Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-2534
Publication date:
08/05/2023
Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. via<br /> ticket histories by any user. (Fuzzing for garnering other adjacent user/sensitive data). Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation<br /> and the number of active users. (Flooding)This issue affects OTRS: from 8.0.X before 8.0.32.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
16/05/2023

CVE-2023-2566
Publication date:
08/05/2023
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
Severity CVSS v4.0: Pending analysis
Last modification:
11/05/2023

CVE-2023-30018
Publication date:
08/05/2023
Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-29944
Publication date:
08/05/2023
Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-30185
Publication date:
08/05/2023
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-30257
Publication date:
08/05/2023
A buffer overflow in the component /proc/ftxxxx-debug of FiiO M6 Build Number v1.0.4 allows attackers to escalate privileges to root.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-2565
Publication date:
07/05/2023
A vulnerability has been found in SourceCodester Multi Language Hotel Management Software 1.0 and classified as problematic. This vulnerability affects unknown code of the file ajax.php of the component POST Parameter Handler. The manipulation of the argument complaint_type with the input alert(document.cookie) leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228172.
Severity CVSS v4.0: Pending analysis
Last modification:
17/05/2024

CVE-2023-2564
Publication date:
07/05/2023
OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2023-32290
Publication date:
07/05/2023
The myMail app through 14.30 for iOS sends cleartext credentials in a situation where STARTTLS is expected by a server.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-31047
Publication date:
07/05/2023
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django&amp;#39;s "Uploading multiple files" documentation suggested otherwise.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-24400
Publication date:
07/05/2023
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Hu-manity.Co Cookie Notice &amp; Compliance for GDPR / CCPA plugin
Severity CVSS v4.0: Pending analysis
Last modification:
10/05/2023

CVE-2023-25491
Publication date:
06/05/2023
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Samuel Marshall JCH Optimize plugin
Severity CVSS v4.0: Pending analysis
Last modification:
10/05/2023
Subscribe to Vulnerabilities