Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-33661

Publication date:

29/06/2023

Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

CVE-2023-34843

Publication date:

29/06/2023

Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

CVE-2023-36475

Publication date:

28/06/2023

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

CVE-2023-34736

Publication date:

28/06/2023

Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2023

CVE-2023-34647

Publication date:

28/06/2023

PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2023-36474

Publication date:

28/06/2023

Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user&#39;s browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.

Severity CVSS v4.0: Pending analysis

Last modification:

07/07/2023

CVE-2023-3357

Publication date:

28/06/2023

A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.

Severity CVSS v4.0: Pending analysis

Last modification:

10/03/2025

CVE-2023-3358

Publication date:

28/06/2023

A null pointer dereference was found in the Linux kernel&#39;s Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.

Severity CVSS v4.0: Pending analysis

Last modification:

10/03/2025

CVE-2023-3359

Publication date:

28/06/2023

An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2025

CVE-2023-3390

Publication date:

28/06/2023

A use-after-free vulnerability was found in the Linux kernel&#39;s netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.

Severity CVSS v4.0: Pending analysis

Last modification:

11/01/2024

CVE-2023-3243

Publication date:

28/06/2023

** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-3355

Publication date:

28/06/2023

A NULL pointer dereference flaw was found in the Linux kernel&#39;s drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

Subscribe to Vulnerabilities