Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-20306

Publication date:

20/12/2018

A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authenticated attacker to inject web script or HTML via a crafted website and steal sensitive data and credentials. Affected releases are Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1.

Severity CVSS v4.0: Pending analysis

Last modification:

08/01/2019

CVE-2018-20307

Publication date:

20/12/2018

Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity information by leveraging incorrect permission validation.

Severity CVSS v4.0: Pending analysis

Last modification:

14/07/2020

CVE-2018-20302

Publication date:

20/12/2018

An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

09/01/2019

CVE-2018-20304

Publication date:

20/12/2018

wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argument. NOTE: this is not a Microsoft product.

Severity CVSS v4.0: Pending analysis

Last modification:

31/01/2019

CVE-2018-20303

Publication date:

20/12/2018

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

Severity CVSS v4.0: Pending analysis

Last modification:

31/01/2019

CVE-2018-20300

Publication date:

20/12/2018

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2019

CVE-2018-20305

Publication date:

20/12/2018

D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function, a long password may lead to a stack-based buffer overflow and overwrite a return address.

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2023

CVE-2018-15798

Publication date:

19/12/2018

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user&#39;s access token in Concourse.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-15801

Publication date:

19/12/2018

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2022

CVE-2018-20299

Publication date:

19/12/2018

An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface, because there is a buffer overflow in the RCP+ parser of the web server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2021

CVE-2018-11799

Publication date:

19/12/2018

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user&#39;s name.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023