Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-11578

Publication date:

31/05/2018

GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.

Severity CVSS v4.0: Pending analysis

Last modification:

13/07/2018

CVE-2018-11577

Publication date:

31/05/2018

Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-11575

Publication date:

31/05/2018

ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-11567

Publication date:

30/05/2018

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device&#39;s hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2024

CVE-2018-11568

Publication date:

30/05/2018

Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some (but not all) cases, the &#39;&#39; characters have &lt; and &gt; representations.

Severity CVSS v4.0: Pending analysis

Last modification:

13/07/2018

CVE-2018-11565

Publication date:

30/05/2018

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2018

CVE-2018-11476

Publication date:

30/05/2018

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-11478

Publication date:

30/05/2018

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car (different for every vendor / car product line / car). No authentication is needed, which allows attacks from the local Wi-Fi network.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-7534

Publication date:

30/05/2018

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-11482

Publication date:

30/05/2018

/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-11481

Publication date:

30/05/2018

TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.

Severity CVSS v4.0: Pending analysis

Last modification:

05/07/2018

CVE-2018-11477

Publication date:

30/05/2018

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the public.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

Subscribe to Vulnerabilities