Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2013-6785
Publication date:
23/01/2020
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
04/02/2020

CVE-2008-7314
Publication date:
23/01/2020
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2012-4863
Publication date:
23/01/2020
IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2012-2087
Publication date:
23/01/2020
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
Severity CVSS v4.0: Pending analysis
Last modification:
21/11/2024

CVE-2019-18898
Publication date:
23/01/2020
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
Severity CVSS v4.0: Pending analysis
Last modification:
10/11/2022

CVE-2019-19837
Publication date:
23/01/2020
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2020-7210
Publication date:
23/01/2020
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2020

CVE-2019-19835
Publication date:
23/01/2020
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2020

CVE-2020-5216
Publication date:
23/01/2020
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Severity CVSS v4.0: Pending analysis
Last modification:
18/02/2020

CVE-2020-5217
Publication date:
23/01/2020
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
Severity CVSS v4.0: Pending analysis
Last modification:
21/05/2020

CVE-2020-5223
Publication date:
23/01/2020
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2020

CVE-2019-20399
Publication date:
23/01/2020
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021
Subscribe to Vulnerabilities