Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-17068

Publication date:

15/09/2018

An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2023

CVE-2018-17061

Publication date:

15/09/2018

BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google, Bing, and Yahoo! pages via domains indexed in search results.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-16287

Publication date:

14/09/2018

LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2018

CVE-2018-16288

Publication date:

14/09/2018

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2018

CVE-2018-16706

Publication date:

14/09/2018

LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-10763

Publication date:

14/09/2018

Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.

Severity CVSS v4.0: Pending analysis

Last modification:

09/11/2018

CVE-2018-16286

Publication date:

14/09/2018

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2018

CVE-2018-12585

Publication date:

14/09/2018

An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

27/11/2018

CVE-2018-10814

Publication date:

14/09/2018

Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-16242

Publication date:

14/09/2018

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2017-16639

Publication date:

14/09/2018

Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a different vulnerability than CVE-2017-16541. User interaction is required to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

26/11/2018