Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-31847
Publication date:
21/05/2024
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization.
Severity CVSS v4.0: Pending analysis
Last modification:
13/03/2025

CVE-2024-36039
Publication date:
21/05/2024
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2024

CVE-2024-27128
Publication date:
21/05/2024
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network.<br /> <br /> We have already fixed the vulnerability in the following version:<br /> QTS 5.1.7.2770 build 20240520 and later<br /> QuTS hero h5.1.7.2770 build 20240520 and later
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2024

CVE-2024-27129
Publication date:
21/05/2024
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network.<br /> <br /> We have already fixed the vulnerability in the following version:<br /> QTS 5.1.7.2770 build 20240520 and later<br /> QuTS hero h5.1.7.2770 build 20240520 and later
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2024

CVE-2024-27130
Publication date:
21/05/2024
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network.<br /> <br /> We have already fixed the vulnerability in the following version:<br /> QTS 5.1.7.2770 build 20240520 and later<br /> QuTS hero h5.1.7.2770 build 20240520 and later
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2024

CVE-2024-31840
Publication date:
21/05/2024
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edit the configuration of the email server. Once the user access the edit function, the web application fills the edit form with the current credentials for the email account, including the cleartext password.
Severity CVSS v4.0: Pending analysis
Last modification:
14/03/2025

CVE-2023-52873
Publication date:
21/05/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data<br /> <br /> Add the check for the return value of mtk_alloc_clk_data() in order to<br /> avoid NULL pointer dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2025

CVE-2023-52874
Publication date:
21/05/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro<br /> <br /> In the TDX_HYPERCALL asm, after the TDCALL instruction returns from the<br /> untrusted VMM, the registers that the TDX guest shares to the VMM need<br /> to be cleared to avoid speculative execution of VMM-provided values.<br /> <br /> RSI is specified in the bitmap of those registers, but it is missing<br /> when zeroing out those registers in the current TDX_HYPERCALL.<br /> <br /> It was there when it was originally added in commit 752d13305c78<br /> ("x86/tdx: Expand __tdx_hypercall() to handle more arguments"), but was<br /> later removed in commit 1e70c680375a ("x86/tdx: Do not corrupt<br /> frame-pointer in __tdx_hypercall()"), which was correct because %rsi is<br /> later restored in the "pop %rsi". However a later commit 7a3a401874be<br /> ("x86/tdx: Drop flags from __tdx_hypercall()") removed that "pop %rsi"<br /> but forgot to add the "xor %rsi, %rsi" back.<br /> <br /> Fix by adding it back.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2025

CVE-2023-52875
Publication date:
21/05/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data<br /> <br /> Add the check for the return value of mtk_alloc_clk_data() in order to<br /> avoid NULL pointer dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2025

CVE-2023-52876
Publication date:
21/05/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data<br /> <br /> Add the check for the return value of mtk_alloc_clk_data() in order to<br /> avoid NULL pointer dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2025

CVE-2023-52877
Publication date:
21/05/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()<br /> <br /> It is possible that typec_register_partner() returns ERR_PTR on failure.<br /> When port-&gt;partner is an error, a NULL pointer dereference may occur as<br /> shown below.<br /> <br /> [91222.095236][ T319] typec port0: failed to register partner (-17)<br /> ...<br /> [91225.061491][ T319] Unable to handle kernel NULL pointer dereference<br /> at virtual address 000000000000039f<br /> [91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc<br /> [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc<br /> [91225.308067][ T319] Call trace:<br /> [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc<br /> [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8<br /> [91225.355900][ T319] kthread_worker_fn+0x178/0x58c<br /> [91225.355902][ T319] kthread+0x150/0x200<br /> [91225.355905][ T319] ret_from_fork+0x10/0x30<br /> <br /> Add a check for port-&gt;partner to avoid dereferencing a NULL pointer.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2025

CVE-2023-52878
Publication date:
21/05/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: dev: can_put_echo_skb(): don&amp;#39;t crash kernel if can_priv::echo_skb is accessed out of bounds<br /> <br /> If the "struct can_priv::echoo_skb" is accessed out of bounds, this<br /> would cause a kernel crash. Instead, issue a meaningful warning<br /> message and return with an error.
Severity CVSS v4.0: Pending analysis
Last modification:
21/05/2024
Subscribe to Vulnerabilities