Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2004-2720

Publication date:

31/12/2004

Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via javascript events in the Email parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2721

Publication date:

31/12/2004

The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows remote attackers to determine the private key and decrypt messages.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2722

Publication date:

31/12/2004

Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has disputed this issue

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2723

Publication date:

31/12/2004

NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2724

Publication date:

31/12/2004

LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a username beginning with percent (%) followed by a null character.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2725

Publication date:

31/12/2004

Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in (a) search.php, (2) the email parameter in (b) subscribe.php, and (3) the return and (4) title parameters in (c) forum_2.php.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2727

Publication date:

31/12/2004

Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (application crash) via a long HTTP GET request.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2728

Publication date:

31/12/2004

Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (application crash) via a long argument to the XCWD command.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2729

Publication date:

31/12/2004

Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for handling incoming connections.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2730

Publication date:

31/12/2004

Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03, (5) PsList before 1.26, (6) PsLoglist before 2.51, (7) PsPasswd before 1.21, (8) PsService before 2.12, (9) PsSuspend before 1.05, and (10) PsShutdown before 2.32, does not properly disconnect from remote IPC$ and ADMIN$ shares, which allows local users to access the shares with elevated privileges by using the existing share mapping.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2732

Publication date:

31/12/2004

nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to determine the access key.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2004-2733

Publication date:

31/12/2004

Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topics via pop_up_topic_admin.asp.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities