Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-27706

Publication date:

09/06/2023

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-29713

Publication date:

09/06/2023

Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request after the /css/ directory.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-29714

Publication date:

09/06/2023

Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, password, and language cookies parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-2454

Publication date:

09/06/2023

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-2455

Publication date:

09/06/2023

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-34100

Publication date:

09/06/2023

Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS does not verify that certain buffer indices to read from are within the bounds of the IPv6 packet buffer, uip_buf. In particular, there is a 2-byte buffer read in the module os/net/ipv6/uip6.c. The buffer is indexed using &#39;UIP_IPTCPH_LEN + 2 + c&#39; and &#39;UIP_IPTCPH_LEN + 3 + c&#39;, but the uip_buf buffer may not have enough data, resulting in a 2-byte read out of bounds. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in release 4.9. Users are advised to watch for the 4.9 release and to upgrade when it becomes available. There are no workarounds for this vulnerability aside from manually patching with the diff in commit `cde4e9839`.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2023

CVE-2023-34245

Publication date:

09/06/2023

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. `@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `[&#39;http&#39;, &#39;https&#39;, &#39;mailto&#39;, &#39;tel&#39;]`. URLs using a scheme that isn&#39;t in this list will not be rendered to the DOM. Users are advised to upgrade. Users unable to upgrade are advised to override the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2023

CVE-2019-16283

Publication date:

09/06/2023

A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-29712

Publication date:

09/06/2023

Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the X-Rewrite-URL parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-30262

Publication date:

09/06/2023

An issue found in MIM software Inc MIM License Server and MIMpacs services v.6.9 thru v.7.0 fixed in v.7.0.10 allows a remote unauthenticated attacker to execute arbitrary code via the RMI Registry service.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-33557

Publication date:

09/06/2023

Fuel CMS v1.5.2 was discovered to contain a SQL injection vulnerability via the id parameter at /controllers/Blocks.php.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2025

CVE-2023-2121

Publication date:

09/06/2023

Vault and Vault Enterprise&#39;s (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2023

Subscribe to Vulnerabilities