Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18950
Publication date:
05/11/2018
KindEditor through 4.1.11 has a path traversal vulnerability in php/upload_json.php. Anyone can browse a file or directory in the kindeditor/attached/ folder via the path parameter without authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2018

CVE-2018-18943
Publication date:
05/11/2018
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2018

CVE-2018-18935
Publication date:
05/11/2018
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2018

CVE-2018-18936
Publication date:
05/11/2018
An issue was discovered in PopojiCMS v2.0.1. admin_library.php allows remote attackers to delete arbitrary files via directory traversal in the po-admin/route.php?mod=library&act=delete id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2018

CVE-2018-18934
Publication date:
05/11/2018
An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted and can be executed). This can also be exploited via CSRF.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2018

CVE-2018-18937
Publication date:
05/11/2018
An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSet_getValues in client/ied_connection.c.
Severity CVSS v4.0: Pending analysis
Last modification:
07/12/2018

CVE-2018-18952
Publication date:
05/11/2018
JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2018

CVE-2018-18939
Publication date:
05/11/2018
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field.
Severity CVSS v4.0: Pending analysis
Last modification:
15/11/2018

CVE-2018-18938
Publication date:
05/11/2018
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2025

CVE-2018-18942
Publication date:
05/11/2018
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2018-18949
Publication date:
05/11/2018
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2021

CVE-2018-18928
Publication date:
04/11/2018
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
Severity CVSS v4.0: Pending analysis
Last modification:
16/01/2019
Subscribe to Vulnerabilities