized information disclosure, compromised data integrity, and data loss. For a full listing of available UAPI endpoints and associated CRUD actions you can navigate to /uapi/doc in your instance of Jamf Pro.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-18386

Publication date:

07/01/2020

Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when receiving specifically crafted message payloads over a systems management communication channel

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-6700

Publication date:

07/01/2020

An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2014-8673

Publication date:

07/01/2020

Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33.

Severity CVSS v4.0: Pending analysis

Last modification:

08/01/2020

CVE-2019-14819

Publication date:

07/01/2020

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-14837

Publication date:

07/01/2020

A flaw was found in keycloack before version 8.0.0. The owner of &#39;placeholder.org&#39; domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name &#39;test&#39; the email address will be &#39;service-account-test@placeholder.org&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

15/01/2020

CVE-2019-14843

Publication date:

07/01/2020

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 are vulnerable to this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

15/01/2020

CVE-2019-14879

Publication date:

07/01/2020

A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2020

CVE-2019-14854

Publication date:

07/01/2020

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-14866

Publication date:

07/01/2020

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2023