Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-25648
Publication date:
14/12/2023
<br /> There is a weak folder permission vulnerability in ZTE&amp;#39;s ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2023-25650
Publication date:
14/12/2023
<br /> There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2025

CVE-2023-44709
Publication date:
14/12/2023
PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg_load_from_memory.
Severity CVSS v4.0: Pending analysis
Last modification:
08/10/2024

CVE-2023-6407
Publication date:
14/12/2023
<br /> A CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&amp;#39;Path Traversal&amp;#39;)<br /> vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by<br /> a local and low-privileged attacker.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2023

CVE-2023-5630
Publication date:
14/12/2023
<br /> <br /> <br /> A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a<br /> privileged user to install an untrusted firmware.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
27/12/2023

CVE-2023-5629
Publication date:
14/12/2023
<br /> A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could<br /> cause disclosure of information through phishing attempts over HTTP.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
27/12/2023

CVE-2023-49937
Publication date:
14/12/2023
An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a denial of service or possibly execute arbitrary code. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
Severity CVSS v4.0: Pending analysis
Last modification:
03/01/2024

CVE-2023-49938
Publication date:
14/12/2023
An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7.
Severity CVSS v4.0: Pending analysis
Last modification:
03/01/2024

CVE-2023-49934
Publication date:
14/12/2023
An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed version is 23.11.1.
Severity CVSS v4.0: Pending analysis
Last modification:
03/01/2024

CVE-2023-49935
Publication date:
14/12/2023
An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.
Severity CVSS v4.0: Pending analysis
Last modification:
03/01/2024

CVE-2023-49936
Publication date:
14/12/2023
An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
Severity CVSS v4.0: Pending analysis
Last modification:
03/01/2024

CVE-2023-49933
Publication date:
14/12/2023
An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
Severity CVSS v4.0: Pending analysis
Last modification:
03/01/2024
Subscribe to Vulnerabilities