Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-9809

Publication date:

26/04/2019

If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service (DOS) attack. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2019

CVE-2019-9808

Publication date:

26/04/2019

If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2019

CVE-2019-9807

Publication date:

26/04/2019

When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this text as the content. This could potentially be used for social engineering attacks. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2019

CVE-2019-9805

Publication date:

26/04/2019

A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

08/02/2024

CVE-2019-9802

Publication date:

26/04/2019

If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process, which may include sensitive data. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-9797

Publication date:

26/04/2019

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2019

CVE-2019-9801

Publication date:

26/04/2019

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2019

CVE-2019-9795

Publication date:

26/04/2019

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-9798

Publication date:

26/04/2019

On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party applications to execute a man-in-the-middle attack if a malicious code was written to that location and loaded. *Note: This issue only affects Android. Other operating systems are unaffected.*. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2019-9799

Publication date:

26/04/2019

Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent process under certain conditions. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2019-9794

Publication date:

26/04/2019

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2019-9796

Publication date:

26/04/2019

A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver&#39;s observer array. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

Subscribe to Vulnerabilities