Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-14364

Publication date:

18/07/2018

GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component.

Severity CVSS v4.0: Pending analysis

Last modification:

15/09/2018

CVE-2018-7546

Publication date:

18/07/2018

wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1.0.6621 allows remote attackers to cause a denial of service via a crafted pdf file.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2018

CVE-2018-14082

Publication date:

18/07/2018

PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2018

CVE-2018-12429

Publication date:

18/07/2018

JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2018

CVE-2018-14382

Publication date:

18/07/2018

InstantCMS 2.10.1 has /redirect?url= XSS.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2018

CVE-2018-14380

Publication date:

18/07/2018

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2018

CVE-2018-14381

Publication date:

18/07/2018

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2018

CVE-2018-8042

Publication date:

18/07/2018

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-10616

Publication date:

18/07/2018

ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-10877

Publication date:

18/07/2018

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2023

CVE-2017-18103

Publication date:

18/07/2018

The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a content-type of application/mathml+xml.

Severity CVSS v4.0: Pending analysis

Last modification:

14/09/2018

CVE-2018-5232

Publication date:

18/07/2018

The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2022

Subscribe to Vulnerabilities