Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-18603

Publication date:

29/10/2019

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent over the network to a peer.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2019-18602

Publication date:

29/10/2019

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2019-18612

Publication date:

29/10/2019

An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFilter filters were viewable (or their differences were viewable) to unprivileged users, thus disclosing potentially sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2019

CVE-2019-18611

Publication date:

29/10/2019

An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available via the MediaWiki API was potentially visible to users with various levels of access to this extension. Said users should not have been able to view these oversighted edit summaries via the MediaWiki API.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2019

CVE-2019-18601

Publication date:

29/10/2019

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTE_Debug RPC calls to crash a database server within the SVOTE_Debug RPC handler.

Severity CVSS v4.0: Pending analysis

Last modification:

06/11/2019

CVE-2019-18604

Publication date:

29/10/2019

In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

31/05/2023

CVE-2019-18608

Publication date:

29/10/2019

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT /ajax/cart operation for a checkout, because of getValidDocumentForUpdate in api/server/services/orders/orders.js.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-15680

Publication date:

29/10/2019

TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.

Severity CVSS v4.0: Pending analysis

Last modification:

09/12/2020

CVE-2019-15681

Publication date:

29/10/2019

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.

Severity CVSS v4.0: Pending analysis

Last modification:

05/04/2022

CVE-2019-15683

Publication date:

29/10/2019

TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea98166008301e614e0d36776bf9435a536136e.

Severity CVSS v4.0: Pending analysis

Last modification:

05/11/2019

CVE-2019-16647

Publication date:

29/10/2019

Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.

Severity CVSS v4.0: Pending analysis

Last modification:

05/11/2019

CVE-2019-15678

Publication date:

29/10/2019

TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via network connectivity.

Severity CVSS v4.0: Pending analysis

Last modification:

09/12/2020

Subscribe to Vulnerabilities