Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18191

Publication date:

09/10/2018

Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator&#39;s password.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2018

CVE-2018-18088

Publication date:

09/10/2018

OpenJPEG 2.3.0 has a NULL pointer dereference for "red" in the imagetopnm function of jp2/convert.c

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2019

CVE-2018-18083

Publication date:

09/10/2018

An issue was discovered in DuomiCMS 3.0. Remote PHP code execution is possible via the search.php searchword parameter because "eval" is used during "if" processing.

Severity CVSS v4.0: Pending analysis

Last modification:

29/11/2018

CVE-2018-18082

Publication date:

09/10/2018

XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI.

Severity CVSS v4.0: Pending analysis

Last modification:

23/11/2018

CVE-2018-18084

Publication date:

09/10/2018

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2020

CVE-2018-18075

Publication date:

09/10/2018

WikidForum 2.20 has SQL Injection via the rpc.php parent_post_id or num_records parameter, or the index.php?action=search select_sort parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2018

CVE-2018-15543

Publication date:

09/10/2018

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2018-15542

Publication date:

09/10/2018

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method&#39;s return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2018-18029

Publication date:

09/10/2018

Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.

Severity CVSS v4.0: Pending analysis

Last modification:

23/11/2018

CVE-2018-18074

Publication date:

09/10/2018

The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2022

CVE-2018-14649

Publication date:

09/10/2018

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2023

CVE-2018-14080

Publication date:

09/10/2018

An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to download the configuration file.

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2023

Subscribe to Vulnerabilities