Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16179
Publication date:
09/09/2019
Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16175
Publication date:
09/09/2019
A clickjacking vulnerability was found in Limesurvey before 3.17.14.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-16145
Publication date:
09/09/2019
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2019

CVE-2019-16181
Publication date:
09/09/2019
In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-16184
Publication date:
09/09/2019
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-10253
Publication date:
09/09/2019
A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-15297
Publication date:
09/09/2019
res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
30/08/2022

CVE-2019-6995
Publication date:
09/09/2019
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-6793
Publication date:
09/09/2019
An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2019

CVE-2019-6792
Publication date:
09/09/2019
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-6794
Publication date:
09/09/2019
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 5 of 6). A project guest user can view the last commit status of the default branch.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-6795
Publication date:
09/09/2019
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social engineering.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020
Subscribe to Vulnerabilities