Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-6253

Publication date:

22/11/2023

A saved encryption key in the Uninstaller in Digital Guardian&#39;s Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-6117

Publication date:

22/11/2023

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2024

CVE-2023-6189

Publication date:

22/11/2023

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2024

CVE-2023-46673

Publication date:

22/11/2023

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2023-37924

Publication date:

22/11/2023

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins. If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054 and rebuild the submarine-server image to fix this.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2023-5921

Publication date:

22/11/2023

Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.This issue affects Geodi: before 8.0.0.27396.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-6011

Publication date:

22/11/2023

Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in DECE Software Geodi allows Stored XSS.This issue affects Geodi: before 8.0.0.27396.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2023-2446

Publication date:

22/11/2023

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the &#39;userpro&#39; shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2023-2447

Publication date:

22/11/2023

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the &#39;export_users&#39; function. This makes it possible for unauthenticated attackers to export the users to a csv file, granted they can trick a site administrator into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2023-41146

Publication date:

22/11/2023

Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.

Severity CVSS v4.0: Pending analysis

Last modification:

29/11/2023

CVE-2023-47016

Publication date:

22/11/2023

radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.

Severity CVSS v4.0: Pending analysis

Last modification:

11/10/2024

CVE-2023-47392

Publication date:

22/11/2023

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request.

Severity CVSS v4.0: Pending analysis

Last modification:

29/08/2024

Subscribe to Vulnerabilities