Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-9925

Publication date:

22/03/2019

S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2019

CVE-2019-9924

Publication date:

22/03/2019

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

Severity CVSS v4.0: Pending analysis

Last modification:

05/04/2022

CVE-2019-9936

Publication date:

22/03/2019

In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-9937

Publication date:

22/03/2019

In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2019-9939

Publication date:

22/03/2019

The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to bypass authentication by trying to fetch a non-existing page. When the non-existing page is requested, the application responds with a 200 status code and empty page, and adds the requesting client device into the list of recognized devices.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-9927

Publication date:

22/03/2019

Caret before 2019-02-22 allows Remote Code Execution.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-9938

Publication date:

22/03/2019

The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The attacker must be authenticated as a "recognized device."

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-9923

Publication date:

22/03/2019

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025