Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-1229

Publication date:
21/03/2018
Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2018-1230

Publication date:
21/03/2018
Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection. A remote unauthenticated user could craft a malicious site that executes requests to Spring Batch Admin. This issue has not been patched because Spring Batch Admin has reached end of life.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2018-8073

Publication date:
21/03/2018
Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2018

CVE-2018-7269

Publication date:
21/03/2018
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2018

CVE-2018-8074

Publication date:
21/03/2018
Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2018

CVE-2017-18241

Publication date:
21/03/2018
fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.
Severity CVSS v4.0: Pending analysis
Last modification:
18/03/2019

CVE-2018-1344

Publication date:
21/03/2018
Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-1345

Publication date:
21/03/2018
NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-1346

Publication date:
21/03/2018
Addresses denial of service attack to eDirectory versions prior to 9.1.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-1347

Publication date:
21/03/2018
The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-8881

Publication date:
20/03/2018
Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated string.
Severity CVSS v4.0: Pending analysis
Last modification:
13/07/2020

CVE-2018-8882

Publication date:
20/03/2018
Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.
Severity CVSS v4.0: Pending analysis
Last modification:
13/07/2020