Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-1731

Publication date:

24/04/2023

In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

23/05/2023

CVE-2023-23892

Publication date:

24/04/2023

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jamie Poitra M Chart plugin

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2023

CVE-2023-29578

Publication date:

24/04/2023

mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the mp4v2::impl::MP4StringProperty::~MP4StringProperty() function at src/mp4property.cpp.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2025

CVE-2022-48476

Publication date:

24/04/2023

In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible<br />

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2023

CVE-2022-48477

Publication date:

24/04/2023

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing<br />

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2023

CVE-2023-29579

Publication date:

24/04/2023

yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-29582

Publication date:

24/04/2023

yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-29583

Publication date:

24/04/2023

yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

CVE-2023-25133

Publication date:

24/04/2023

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2023

CVE-2023-25131

Publication date:

24/04/2023

Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the &#39;admin&#39; password.

Severity CVSS v4.0: Pending analysis

Last modification:

03/05/2023

CVE-2023-25132

Publication date:

24/04/2023

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2023

CVE-2023-22577

Publication date:

24/04/2023

Within White Rabbit Switch it&#39;s possible as an unauthenticated user to retrieve sensitive information such as password hashes and the SNMP community strings.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2023

Subscribe to Vulnerabilities