Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-19215

Publication date:

12/11/2018

Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! characters.

Severity CVSS v4.0: Pending analysis

Last modification:

13/07/2020

CVE-2018-19216

Publication date:

12/11/2018

Netwide Assembler (NASM) before 2.13.02 has a use-after-free in detoken at asm/preproc.c.

Severity CVSS v4.0: Pending analysis

Last modification:

13/07/2020

CVE-2018-19212

Publication date:

12/11/2018

In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-19219

Publication date:

12/11/2018

In LibSass 3.5-stable, there is an illegal address access at Sass::Eval::operator that will lead to a DoS attack.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-19207

Publication date:

12/11/2018

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-19205

Publication date:

12/11/2018

Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.

Severity CVSS v4.0: Pending analysis

Last modification:

10/03/2022

CVE-2018-19206

Publication date:

12/11/2018

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

Severity CVSS v4.0: Pending analysis

Last modification:

10/03/2022

CVE-2018-1786

Publication date:

12/11/2018

IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1798

Publication date:

12/11/2018

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149428.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1884

Publication date:

12/11/2018

IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerable to a "zip slip" vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-19203

Publication date:

12/11/2018

PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request.

Severity CVSS v4.0: Pending analysis

Last modification:

29/06/2021

CVE-2018-19204

Publication date:

12/11/2018

PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user&#39;s input in the POST parameter &#39;proxyport_&#39; is mishandled. The attacker can craft an HTTP request and override the &#39;writeresult&#39; command-line parameter for HttpAdvancedSensor.exe to store arbitrary data in an arbitrary place on the file system. For example, the attacker can create an executable file in the \Custom Sensors\EXE directory and execute it by creating EXE/Script Sensor.

Severity CVSS v4.0: Pending analysis

Last modification:

29/06/2021

Subscribe to Vulnerabilities