Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-17563

Publication date:

01/04/2019

A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device&#39;s configuration in cleartext.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2017-8023

Publication date:

01/04/2019

EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when oldauth authentication method is used. An unauthenticated remote attacker could send arbitrary commands via RPC service to be executed on the host system with the privileges of the nsrexecd service, which runs with administrative privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2019

CVE-2019-3489

Publication date:

01/04/2019

An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenticated remote attacker to upload content to arbitrary locations on the Content Manager server.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-6715

Publication date:

01/04/2019

pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.

Severity CVSS v4.0: Pending analysis

Last modification:

26/05/2023

CVE-2018-4050

Publication date:

01/04/2019

An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy&#39;s Games, version 1.2.47 for macOS. An attacker can globally adjust folder permissions leading to execution of arbitrary code with elevated privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

07/06/2022

CVE-2019-8956

Publication date:

01/04/2019

In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2023

CVE-2019-5523

Publication date:

01/04/2019

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2019

CVE-2019-10686

Publication date:

01/04/2019

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2019

CVE-2018-5757

Publication date:

01/04/2019

An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to Remote Code Execution via shell metacharacters in the query string.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2019

CVE-2019-9132

Publication date:

01/04/2019

Remote code execution vulnerability exists in KaKaoTalk PC messenger when user clicks specially crafted link in the message window. This affects KaKaoTalk windows version 2.7.5.2024 or lower.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-10684

Publication date:

01/04/2019

Application/Admin/Controller/ConfigController.class.php in 74cms v5.0.1 allows remote attackers to execute arbitrary PHP code via the index.php?m=Admin&c=config&a=edit site_domain parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2019