Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-13110

Publication date:

30/06/2019

A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-13111

Publication date:

30/06/2019

A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-13112

Publication date:

30/06/2019

A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-13113

Publication date:

30/06/2019

Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-13114

Publication date:

30/06/2019

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-13108

Publication date:

30/06/2019

An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-13107

Publication date:

30/06/2019

Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-20848

Publication date:

30/06/2019

Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter.

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2021

CVE-2018-20849

Publication date:

30/06/2019

Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.

Severity CVSS v4.0: Pending analysis

Last modification:

01/07/2019

CVE-2019-13086

Publication date:

30/06/2019

core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2019