Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-45837

Publication date:
22/11/2024
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2024

CVE-2024-47142

Publication date:
22/11/2024
AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations.
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2024

CVE-2024-39290

Publication date:
22/11/2024
Insufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent unauthenticated attacker may obtain sensitive information such as a username and its password in the address book.
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2024

CVE-2024-31408

Publication date:
22/11/2024
OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command with root privileges by sending a specially crafted request.
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2024

CVE-2024-52056

Publication date:
21/11/2024
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to delete any directory on the file system if the target directory contains an XML definition file.
Severity CVSS v4.0: MEDIUM
Last modification:
21/11/2024

CVE-2024-52053

Publication date:
21/11/2024
Stored Cross-Site Scripting in the Manager component of Wowza Streaming Engine below 4.9.1 allows an unauthenticated attacker to inject client-side JavaScript into the web dashboard to automatically hijack admin accounts.
Severity CVSS v4.0: HIGH
Last modification:
21/11/2024

CVE-2024-52054

Publication date:
21/11/2024
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to create an XML definition file anywhere on the file system.
Severity CVSS v4.0: MEDIUM
Last modification:
21/11/2024

CVE-2024-52055

Publication date:
21/11/2024
Path Traversal in the Manager component of Wowza Streaming Engine below 4.9.1 allows an administrator user to read any file on the file system if the target directory contains an XML definition file.
Severity CVSS v4.0: HIGH
Last modification:
21/11/2024

CVE-2024-52052

Publication date:
21/11/2024
Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.
Severity CVSS v4.0: CRITICAL
Last modification:
26/02/2025

CVE-2024-52616

Publication date:
21/11/2024
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
Severity CVSS v4.0: Pending analysis
Last modification:
14/05/2025

CVE-2024-52615

Publication date:
21/11/2024
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2025

CVE-2024-51364

Publication date:
21/11/2024
An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2024