Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-10888
Publication date:
10/07/2018
A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-1128
Publication date:
10/07/2018
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
Severity CVSS v4.0: Pending analysis
Last modification:
17/11/2020

CVE-2018-13388
Publication date:
10/07/2018
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2018

CVE-2018-13389
Publication date:
10/07/2018
The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml.
Severity CVSS v4.0: Pending analysis
Last modification:
07/09/2018

CVE-2018-1337
Publication date:
10/07/2018
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-13797
Publication date:
10/07/2018
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2019

CVE-2018-12230
Publication date:
10/07/2018
An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 token, allows the attacker to steal tokens or conduct resultant integer underflow attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2018

CVE-2016-10726
Publication date:
10/07/2018
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
Severity CVSS v4.0: Pending analysis
Last modification:
06/09/2018

CVE-2018-13795
Publication date:
09/07/2018
Gravity before 0.5.1 does not support a maximum recursion depth.
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2018

CVE-2018-13793
Publication date:
09/07/2018
Multiple Cross Site Request Forgery (CSRF) vulnerabilities in the HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 exist in Web Verification, Web Scanning, Web Capture, Monitoring and Administration, and Login.
Severity CVSS v4.0: Pending analysis
Last modification:
07/09/2018

CVE-2018-13791
Publication date:
09/07/2018
The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct Access Control attacks via the /FlexiCapture12/Login/Server/SevaUserProfile FlexiCaptureTmsSts2 parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2019

CVE-2018-13794
Publication date:
09/07/2018
A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.
Severity CVSS v4.0: Pending analysis
Last modification:
14/09/2020
Subscribe to Vulnerabilities