Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-20486

Publication date:

26/12/2018

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2019

CVE-2018-20484

Publication date:

26/12/2018

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2019

CVE-2018-20485

Publication date:

26/12/2018

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2019

CVE-2018-20483

Publication date:

26/12/2018

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file&#39;s origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-20482

Publication date:

26/12/2018

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user&#39;s process (e.g., a system backup running as root).

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2021

CVE-2018-0724

Publication date:

26/12/2018

Cross-site scripting (XSS) vulnerability in Q&#39;center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723.

Severity CVSS v4.0: Pending analysis

Last modification:

08/01/2019

CVE-2018-0723

Publication date:

26/12/2018

Severity CVSS v4.0: Pending analysis

Last modification:

08/01/2019

CVE-2018-17957

Publication date:

26/12/2018

The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-20481

Publication date:

26/12/2018

XRef::getEntry in XRef.cc in Poppler 0.72.0 mishandles unallocated XRef entries, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PDF document, when XRefEntry::setFlag in XRef.h is called from Parser::makeStream in Parser.cc.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2020

CVE-2018-20478

Publication date:

26/12/2018

An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value.

Severity CVSS v4.0: Pending analysis

Last modification:

17/01/2019