Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-2494

Publication date:

21/03/2024

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-29876

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, &#39;sortby&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29877

Publication date:

21/03/2024

Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, &#39;expense_category_name&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29878

Publication date:

21/03/2024

Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, &#39;description&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29879

Publication date:

21/03/2024

Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, &#39;business_id&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29871

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, &#39;id&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29872

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, &#39;agencyids&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29873

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, &#39;bunitname&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29874

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, &#39;sort_name&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29875

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, &#39;sort_name&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-29866

Publication date:

21/03/2024

Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2025

CVE-2024-29870

Publication date:

21/03/2024

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, &#39;business_id&#39; parameter./sentrifugo/index.php/index/getdepartments/format/html, &#39;business_id&#39; parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

Subscribe to Vulnerabilities