Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2015-9256
Publication date:
20/02/2018
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2018

CVE-2015-9254
Publication date:
20/02/2018
Datto ALTO and SIRIS devices have a default VNC password.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2018

CVE-2015-2081
Publication date:
20/02/2018
Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2018

CVE-2017-18192
Publication date:
20/02/2018
smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attackers to access files via the backdoor 17621762 PIN.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2018

CVE-2017-16835
Publication date:
20/02/2018
The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensitive cleartext information via an "adb backup '-f smart.calculator.gallerylock'" command.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2019

CVE-2018-7259
Publication date:
20/02/2018
The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the network for cleartext HTTP traffic. This behavior was removed in 2.0.1.232.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2018-7253
Publication date:
19/02/2018
The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2019

CVE-2018-7254
Publication date:
19/02/2018
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2019

CVE-2018-7251
Publication date:
19/02/2018
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
Severity CVSS v4.0: Pending analysis
Last modification:
03/10/2019

CVE-2016-10008
Publication date:
19/02/2018
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
05/03/2018

CVE-2016-10007
Publication date:
19/02/2018
SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
05/03/2018

CVE-2018-5763
Publication date:
19/02/2018
An issue was discovered in OXID eShop Enterprise Edition before 5.3.7 and 6.x before 6.0.1. By entering specially crafted URLs, an attacker is able to bring the shop server to a standstill and hence, it stops working. This is only valid if OXID High Performance Option is activated and Varnish is used.
Severity CVSS v4.0: Pending analysis
Last modification:
20/03/2018
Subscribe to Vulnerabilities