Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-10906
Publication date:
07/04/2019
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-10904
Publication date:
06/04/2019
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
Severity CVSS v4.0: Pending analysis
Last modification:
09/04/2019

CVE-2019-10905
Publication date:
06/04/2019
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-9490
Publication date:
05/04/2019
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 could allow an non-authorized user to disclose administrative credentials. An attacker must be an authenticated user in order to exploit the vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-9489
Publication date:
05/04/2019
A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5 and 9.0) could allow an attacker to modify arbitrary files on the affected product's management console.
Severity CVSS v4.0: Pending analysis
Last modification:
24/09/2021

CVE-2019-10478
Publication date:
05/04/2019
An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glytoolcgi/settingfile_upload.cgi allows attackers to upload supplied data. This can be used to place attacker controlled code on the filesystem that can be executed and can lead to a reverse root shell.
Severity CVSS v4.0: Pending analysis
Last modification:
09/04/2019

CVE-2019-10479
Publication date:
05/04/2019
An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface.
Severity CVSS v4.0: Pending analysis
Last modification:
09/04/2019

CVE-2019-6554
Publication date:
05/04/2019
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition.
Severity CVSS v4.0: Pending analysis
Last modification:
16/10/2020

CVE-2019-6550
Publication date:
05/04/2019
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2020

CVE-2019-6552
Publication date:
05/04/2019
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2020

CVE-2019-10888
Publication date:
05/04/2019
A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html.
Severity CVSS v4.0: Pending analysis
Last modification:
07/04/2019

CVE-2019-10887
Publication date:
05/04/2019
A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name= request.
Severity CVSS v4.0: Pending analysis
Last modification:
01/03/2023
Subscribe to Vulnerabilities