Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-6249

Publication date:

02/04/2018

NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

31/05/2018

CVE-2018-6252

Publication date:

02/04/2018

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software allows an actor access to restricted functionality that is unnecessary to production usage, and which may result in denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-6253

Publication date:

02/04/2018

NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted pixel shader can cause infinite recursion leading to denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-9183

Publication date:

02/04/2018

The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2018

CVE-2018-0194

Publication date:

02/04/2018

Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute commands with root privileges on the device. The vulnerabilities exist because the affected software does not sufficiently sanitize command arguments before passing commands to the Linux shell for execution. An attacker could exploit these vulnerabilities by submitting a malicious CLI command to the affected software. A successful exploit could allow the attacker to break from the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell on an affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCuz03145, CSCuz56419, CSCva31971, CSCvb09542.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-1038

Publication date:

02/04/2018

The Windows kernel in Windows 7 SP1 and Windows Server 2008 R2 SP1 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability."

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-6660

Publication date:

02/04/2018

Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-6661

Publication date:

02/04/2018

DLL Side-Loading vulnerability in Microsoft Windows Client in McAfee True Key before 4.20.110 allows local users to gain privilege elevation via not verifying a particular DLL file signature.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-9163

Publication date:

02/04/2018

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2019

CVE-2018-9174

Publication date:

02/04/2018

sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker&#39;s control.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2018

CVE-2018-9175

Publication date:

02/04/2018

DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2018

CVE-2018-9173

Publication date:

02/04/2018

Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2018

Subscribe to Vulnerabilities