Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-18824

Publication date:

17/12/2019

Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of the mutable content on the UBIFS partition before being used.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-18829

Publication date:

17/12/2019

Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed &#39;Clickshare_For_Windows.exe&#39; binary on the ClickShare Button (R9861500D01) loads a number of DLL files dynamically without verifying their integrity.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-18825

Publication date:

17/12/2019

Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements encryption at rest using encryption keys which are shared across all ClickShare Base Units of models CS-100 & CSE-200.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2019

CVE-2014-8178

Publication date:

17/12/2019

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2023

CVE-2019-19815

Publication date:

17/12/2019

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h.

Severity CVSS v4.0: Pending analysis

Last modification:

03/01/2020

CVE-2019-19814

Publication date:

17/12/2019

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.

Severity CVSS v4.0: Pending analysis

Last modification:

03/01/2020

CVE-2019-19813

Publication date:

17/12/2019

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.

Severity CVSS v4.0: Pending analysis

Last modification:

12/03/2021

CVE-2019-19816

Publication date:

17/12/2019

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

19/01/2023

CVE-2019-19830

Publication date:

17/12/2019

_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.

Severity CVSS v4.0: Pending analysis

Last modification:

03/05/2022

CVE-2019-15011

Publication date:

17/12/2019

The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2019

CVE-2017-18107

Publication date:

17/12/2019

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability. Please be aware that the Demo application is not enabled by default.

Severity CVSS v4.0: Pending analysis

Last modification:

27/12/2019

CVE-2019-19826

Publication date:

16/12/2019

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.

Severity CVSS v4.0: Pending analysis

Last modification:

27/12/2019

Subscribe to Vulnerabilities