Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-12112

Publication date:

18/03/2020

An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2020

CVE-2019-12113

Publication date:

18/03/2020

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2020

CVE-2019-12123

Publication date:

18/03/2020

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2020

CVE-2019-12124

Publication date:

18/03/2020

An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file. All APPC setups are affected.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-19351

Publication date:

18/03/2020

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/jenkins-slave-base-rhel7-containera as shipped in Openshift 4 and 3.11.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-19355

Publication date:

18/03/2020

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container as shipped in Openshift 4.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-10178

Publication date:

18/03/2020

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-19335

Publication date:

18/03/2020

During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-14871

Publication date:

18/03/2020

The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds).

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2020

CVE-2020-9326

Publication date:

18/03/2020

BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-10682

Publication date:

18/03/2020

django-nopassword before 5.0.0 stores cleartext secrets in the database.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-10146

Publication date:

18/03/2020

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim&#39;s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

Subscribe to Vulnerabilities