Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-38736

Publication date:

08/09/2023

IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions. IBM X-Force ID: 262542.

Severity CVSS v4.0: Pending analysis

Last modification:

13/09/2023

CVE-2023-41338

Publication date:

08/09/2023

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-28010

Publication date:

08/09/2023

In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2023-39712

Publication date:

08/09/2023

Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name, Address, and Company parameters under the Add New Put section.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-4782

Publication date:

08/09/2023

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-4843

Publication date:

08/09/2023

Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

CVE-2023-39321

Publication date:

08/09/2023

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2023-39322

Publication date:

08/09/2023

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39320

Publication date:

08/09/2023

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39319

Publication date:

08/09/2023

The html/template package does not apply the proper rules for handling occurrences of "

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39318

Publication date:

08/09/2023

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2023

CVE-2023-39676

Publication date:

08/09/2023

FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2023

Subscribe to Vulnerabilities