Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-19118

Publication date:
02/12/2019
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-19245

Publication date:
02/12/2019
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2025

CVE-2019-19496

Publication date:
02/12/2019
Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2019

CVE-2019-19362

Publication date:
02/12/2019
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
14/02/2024

CVE-2019-19493

Publication date:
02/12/2019
Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2022

CVE-2019-19492

Publication date:
02/12/2019
FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
Severity CVSS v4.0: Pending analysis
Last modification:
16/12/2019

CVE-2019-19490

Publication date:
02/12/2019
LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.exe.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2019

CVE-2019-19491

Publication date:
02/12/2019
TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request.
Severity CVSS v4.0: Pending analysis
Last modification:
04/12/2019

CVE-2019-19489

Publication date:
02/12/2019
SMPlayer 19.5.0 has a buffer overflow via a long .m3u file.
Severity CVSS v4.0: Pending analysis
Last modification:
09/12/2019

CVE-2019-15631

Publication date:
02/12/2019
Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
13/12/2019

CVE-2019-19480

Publication date:
01/12/2019
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-19481

Publication date:
01/12/2019
An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023