Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-31160
Publication date:
14/06/2024
The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Stored Cross-site scripting attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
16/08/2024

CVE-2024-31161
Publication date:
14/06/2024
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system commands to be executed upon browsing the webpage.
Severity CVSS v4.0: Pending analysis
Last modification:
16/08/2024

CVE-2024-31159
Publication date:
14/06/2024
The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
16/08/2024

CVE-2024-27180
Publication date:
14/06/2024
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27179
Publication date:
14/06/2024
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27177
Publication date:
14/06/2024
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27178
Publication date:
14/06/2024
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27175
Publication date:
14/06/2024
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27176
Publication date:
14/06/2024
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27172
Publication date:
14/06/2024
Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27173
Publication date:
14/06/2024
Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024

CVE-2024-27174
Publication date:
14/06/2024
Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.<br /> https://www.toshibatec.com/contacts/products/ <br /> As for the affected products/models/versions, see the reference URL.
Severity CVSS v4.0: Pending analysis
Last modification:
04/07/2024
Subscribe to Vulnerabilities