Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-11269

Publication date:

12/06/2019

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2019-0306

Publication date:

12/06/2019

SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-0307

Publication date:

12/06/2019

Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-3947

Publication date:

12/06/2019

Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-6584

Publication date:

12/06/2019

A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2020

CVE-2019-6580

Publication date:

12/06/2019

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

16/10/2020

CVE-2019-6581

Publication date:

12/06/2019

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

16/10/2020

CVE-2019-6582

Publication date:

12/06/2019

A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2020

CVE-2019-6571

Publication date:

12/06/2019

A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy08-0BA0 FS:01 / Firmware version

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2020

CVE-2019-1081

Publication date:

12/06/2019

An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.<br /> To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker&#39;s site.<br /> The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.

Severity CVSS v4.0: Pending analysis

Last modification:

20/05/2025