Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18984

Publication date:

14/12/2018

Medtronic CareLink and Encore Programmers<br /> <br /> do not encrypt or do not sufficiently encrypt sensitive <br /> PII and PHI information while at rest .

Severity CVSS v4.0: Pending analysis

Last modification:

22/05/2025

CVE-2018-16875

Publication date:

14/12/2018

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-16873

Publication date:

14/12/2018

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it&#39;s possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-16874

Publication date:

14/12/2018

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both &#39;{&#39; and &#39;}&#39; characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-18096

Publication date:

14/12/2018

Improper memory handling in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2019

CVE-2018-18093

Publication date:

14/12/2018

Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-18097

Publication date:

14/12/2018

Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalation of privilege via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-3704

Publication date:

14/12/2018

Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially enable an escalation of privilege via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-3705

Publication date:

14/12/2018

Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to potentially enable a denial of service via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-6707

Publication date:

14/12/2018

Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to cause DoS, unexpected behavior, or potentially unauthorized code execution via knowledge of the internal trust mechanism.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-14623

Publication date:

14/12/2018

A SQL injection flaw was found in katello&#39;s errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2018-12206

Publication date:

14/12/2018

Improper configuration of hardware access in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2019

Subscribe to Vulnerabilities