Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-3103
Publication date:
22/11/2023
Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a denial-of-service (DOS) condition.
Severity CVSS v4.0: Pending analysis
Last modification:
02/08/2024

CVE-2023-3104
Publication date:
22/11/2023
Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
02/08/2024

CVE-2023-5047
Publication date:
22/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection.This issue affects DRDrive: before 20231006.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
30/11/2023

CVE-2023-5983
Publication date:
22/11/2023
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data.This issue affects Pharmacy Automation: before 2.1.133.0.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2024

CVE-2023-6253
Publication date:
22/11/2023
A saved encryption key in the Uninstaller in Digital Guardian&amp;#39;s Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file.
Severity CVSS v4.0: Pending analysis
Last modification:
13/02/2025

CVE-2023-6117
Publication date:
22/11/2023
A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server<br /> <br /> before 23.11.13156.0 which allows attackers to execute DoS attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2024

CVE-2023-6189
Publication date:
22/11/2023
Missing access permissions checks<br /> <br /> in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export<br /> <br /> jobs using the M-Files API methods.
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2024

CVE-2023-46673
Publication date:
22/11/2023
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
30/11/2023

CVE-2023-37924
Publication date:
22/11/2023
Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.<br /> Now we have fixed this issue and now user must have the correct login to access workbench.<br /> This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins.<br /> If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054 and rebuild the submarine-server image to fix this.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
30/11/2023

CVE-2023-5921
Publication date:
22/11/2023
Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.This issue affects Geodi: before 8.0.0.27396.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/12/2023

CVE-2023-6011
Publication date:
22/11/2023
Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in DECE Software Geodi allows Stored XSS.This issue affects Geodi: before 8.0.0.27396.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
30/11/2023

CVE-2023-2446
Publication date:
22/11/2023
The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the &amp;#39;userpro&amp;#39; shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
Severity CVSS v4.0: Pending analysis
Last modification:
30/11/2023
Subscribe to Vulnerabilities