Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-10323

Publication date:

31/05/2019

A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various &#39;fillCredentialsIdItems&#39; methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2019-10322

Publication date:

31/05/2019

A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2019-10330

Publication date:

31/05/2019

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2019-10329

Publication date:

31/05/2019

Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2023

CVE-2019-12507

Publication date:

31/05/2019

An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

31/05/2019

CVE-2019-12502

Publication date:

31/05/2019

There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI.

Severity CVSS v4.0: Pending analysis

Last modification:

31/05/2019

CVE-2019-12499

Publication date:

31/05/2019

Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-12500

Publication date:

31/05/2019

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-12496

Publication date:

31/05/2019

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2024

CVE-2019-12495

Publication date:

31/05/2019

An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to a one-byte out-of-bounds write in the gsym_addr function in x86_64-gen.c. This occurs because tccasm.c mishandles section switches.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2019

CVE-2019-12493

Publication date:

31/05/2019

A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace mishandle tint transform functions. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-12481

Publication date:

30/05/2019

An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a, as demonstrated by MP4Box.

Severity CVSS v4.0: Pending analysis

Last modification:

14/03/2025

Subscribe to Vulnerabilities