Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-10202

Publication date:

01/10/2019

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2019-11275

Publication date:

01/10/2019

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.

Severity CVSS v4.0: Pending analysis

Last modification:

16/10/2020

CVE-2019-17056

Publication date:

01/10/2019

llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-17055

Publication date:

01/10/2019

base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-17054

Publication date:

01/10/2019

atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-17053

Publication date:

01/10/2019

ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-17052

Publication date:

01/10/2019

ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-15039

Publication date:

01/10/2019

An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-14954

Publication date:

01/10/2019

JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-14952

Publication date:

01/10/2019

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.

Severity CVSS v4.0: Pending analysis

Last modification:

02/10/2019

CVE-2019-10435

Publication date:

01/10/2019

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2019-10434

Publication date:

01/10/2019

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

Subscribe to Vulnerabilities