Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-15326
Publication date:
23/03/2018
DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker can exploit this vulnerability to crack the encrypted data and cause information leakage.
Severity CVSS v4.0: Pending analysis
Last modification:
19/04/2018

CVE-2017-17736
Publication date:
23/03/2018
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2019

CVE-2018-1211
Publication date:
23/03/2018
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain specific sensitive data without authentication. A remote unauthenticated attacker may be able to read configuration settings from the iDRAC by querying specific URI strings.
Severity CVSS v4.0: Pending analysis
Last modification:
19/04/2018

CVE-2018-1207
Publication date:
23/03/2018
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2018-8944
Publication date:
22/03/2018
PHPOK 4.8.338 has an arbitrary file upload vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
20/04/2018

CVE-2018-8903
Publication date:
22/03/2018
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2018

CVE-2018-8942
Publication date:
22/03/2018
Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2018

CVE-2017-18242
Publication date:
22/03/2018
The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2018

CVE-2017-18243
Publication date:
22/03/2018
The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault) via a crafted file.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2018

CVE-2017-18244
Publication date:
22/03/2018
The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac file, related to ff_ps_apply.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2018

CVE-2018-8943
Publication date:
22/03/2018
There is a SQL injection in the PHPSHE 1.6 userbank parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
18/04/2018

CVE-2018-8945
Publication date:
22/03/2018
The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.
Severity CVSS v4.0: Pending analysis
Last modification:
31/10/2019
Subscribe to Vulnerabilities