Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-34014

Publication date:

11/11/2024

Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.6.599, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.2.181.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2025

CVE-2024-34015

Publication date:

11/11/2024

Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2025

CVE-2024-43430

Publication date:

11/11/2024

A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2024-43432

Publication date:

11/11/2024

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2024-43433

Publication date:

11/11/2024

A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2024-43435

Publication date:

11/11/2024

A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2024-43437

Publication date:

11/11/2024

A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2024-43427

Publication date:

11/11/2024

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2024-43429

Publication date:

11/11/2024

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2024-11067

Publication date:

11/11/2024

The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device&#39;s default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password.

Severity CVSS v4.0: Pending analysis

Last modification:

15/11/2024

CVE-2024-11068

Publication date:

11/11/2024

The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user’s account.

Severity CVSS v4.0: Pending analysis

Last modification:

15/11/2024

CVE-2024-11065

Publication date:

11/11/2024

The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet.

Severity CVSS v4.0: Pending analysis

Last modification:

15/11/2024

Subscribe to Vulnerabilities