Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-4590

Publication date:

27/11/2023

Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument through the Structured Exception Handler (SEH) registers.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2023

CVE-2023-5871

Publication date:

27/11/2023

A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2024

CVE-2023-5607

Publication date:

27/11/2023

An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. The attacker would need the appropriate privileges to access the relevant section of the User Interface. The import logic has been updated to restrict file types and content.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-40610

Publication date:

27/11/2023

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset&#39;s metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-42501

Publication date:

27/11/2023

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-43701

Publication date:

27/11/2023

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart&#39;s metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-6202

Publication date:

27/11/2023

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-6254

Publication date:

27/11/2023

A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-47168

Publication date:

27/11/2023

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-48268

Publication date:

27/11/2023

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-48369

Publication date:

27/11/2023

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-49068

Publication date:

27/11/2023

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

Subscribe to Vulnerabilities