Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-39665

Publication date:

18/08/2023

D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the acStack_50 parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-39666

Publication date:

18/08/2023

D-Link DIR-842 fw_revA_1-02_eu_multi_20151008 was discovered to contain multiple buffer overflows in the fgets function via the acStack_120 and acStack_220 parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2023

CVE-2023-39125

Publication date:

18/08/2023

NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file&#39;s width, height, and BPP are not validated. NOTE: the vendor&#39;s perspective is "this main application was not intended to be a well tested program, it&#39;s just something to demonstrate it works and for the user to see how to integrate it into their own programs."

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-31492

Publication date:

17/08/2023

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2024

CVE-2023-40171

Publication date:

17/08/2023

Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for authentication may be impacted, allowing for any account to be taken over within their own instance. This could be done by using the secret to sign attacker crafted JWTs. If you think that you may be impacted, we strongly suggest you to rotate the secret stored in the `DISPATCH_JWT_SECRET` envvar in the `.env` file. This issue has been addressed in commit `b1942a4319` which has been included in the `20230817` release. users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-28690

Publication date:

17/08/2023

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2023

CVE-2023-39970

Publication date:

17/08/2023

Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2023

CVE-2023-39971

Publication date:

17/08/2023

Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2023

CVE-2023-39972

Publication date:

17/08/2023

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-39973

Publication date:

17/08/2023

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-39974

Publication date:

17/08/2023

Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-40315

Publication date:

17/08/2023

In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization&#39;s private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2024

Subscribe to Vulnerabilities