Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-31705

Publication date:

13/07/2023

A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2023

CVE-2023-31704

Publication date:

13/07/2023

Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator&#39;s role.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2024

CVE-2022-24834

Publication date:

13/07/2023

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2023

CVE-2023-37267

Publication date:

13/07/2023

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2023

CVE-2023-35070

Publication date:

13/07/2023

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2023

CVE-2023-31819

Publication date:

13/07/2023

An issue found in KEISEI STORE Co, Ltd. LIVRE KEISEI v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2023

CVE-2023-31820

Publication date:

13/07/2023

An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2023

CVE-2023-31822

Publication date:

13/07/2023

An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2023

CVE-2023-31825

Publication date:

13/07/2023

An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.

Severity CVSS v4.0: Pending analysis

Last modification:

25/07/2023

CVE-2023-25948

Publication date:

13/07/2023

Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2024

CVE-2023-26597

Publication date:

13/07/2023

Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upgrading and versioning.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2024

CVE-2023-3660

Publication date:

13/07/2023

A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/add_user_modal.php. The manipulation of the argument un leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-234014 is the identifier assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

Subscribe to Vulnerabilities