Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-4559
Publication date:
10/01/2020
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 166355.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2020

CVE-2020-1766
Publication date:
10/01/2020
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
Severity CVSS v4.0: Pending analysis
Last modification:
31/08/2023

CVE-2020-1767
Publication date:
10/01/2020
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. This issue affects: ((OTRS)) Community Edition 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
Severity CVSS v4.0: Pending analysis
Last modification:
31/08/2023

CVE-2020-1765
Publication date:
10/01/2020
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.
Severity CVSS v4.0: Pending analysis
Last modification:
31/08/2023

CVE-2014-5093
Publication date:
10/01/2020
Status2k does not remove the install directory allowing credential reset.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2020

CVE-2013-7380
Publication date:
10/01/2020
The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2020

CVE-2014-4561
Publication date:
10/01/2020
The ultimate-weather plugin 1.0 for WordPress has XSS
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2020

CVE-2013-6231
Publication date:
10/01/2020
SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
Severity CVSS v4.0: Pending analysis
Last modification:
21/01/2020

CVE-2013-6430
Publication date:
10/01/2020
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
Severity CVSS v4.0: Pending analysis
Last modification:
22/01/2020

CVE-2014-5092
Publication date:
10/01/2020
Status2k allows Remote Command Execution in admin/options/editpl.php.
Severity CVSS v4.0: Pending analysis
Last modification:
21/01/2020

CVE-2011-4595
Publication date:
10/01/2020
Pretty-Link WordPress plugin 1.5.2 has XSS
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2025

CVE-2014-5081
Publication date:
10/01/2020
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
Severity CVSS v4.0: Pending analysis
Last modification:
16/08/2021
Subscribe to Vulnerabilities