Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-13308

Publication date:

26/11/2018

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2018

CVE-2018-13312

Publication date:

26/11/2018

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2018

CVE-2018-13322

Publication date:

26/11/2018

Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2018

CVE-2018-13319

Publication date:

26/11/2018

Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2018

CVE-2018-13320

Publication date:

26/11/2018

System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-14663

Publication date:

26/11/2018

An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the &#39;useClientSubnet&#39; or the experimental &#39;addXPF&#39; parameters are used when declaring a new backend.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-11067

Publication date:

26/11/2018

Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain an open redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.

Severity CVSS v4.0: Pending analysis

Last modification:

02/01/2019

CVE-2018-19568

Publication date:

26/11/2018

A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2018

CVE-2018-19567

Publication date:

26/11/2018

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2018

CVE-2018-19566

Publication date:

26/11/2018

A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2018

CVE-2018-19565

Publication date:

26/11/2018

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2018

CVE-2018-11077

Publication date:

26/11/2018

&#39;getlogs&#39; utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2018

Subscribe to Vulnerabilities