Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2002-1647

Publication date:

31/12/2002

The quick login feature in Slash Slashcode does not redirect the user to an alternate URL when the wrong password is provided, which makes it easier for remote web sites to guess the proper passwords by reading the username and password from the Referrer URL.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1664

Publication date:

31/12/2002

Yahoo! Messenger before February 2002 allows remote attackers to add arbitrary users to another user&#39;s buddy list and possibly obtain sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1665

Publication date:

31/12/2002

Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long set_buddygrp field.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1822

Publication date:

31/12/2002

IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page (JSP).

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1830

Publication date:

31/12/2002

Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to bypass authentication and access modifier options via a direct request to moderator.php with the action and ismod parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1841

Publication date:

31/12/2002

The document management module in NOLA 1.1.1 and 1.1.2 does not restrict the types of files that are uploaded, which allows remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1850

Publication date:

31/12/2002

mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-1867

Publication date:

31/12/2002

The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi, which allows remote attackers to create an administrative account, or (2) admin/nph-build.cgi, which allows remote attackers to cause a denial of service (CPU consumption).

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-2039

Publication date:

31/12/2002

/bin/su in QNX realtime operating system (RTOS) 4.25 and 6.1.0 allows local users to obtain sensitive information from core dump files by sending the SIGSERV (invalid memory reference) signal.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-2048

Publication date:

31/12/2002

Buffer overflow in PFinger 0.7.8 client allows remote attackers to execute arbitrary code via a long query value passed to the (1) finger program, (2) -l, (3) -d, and (4) -t options. NOTE: if PFinger is not setuid or setgid, then this issue would not cross privilege boundaries and would not be considered a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-2054

Publication date:

31/12/2002

TeeKai Forum 1.2 allows remote attackers to authenticate as the administrator and and gain privileged web forum access by setting the valid_level cookie to admin.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

CVE-2002-2055

Publication date:

31/12/2002

Cross-site scripting (XSS) vulnerability in userlog.php in TeeKai Tracking Online 1.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/04/2025

Subscribe to Vulnerabilities