Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-28329
Publication date:
23/03/2023
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2024

CVE-2023-28330
Publication date:
23/03/2023
Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2024

CVE-2022-3146
Publication date:
23/03/2023
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-24788
Publication date:
23/03/2023
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.
Severity CVSS v4.0: Pending analysis
Last modification:
11/05/2023

CVE-2023-1249
Publication date:
23/03/2023
A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2025

CVE-2023-0056
Publication date:
23/03/2023
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-1513
Publication date:
23/03/2023
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-20861
Publication date:
23/03/2023
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2023-1252
Publication date:
23/03/2023
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.
Severity CVSS v4.0: Pending analysis
Last modification:
23/04/2025

CVE-2022-3101
Publication date:
23/03/2023
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-25655
Publication date:
23/03/2023
baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2023

CVE-2023-26361
Publication date:
23/03/2023
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2023
Subscribe to Vulnerabilities