Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-33217

Publication date:

15/12/2023

By abusing a design flaw in the firmware upgrade mechanism of the impacted terminal it&#39;s possible to cause a permanent denial of service for the terminal. the only way to recover the terminal is by sending back the terminal to the manufacturer

Severity CVSS v4.0: Pending analysis

Last modification:

21/12/2023

CVE-2023-6838

Publication date:

15/12/2023

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2023

CVE-2023-6835

Publication date:

15/12/2023

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

Severity CVSS v4.0: Pending analysis

Last modification:

28/12/2023

CVE-2023-6836

Publication date:

15/12/2023

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2023

CVE-2023-6837

Publication date:

15/12/2023

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: * An IDP configured for federated authentication and JIT provisioning enabled with the "Prompt for username, password and consent" option. * A service provider that uses the above IDP for federated authentication and has the "Assert identity using mapped local subject identifier" flag enabled. Attacker should have: * A fresh valid user account in the federated IDP that has not been used earlier. * Knowledge of the username of a valid user in the local IDP. When all preconditions are met, a malicious actor could use JIT provisioning flow to perform user impersonation.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2025

CVE-2023-48394

Publication date:

15/12/2023

Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2023

CVE-2023-48395

Publication date:

15/12/2023

Kaifa Technology WebITR is an online attendance system, it has insufficient validation for user input within a special function. A remote attacker with regular user privilege can exploit this vulnerability to inject arbitrary SQL commands to read database.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2023

CVE-2023-48392

Publication date:

15/12/2023

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, to execute login account’s permissions, and obtain relevant information.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2024

CVE-2023-48393

Publication date:

15/12/2023

Kaifa Technology WebITR is an online attendance system. A remote attacker with regular user privilege can obtain partial sensitive system information from error message.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2023

CVE-2023-48384

Publication date:

15/12/2023

ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2023

CVE-2023-48387

Publication date:

15/12/2023

TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2024

CVE-2023-48388

Publication date:

15/12/2023

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2023

Subscribe to Vulnerabilities