Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-1000007

Publication date:

04/02/2019

aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2018-1962

Publication date:

04/02/2019

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1970

Publication date:

04/02/2019

IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1801

Publication date:

04/02/2019

IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1675

Publication date:

04/02/2019

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-20752

Publication date:

04/02/2019

An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically, when a Twitter user possesses an Excel macro for a username, it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-1000001

Publication date:

04/02/2019

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-1000002

Publication date:

04/02/2019

Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-7352

Publication date:

04/02/2019

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view &#39;state&#39; (aka Run State) (state.php) does no input validation to the value supplied to the &#39;New State&#39; (aka newState) field, allowing an attacker to execute HTML or JavaScript code.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2019

CVE-2019-7351

Publication date:

04/02/2019

Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the &#39;log&#39; view page, as demonstrated by the message=User%20&#39;admin&#39;%20Logged%20in value.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2019

CVE-2019-7340

Publication date:

04/02/2019

POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable &#39;filter[Query][terms][0][val]&#39; parameter value in the view filter (filter.php) because proper filtration is omitted.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2019

CVE-2019-7341

Publication date:

04/02/2019

Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable &#39;newMonitor[LinkedMonitors]&#39; parameter value in the view monitor (monitor.php) because proper filtration is omitted.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2019

Subscribe to Vulnerabilities