Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18248

Publication date:

17/12/2018

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string.

Severity CVSS v4.0: Pending analysis

Last modification:

16/01/2020

CVE-2018-18249

Publication date:

17/12/2018

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER} parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet.

Severity CVSS v4.0: Pending analysis

Last modification:

16/01/2020

CVE-2018-18245

Publication date:

17/12/2018

Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2020

CVE-2018-18250

Publication date:

17/12/2018

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single &#39;$&#39; character as the Name of a Navigation item.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-20173

Publication date:

17/12/2018

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

Severity CVSS v4.0: Pending analysis

Last modification:

04/05/2021

CVE-2017-18354

Publication date:

17/12/2018

Rendertron 1.0.0 allows for alternative protocols such as &#39;file://&#39; introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2019

CVE-2017-18352

Publication date:

17/12/2018

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2019

CVE-2017-18355

Publication date:

17/12/2018

Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2019

CVE-2018-20170

Publication date:

17/12/2018

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor&#39;s position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2017-18353

Publication date:

17/12/2018

Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-20169

Publication date:

17/12/2018

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2024

CVE-2018-20168

Publication date:

17/12/2018

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2019

Subscribe to Vulnerabilities