Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-25007

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-25008

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-25009

Publication date:

12/05/2023

A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2023-20880

Publication date:

12/05/2023

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to &#39;root&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-32303

Publication date:

12/05/2023

Planet is software that provides satellite data. The secret file stores the user&#39;s Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user&#39;s group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

26/05/2023

CVE-2023-2181

Publication date:

12/05/2023

An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.

Severity CVSS v4.0: Pending analysis

Last modification:

26/05/2023

CVE-2023-25005

Publication date:

12/05/2023

A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to a resource injection vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-2088

Publication date:

12/05/2023

A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exploit this vulnerability by detaching one of their volumes from Cinder. The highest impact is to confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2023-1096

Publication date:

12/05/2023

SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-32306

Publication date:

12/05/2023

Time Tracker is an open source time tracking system. A time-based blind injection vulnerability existed in Time Tracker reports in versions prior to 1.22.13.5792. This was happening because the `reports.php` page was not validating all parameters in POST requests. Because some parameters were not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue is fixed in version 1.22.13.5792. As a workaround, use the fixed code in `ttReportHelper.class.php` from version 1.22.13.5792.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2023

CVE-2023-32305

Publication date:

12/05/2023

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.

Severity CVSS v4.0: Pending analysis

Last modification:

01/02/2024

CVE-2023-27863

Publication date:

12/05/2023

IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores. IBM X-Force ID: 249325.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2023

Subscribe to Vulnerabilities