Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2003-0470

Publication date:
07/08/2003
Buffer overflow in the "RuFSI Utility Class" ActiveX control (aka "RuFSI Registry Information Class"), as used for the Symantec Security Check service, allows remote attackers to execute arbitrary code via a long argument to CompareVersionStrings.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0472

Publication date:
07/08/2003
The IPv6 capability in IRIX 6.5.19 allows remote attackers to cause a denial of service (hang) in inetd via port scanning.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0473

Publication date:
07/08/2003
Unknown vulnerability in the IPv6 capability in IRIX 6.5.19 causes snoop to process packets as the root user, with unknown implications.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0486

Publication date:
07/08/2003
SQL injection vulnerability in viewtopic.php for phpBB 2.0.5 and earlier allows remote attackers to steal password hashes via the topic_id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0487

Publication date:
07/08/2003
Multiple buffer overflows in Kerio MailServer 5.6.3 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a long showuser parameter in the do_subscribe module, (2) a long folder parameter in the add_acl module, (3) a long folder parameter in the list module, and (4) a long user parameter in the do_map module.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0488

Publication date:
07/08/2003
Multiple cross-site scripting (XSS) vulnerabilities in Kerio MailServer 5.6.3 allow remote attackers to insert arbitrary web script via (1) the add_name parameter in the add_acl module, or (2) the alias parameter in the do_map module.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0492

Publication date:
07/08/2003
Cross-site scripting (XSS) vulnerability in search.asp for Snitz Forums 3.4.03 and earlier allows remote attackers to execute arbitrary web script via the Search parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0494

Publication date:
07/08/2003
password.asp in Snitz Forums 3.4.03 and earlier allows remote attackers to reset passwords and gain privileges as other users by via a direct request to password.asp with a modified member id.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0495

Publication date:
07/08/2003
Cross-site scripting (XSS) vulnerability in LedNews 0.7 allows remote attackers to insert arbitrary web script via a news item.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0509

Publication date:
07/08/2003
SQL injection vulnerability in Cyberstrong eShop 4.2 and earlier allows remote attackers to steal authentication information and gain privileges via the ProductCode parameter in (1) 10expand.asp, (2) 10browse.asp, and (3) 20review.asp.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0499

Publication date:
07/08/2003
Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, which allows local users to perform unauthorized database operations.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2003-0450

Publication date:
07/08/2003
Cistron RADIUS daemon (radiusd-cistron) 1.6.6 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large value in an NAS-Port attribute, which is interpreted as a negative number and causes a buffer overflow.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025