Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-12401

Publication date:

28/02/2019

Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a &#39;?&#39; in the parsed string. This could lead to denial of service (DOS) attacks. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2019

CVE-2018-12406

Publication date:

28/02/2019

Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2019

CVE-2018-12400

Publication date:

28/02/2019

In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage of sites visited during private browsing sessions. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2019

CVE-2018-12407

Publication date:

28/02/2019

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2019

CVE-2018-18492

Publication date:

28/02/2019

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2019

CVE-2018-18494

Publication date:

28/02/2019

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2019

CVE-2018-18493

Publication date:

28/02/2019

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2019

CVE-2018-12405

Publication date:

28/02/2019

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

12/03/2019

CVE-2018-12402

Publication date:

28/02/2019

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor&#39;s Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-12403

Publication date:

28/02/2019

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-18495

Publication date:

28/02/2019

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-18496

Publication date:

28/02/2019

When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

Subscribe to Vulnerabilities