Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-16122

Publication date:
07/06/2018
cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16123

Publication date:
07/06/2018
welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16124

Publication date:
07/06/2018
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16125

Publication date:
07/06/2018
rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16127

Publication date:
07/06/2018
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16128

Publication date:
07/06/2018
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16129

Publication date:
07/06/2018
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16130

Publication date:
07/06/2018
exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible files are restricted to those with a file extension. Files with no extension such as /etc/passwd throw an error.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16131

Publication date:
07/06/2018
unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16132

Publication date:
07/06/2018
simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16133

Publication date:
07/06/2018
goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2017-16134

Publication date:
07/06/2018
http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019