Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16147
Publication date:
09/09/2019
Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16179
Publication date:
09/09/2019
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16175
Publication date:
09/09/2019
A clickjacking vulnerability was found in Limesurvey before 3.17.14.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16145
Publication date:
09/09/2019
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2019

CVE-2019-16178
Publication date:
09/09/2019
A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16182
Publication date:
09/09/2019
A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16181
Publication date:
09/09/2019
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-16184
Publication date:
09/09/2019
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-16176
Publication date:
09/09/2019
A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-16180
Publication date:
09/09/2019
Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-10253
Publication date:
09/09/2019
A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-15297
Publication date:
09/09/2019
res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
30/08/2022
Subscribe to Vulnerabilities