Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-12389

Publication date:

02/12/2019

Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5010.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-12390

Publication date:

02/12/2019

Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port tcp/5010.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-12392

Publication date:

02/12/2019

Anviz access control devices allow remote attackers to issue commands without a password.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-12391

Publication date:

02/12/2019

The Anviz Management System for access control has insufficient logging for device events such as door open requests.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2019

CVE-2019-12393

Publication date:

02/12/2019

Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2019

CVE-2019-19502

Publication date:

02/12/2019

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-15628

Publication date:

02/12/2019

Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started.

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2019

CVE-2019-19118

Publication date:

02/12/2019

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model&#39;s save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-19245

Publication date:

02/12/2019

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2025

CVE-2019-19496

Publication date:

02/12/2019

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2019

CVE-2019-19362

Publication date:

02/12/2019

An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2024