Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-7804
Publication date:
17/12/2018
A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing.
Severity CVSS v4.0: Pending analysis
Last modification:
28/12/2018

CVE-2018-11795
Publication date:
17/12/2018
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-20190
Publication date:
17/12/2018
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
Severity CVSS v4.0: Pending analysis
Last modification:
23/07/2019

CVE-2018-20189
Publication date:
17/12/2018
In GraphicsMagick 1.3.31, the ReadDIBImage function of coders/dib.c has a vulnerability allowing a crash and denial of service via a dib file that is crafted to appear with direct pixel values and also colormapping (which is not available beyond 8-bits/sample), and therefore lacks indexes initialization.
Severity CVSS v4.0: Pending analysis
Last modification:
03/12/2019

CVE-2018-20188
Publication date:
17/12/2018
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account.
Severity CVSS v4.0: Pending analysis
Last modification:
07/01/2019

CVE-2018-20186
Publication date:
17/12/2018
An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an attempted excessive memory allocation, related to AP4_DataBuffer::SetDataSize and AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
Severity CVSS v4.0: Pending analysis
Last modification:
30/01/2019

CVE-2018-20133
Publication date:
17/12/2018
ymlref allows code injection.
Severity CVSS v4.0: Pending analysis
Last modification:
07/01/2019

CVE-2018-20185
Publication date:
17/12/2018
In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPImage function of bmp.c, which allows attackers to cause a denial of service via a crafted bmp image file. This only affects GraphicsMagick installations with customized BMP limits.
Severity CVSS v4.0: Pending analysis
Last modification:
18/08/2020

CVE-2018-20184
Publication date:
17/12/2018
In GraphicsMagick 1.4 snapshot-20181209 Q8, there is a heap-based buffer overflow in the WriteTGAImage function of tga.c, which allows attackers to cause a denial of service via a crafted image file, because the number of rows or columns can exceed the pixel-dimension restrictions of the TGA specification.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2018-20123
Publication date:
17/12/2018
pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-19976
Publication date:
17/12/2018
In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the design of the YARA virtual machine.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-20092
Publication date:
17/12/2018
PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
Severity CVSS v4.0: Pending analysis
Last modification:
20/06/2019
Subscribe to Vulnerabilities