Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-47293

Publication date:

27/09/2024

Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2024-47294

Publication date:

27/09/2024

Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2024-47290

Publication date:

27/09/2024

Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2024-47291

Publication date:

27/09/2024

Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2024-9202

Publication date:

27/09/2024

In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering. This enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way. Affected code: DatasetResolverImpl, L76-79 https://github.com/eclipse-edc/Connector/blob/v0.9.0/core/control-plane/control-plane-catalog/src/main/java/org/eclipse/edc/connector/controlplane/catalog/DatasetResolverImpl.java

Severity CVSS v4.0: MEDIUM

Last modification:

09/01/2025

CVE-2024-6931

Publication date:

27/09/2024

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2024

CVE-2024-41930

Publication date:

27/09/2024

Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2024

CVE-2024-6654

Publication date:

27/09/2024

Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET security product and cause general system slow-down.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2024

CVE-2024-38861

Publication date:

27/09/2024

Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a.

Severity CVSS v4.0: MEDIUM

Last modification:

20/12/2024

CVE-2024-39435

Publication date:

27/09/2024

In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2024-39432

Publication date:

27/09/2024

In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2024-39433

Publication date:

27/09/2024

In drm service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

Subscribe to Vulnerabilities