Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-36243

Publication date:
30/05/2023
Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2.57 on arm.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2022-36244

Publication date:
30/05/2023
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2022-36246

Publication date:
30/05/2023
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2022-36247

Publication date:
30/05/2023
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2022-36249

Publication date:
30/05/2023
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2022-36250

Publication date:
30/05/2023
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF).
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2022-47029

Publication date:
30/05/2023
An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2025

CVE-2022-47028

Publication date:
30/05/2023
An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2025

CVE-2023-32696

Publication date:
30/05/2023
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
06/06/2023

CVE-2023-32699

Publication date:
30/05/2023
MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. ​The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-1711

Publication date:
30/05/2023
A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. <br /> If exploited an attacker could obtain confidential information.<br /> <br /> <br /> <br /> List of CPEs:<br /> * cpe:2.3:a:hitachienergy:foxman_un:R9C:*:*:*:*:*:*:*<br /> * cpe:2.3:a:hitachienergy:foxman_un:R10C:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R11A:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R11B:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R14A:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R14B:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R15A:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R15B:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy:foxman_un:R16A:*:*:*:*:*:*:*<br /> <br /> * <br /> * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*<br /> * cpe:2.3:a:hitachienergy: unem :R10C:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R11A:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R11B:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R14A:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R14B:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R15A:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R15B:*:*:*:*:*:*:*<br /> <br /> * cpe:2.3:a:hitachienergy: unem :R16A:*:*:*:*:*:*:*<br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
25/07/2024

CVE-2023-2994

Publication date:
30/05/2023
Rejected reason: This 2023 CVE was incorrectly assigned instead of a 2022 CVE.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023