Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-36628
Publication date:
03/10/2023
A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2024

CVE-2023-28373
Publication date:
03/10/2023
A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode. <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/10/2023

CVE-2023-32572
Publication date:
03/10/2023
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection. <br />
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2024

CVE-2023-28372
Publication date:
02/10/2023
A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
20/09/2024

CVE-2023-31042
Publication date:
02/10/2023
A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols. <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/10/2023

CVE-2023-36627
Publication date:
02/10/2023
A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly. <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/10/2023

CVE-2023-43980
Publication date:
02/10/2023
Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2023

CVE-2023-43892
Publication date:
02/10/2023
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. This vulnerability is exploited via a crafted payload.
Severity CVSS v4.0: Pending analysis
Last modification:
04/04/2025

CVE-2023-43893
Publication date:
02/10/2023
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) function. This vulnerability is exploited via a crafted payload.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2023

CVE-2023-44011
Publication date:
02/10/2023
An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management component.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2024

CVE-2023-44012
Publication date:
02/10/2023
Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2024

CVE-2023-43891
Publication date:
02/10/2023
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2023
Subscribe to Vulnerabilities