Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-16117
Publication date:
20/06/2019
A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
13/07/2020

CVE-2019-8459
Publication date:
20/06/2019
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2019-8458
Publication date:
20/06/2019
Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL during an update initiated by the UI. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate.
Severity CVSS v4.0: Pending analysis
Last modification:
22/10/2020

CVE-2018-15890
Publication date:
20/06/2019
An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.
Severity CVSS v4.0: Pending analysis
Last modification:
20/06/2019

CVE-2018-16116
Publication date:
20/06/2019
SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2019

CVE-2018-15892
Publication date:
20/06/2019
FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2019

CVE-2018-15891
Publication date:
20/06/2019
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2019

CVE-2019-12905
Publication date:
20/06/2019
FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman&section=do&page=up URI. This issue has been fixed in FileRun 2019.06.01.
Severity CVSS v4.0: Pending analysis
Last modification:
23/03/2021

CVE-2018-16247
Publication date:
20/06/2019
YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
20/06/2019

CVE-2018-16248
Publication date:
20/06/2019
b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.
Severity CVSS v4.0: Pending analysis
Last modification:
21/06/2019

CVE-2018-16119
Publication date:
20/06/2019
Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code via a malicious MediaServer request to /userRpm/MediaServerFoldersCfgRpm.htm.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2017-17944
Publication date:
20/06/2019
The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.
Severity CVSS v4.0: Pending analysis
Last modification:
21/06/2019
Subscribe to Vulnerabilities