Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-40610

Publication date:

27/11/2023

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset&#39;s metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-42501

Publication date:

27/11/2023

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-43701

Publication date:

27/11/2023

Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart&#39;s metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-6202

Publication date:

27/11/2023

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-6254

Publication date:

27/11/2023

A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-47168

Publication date:

27/11/2023

Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-48268

Publication date:

27/11/2023

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-48369

Publication date:

27/11/2023

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-49068

Publication date:

27/11/2023

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-35075

Publication date:

27/11/2023

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim&#39;s page by create a channel name that is valid HTML. No XSS is possible though.

Severity CVSS v4.0: Pending analysis

Last modification:

30/11/2023

CVE-2023-40703

Publication date:

27/11/2023

Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

CVE-2023-43754

Publication date:

27/11/2023

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2023

Subscribe to Vulnerabilities