Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-15506
Publication date:
26/08/2019
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2016-10931
Publication date:
26/08/2019
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Severity CVSS v4.0: Pending analysis
Last modification:
27/02/2023

CVE-2019-15478
Publication date:
26/08/2019
Status Board 1.1.81 has reflected XSS via logic.ts.
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019

CVE-2019-15532
Publication date:
26/08/2019
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019

CVE-2019-15534
Publication date:
26/08/2019
Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019

CVE-2019-15489
Publication date:
26/08/2019
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019

CVE-2019-15541
Publication date:
26/08/2019
rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.
Severity CVSS v4.0: Pending analysis
Last modification:
03/09/2019

CVE-2019-15540
Publication date:
25/08/2019
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-15538
Publication date:
25/08/2019
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2016-6154
Publication date:
23/08/2019
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019

CVE-2019-6695
Publication date:
23/08/2019
Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods.
Severity CVSS v4.0: Pending analysis
Last modification:
01/03/2023

CVE-2019-5594
Publication date:
23/08/2019
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019
Subscribe to Vulnerabilities