Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2000-0129

Publication date:
04/02/2000
Buffer overflow in the SHGetPathFromIDList function of the Serv-U FTP server allows attackers to cause a denial of service by performing a LIST command on a malformed .lnk file.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0122

Publication date:
03/02/2000
Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0124

Publication date:
03/02/2000
surfCONTROL SuperScout does not properly asign a category to web sites with a . (dot) at the end, which may allow users to bypass web access restrictions.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0125

Publication date:
03/02/2000
wwwthreads does not properly cleanse numeric data or table names that are passed to SQL queries, which allows remote attackers to gain privileges for wwwthreads forums.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0127

Publication date:
03/02/2000
The Webspeed configuration program does not properly disable access to the WSMadmin utility, which allows remote attackers to gain privileges via wsisa.dll.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0218

Publication date:
03/02/2000
Buffer overflow in Linux mount and umount allows local users to gain root privileges via a long relative pathname.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0112

Publication date:
02/02/2000
The default installation of Debian GNU/Linux uses an insecure Master Boot Record (MBR) which allows a local user to boot from a floppy disk during the installation.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0114

Publication date:
02/02/2000
Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /_vti_bin/ virtual directory.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0469

Publication date:
02/02/2000
Selena Sol WebBanner 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-1205

Publication date:
01/02/2000
Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0101

Publication date:
01/02/2000
The Make-a-Store OrderPage shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2000-0102

Publication date:
01/02/2000
The SalesCart shopping cart application allows remote users to modify sensitive purchase information via hidden form fields.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026