Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2023-29512

Fecha de publicación:

19/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it&#39;s own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the information loaded from attachments in `imported.vm`, `importinline.vm`, and `packagelist.vm`. This page is installed by default. This vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/04/2023

CVE-2023-29510

Fecha de publicación:

19/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged contexts without any escaping which allows remote code execution for any user who has edit access on at least one document which could be the user&#39;s own profile where edit access is enabled by default. A mitigation for this vulnerability is part of XWiki 14.10.2 and XWiki 15.0 RC1: translations with user scope now require script right. This means that regular users cannot exploit this anymore as users don&#39;t have script right by default anymore starting with XWiki 14.10. There are no known workarounds apart from upgrading to a patched versions.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/04/2023

CVE-2023-29514

Fecha de publicación:

19/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their own user profile) can execute code with programming rights, leading to remote code execution. This vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/04/2023

CVE-2023-29513

Fecha de publicación:

19/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It&#39;s possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. This vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1. There is no known workaround other than upgrading.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/04/2023

CVE-2021-28254

Fecha de publicación:

19/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

05/03/2025

CVE-2023-27043

Fecha de publicación:

19/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Gravedad CVSS v3.1: MEDIA

Última modificación:

12/05/2026

CVE-2023-30606

Fecha de publicación:

18/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSetting` class, notably `#clear_cache!` and `#notify_changed!`, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/04/2023

CVE-2023-30538

Fecha de publicación:

18/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on the users’ browsers by uploading a crafted SVG file. This issue is patched in the latest stable and tests-passed versions of Discourse. Users are advised to upgrade. For users unable to upgrade there are two possible workarounds: enable CDN handing of uploads (and ensure the CDN sanitizes SVG files) or disable SVG file uploads by ensuring that the `authorized extensions` site setting does not include `svg` (or reset that setting to the default, by default Discourse doesn&#39;t enable SVG uploads by users).

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/04/2023

CVE-2023-29410

Fecha de publicación:

18/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/04/2023

CVE-2023-30608

Fecha de publicación:

18/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

03/11/2025

CVE-2023-29196

Fecha de publicación:

18/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in embedding Javascript that does pass the CSP, it could result in session hijacking for any users that view the attacker’s post. The vulnerability is patched in the latest tests-passed, beta and stable branches. Users are advised to upgrade. Users unable to upgrade should enable and/or restore your site&#39;s CSP to the default one provided with Discourse. Remove any embed-able hosts configured.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/04/2023

CVE-2023-28004

Fecha de publicación:

18/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial of service or remote code execution.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

28/04/2023

Suscribirse a Vulnerabilidades