Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2016-6559

Publication date:

13/07/2018

Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by FreeBSD developers, it is very unlikely that applications exist that utilize link_ntoa() in an exploitable manner, and the CERT/CC is not aware of any proof of concept. A blog post describes the functionality of link_ntoa() and points out that none of the base utilities use this function in an exploitable manner. For more information, please see FreeBSD Security Advisory SA-16:37.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2016-6562

Publication date:

13/07/2018

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-10631

Publication date:

13/07/2018

The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection mechanisms, this malicious code will be run when the card is inserted into an 8840 Clinician Programmer.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2025

CVE-2018-8847

Publication date:

13/07/2018

Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2020

CVE-2018-1000208

Publication date:

13/07/2018

MODX Revolution version

Severity CVSS v4.0: Pending analysis

Last modification:

07/09/2018

CVE-2018-1000206

Publication date:

13/07/2018

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable via The victim must run maliciously crafted flash component. This vulnerability appears to have been fixed in 6.1.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2019

CVE-2018-1000207

Publication date:

13/07/2018

MODX Revolution version

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-1000209

Publication date:

13/07/2018

Sensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions vulnerability in Sensu Core on Windows platforms that can result in Unprivileged users may execute code in context of Sensu service account. This attack appear to be exploitable via Unprivileged user may place an arbitrary DLL in the c:\opt\sensu\embedded\bin directory in order to exploit standard Windows DLL load order behavior. This vulnerability appears to have been fixed in 1.4.2-3 and later.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-1000211

Publication date:

13/07/2018

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API&#39;s authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-1000210

Publication date:

13/07/2018

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-10098

Publication date:

13/07/2018

In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to send a 0x830020E0 IOCTL request to \\.\econceal to cause a denial of service (BSOD).

Severity CVSS v4.0: Pending analysis

Last modification:

10/09/2018