Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-6574

Publication date:

07/02/2018

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-6824

Publication date:

07/02/2018

Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI, as demonstrated by an XMLHttpRequest call with an &#39;email:"attacker@example.com"&#39; request, which can be followed by a password reset.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2018

CVE-2017-1692

Publication date:

07/02/2018

IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM X-Force ID: 134067.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2018

CVE-2017-1785

Publication date:

07/02/2018

IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2018

CVE-2018-1382

Publication date:

07/02/2018

IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138079.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2018

CVE-2017-12472

Publication date:

07/02/2018

ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging missing NULL pointer checks after ccnl_malloc.

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2018

CVE-2017-12473

Publication date:

07/02/2018

ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving packets with "wrong L values."

Severity CVSS v4.0: Pending analysis

Last modification:

22/02/2018

CVE-2017-17552

Publication date:

07/02/2018

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2025

CVE-2018-1366

Publication date:

07/02/2018

IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection. An attacker could exploit this vulnerability to exploit other vulnerabilities in spreadsheet software. IBM X-Force ID: 137452.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-1388

Publication date:

07/02/2018

GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. IBM X-Force ID: 138212.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2018

CVE-2016-6168

Publication date:

07/02/2018

Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a crafted PDF file.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2018

CVE-2016-6169

Publication date:

07/02/2018

Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (memory corruption and application crash) or potentially execute arbitrary code via the Bezier data in a crafted PDF file.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2018

Subscribe to Vulnerabilities