Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-16346
Publication date:
02/09/2018
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
Severity CVSS v4.0: Pending analysis
Last modification:
09/11/2018

CVE-2018-16345
Publication date:
02/09/2018
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2018

CVE-2018-16342
Publication date:
02/09/2018
ShowDoc v1.8.0 has XSS via a new page.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2018

CVE-2018-16338
Publication date:
02/09/2018
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2018

CVE-2018-16339
Publication date:
02/09/2018
An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2018

CVE-2018-16337
Publication date:
02/09/2018
An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2018

CVE-2018-16344
Publication date:
02/09/2018
An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2018

CVE-2018-16343
Publication date:
02/09/2018
SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2018

CVE-2018-16331
Publication date:
02/09/2018
admin.php?s=/Admin/doedit in DamiCMS v6.0.0 allows CSRF to change the administrator account's password.
Severity CVSS v4.0: Pending analysis
Last modification:
23/10/2018

CVE-2018-16332
Publication date:
02/09/2018
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2018

CVE-2018-16334
Publication date:
02/09/2018
An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN and AC10 V15.03.06.23_CN devices. The mac parameter in a POST request is used directly in a doSystemCmd call, causing OS command injection.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2018

CVE-2018-16333
Publication date:
02/09/2018
An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server. While processing the ssid parameter for a POST request, the value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2018
Subscribe to Vulnerabilities