Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-7105

Publication date:

23/05/2019

Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2019

CVE-2017-11738

Publication date:

23/05/2019

In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the &#39;haid&#39; parameter of the &#39;/auditLogAction.do&#39; module is vulnerable to a Time-based Blind SQL Injection attack.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2020

CVE-2019-12301

Publication date:

23/05/2019

The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-7104

Publication date:

23/05/2019

Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-7130

Publication date:

23/05/2019

Adobe Bridge CC versions 9.0.2 have a heap overflow vulnerability. Successful exploitation could lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-7107

Publication date:

23/05/2019

Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability. Successful exploitation could lead to arbitrary code execution. Fixed in versions 13.1.1 and 14.0.2.

Severity CVSS v4.0: Pending analysis

Last modification:

12/10/2022

CVE-2019-7097

Publication date:

23/05/2019

Adobe Dreamweaver versions 19.0 and earlier have an insecure protocol implementation vulnerability. Successful exploitation could lead to sensitive data disclosure if smb request is subject to a relay attack.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2021

CVE-2019-12300

Publication date:

23/05/2019

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-12272

Publication date:

23/05/2019

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2017-15652

Publication date:

23/05/2019

Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023