Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-9177

Publication date:

08/06/2018

Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2018

CVE-2018-9182

Publication date:

08/06/2018

Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.

Severity CVSS v4.0: Pending analysis

Last modification:

31/07/2018

CVE-2018-9246

Publication date:

08/06/2018

The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2018

CVE-2018-12047

Publication date:

08/06/2018

xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by n equal to 0 through 12.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2018

CVE-2018-12048

Publication date:

08/06/2018

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2018-12041

Publication date:

08/06/2018

An issue was discovered on the MediaTek AWUS036NH wireless USB adapter through 5.1.25.0. Attackers can remotely deny service by sending specially constructed 802.11 frames.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2018

CVE-2018-12045

Publication date:

08/06/2018

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2018

CVE-2018-12046

Publication date:

08/06/2018

DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file.

Severity CVSS v4.0: Pending analysis

Last modification:

27/07/2018

CVE-2018-12049

Publication date:

08/06/2018

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2018-11229

Publication date:

08/06/2018

Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2019

CVE-2018-11228

Publication date:

08/06/2018

Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2019

CVE-2011-0467

Publication date:

07/06/2018

A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

Subscribe to Vulnerabilities