Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18536

Publication date:

26/12/2018

The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-17987

Publication date:

26/12/2018

The determineWinner function of a smart contract implementation for HashHeroes Tiles, an Ethereum game, uses a certain blockhash value in an attempt to generate a random number for the case where NUM_TILES equals the number of people who purchased a tile, which allows an attacker to control the awarding of the prize by being the last person to purchase a tile.

Severity CVSS v4.0: Pending analysis

Last modification:

14/02/2019

CVE-2018-15518

Publication date:

26/12/2018

QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2020

CVE-2018-11741

Publication date:

26/12/2018

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId=#####&GOTO(8) URIs.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2021

CVE-2018-11742

Publication date:

26/12/2018

NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2021

CVE-2018-20486

Publication date:

26/12/2018

MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2019

CVE-2018-20484

Publication date:

26/12/2018

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2019

CVE-2018-20485

Publication date:

26/12/2018

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2019

CVE-2018-20483

Publication date:

26/12/2018

set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file&#39;s origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-20482

Publication date:

26/12/2018

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user&#39;s process (e.g., a system backup running as root).

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2021

CVE-2018-0724

Publication date:

26/12/2018

Cross-site scripting (XSS) vulnerability in Q&#39;center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723.

Severity CVSS v4.0: Pending analysis

Last modification:

08/01/2019

CVE-2018-0723

Publication date:

26/12/2018

Severity CVSS v4.0: Pending analysis

Last modification:

08/01/2019

Subscribe to Vulnerabilities