Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-17052
Publication date:
01/10/2019
ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-15039
Publication date:
01/10/2019
An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-14954
Publication date:
01/10/2019
JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-14952
Publication date:
01/10/2019
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
Severity CVSS v4.0: Pending analysis
Last modification:
02/10/2019

CVE-2019-10435
Publication date:
01/10/2019
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2019-10434
Publication date:
01/10/2019
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2019-10433
Publication date:
01/10/2019
Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-10432
Publication date:
01/10/2019
Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2019-10431
Publication date:
01/10/2019
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2019-15940
Publication date:
01/10/2019
Victure PC530 devices allow unauthenticated TELNET access as root.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2019

CVE-2019-16508
Publication date:
01/10/2019
The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers to trigger an Integer Overflow and gain privileges via a malicious application. This occurs because of intentional access for the GPU process to /dev/dri/card1 and the PowerVR ioctl handler, as demonstrated by PVRSRVBridgeSyncPrimOpCreate.
Severity CVSS v4.0: Pending analysis
Last modification:
08/10/2019

CVE-2019-3729
Publication date:
30/09/2019
RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsing ECDSA signature. A malicious user with adjacent network access could potentially exploit this vulnerability to cause a crash in the library of the affected system.
Severity CVSS v4.0: Pending analysis
Last modification:
12/04/2022
Subscribe to Vulnerabilities