Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-24294

Publication date:

29/11/2023

Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentification.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-46944

Publication date:

28/11/2023

An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust component.

Severity CVSS v4.0: Pending analysis

Last modification:

04/12/2023

CVE-2023-29066

Publication date:

28/11/2023

The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-48193

Publication date:

28/11/2023

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-49092

Publication date:

28/11/2023

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.

Severity CVSS v4.0: Pending analysis

Last modification:

28/12/2023

CVE-2023-29061

Publication date:

28/11/2023

There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-29062

Publication date:

28/11/2023

The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-29063

Publication date:

28/11/2023

The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-29064

Publication date:

28/11/2023

The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-29065

Publication date:

28/11/2023

The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

CVE-2023-45539

Publication date:

28/11/2023

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Severity CVSS v4.0: Pending analysis

Last modification:

15/10/2024

CVE-2023-29060

Publication date:

28/11/2023

The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2023

Subscribe to Vulnerabilities