Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-9161

Publication date:

18/04/2019

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginx_webconsole.php Cookie header can be used to read an etc/config/wac/wns_cfg_admin_detail.xml file containing the admin password. (The password for root is the WebUI admin password concatenated with a static string.)

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-9160

Publication date:

18/04/2019

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP port 22345) and escalate to root (because the password for root is the WebUI admin password concatenated with a static string).

Severity CVSS v4.0: Pending analysis

Last modification:

19/04/2019

CVE-2019-11015

Publication date:

18/04/2019

A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user&#39;s stored credentials (partially). This occurs because of paste access to a social media login page.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-11331

Publication date:

18/04/2019

Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-11324

Publication date:

18/04/2019

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-3718

Publication date:

18/04/2019

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2023

CVE-2019-3719

Publication date:

18/04/2019

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.

Severity CVSS v4.0: Pending analysis

Last modification:

01/01/2022

CVE-2019-10893

Publication date:

18/04/2019

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2019

CVE-2019-11084

Publication date:

18/04/2019

GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.

Severity CVSS v4.0: Pending analysis

Last modification:

19/04/2019

CVE-2018-20200

Publication date:

18/04/2019

CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don&#39;t consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2019-9005

Publication date:

18/04/2019

The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.

Severity CVSS v4.0: Pending analysis

Last modification:

19/04/2019

CVE-2019-3885

Publication date:

18/04/2019

A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

Subscribe to Vulnerabilities