Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2016-9063

Publication date:

11/06/2018

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

27/06/2022

CVE-2016-5290

Publication date:

11/06/2018

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2016-5291

Publication date:

11/06/2018

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2016-5293

Publication date:

11/06/2018

When the Mozilla Updater is run, if the Updater&#39;s log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2016-5294

Publication date:

11/06/2018

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2016-5296

Publication date:

11/06/2018

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2016-5297

Publication date:

11/06/2018

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2018-6514

Publication date:

11/06/2018

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2018

CVE-2018-6515

Publication date:

11/06/2018

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2018

CVE-2018-6512

Publication date:

11/06/2018

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2018

CVE-2018-6513

Publication date:

11/06/2018

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2022

CVE-2017-3208

Publication date:

11/06/2018

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages. If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2018

Subscribe to Vulnerabilities