Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2023-26097

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/05/2025

CVE-2023-26099

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** An issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/05/2025

CVE-2023-26059

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** An issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab, attackers can upload a ZIP file which, when processed, exploits Stored XSS. The upload option of the Site Configuration tool does not validate the file contents. The application is in a demilitarised zone behind a perimeter firewall and without exposure to the internet. The attack can only be performed by an internal user.

Gravedad CVSS v3.1: MEDIA

Última modificación:

04/02/2025

CVE-2023-27991

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker to execute some OS commands remotely.

Gravedad CVSS v3.1: ALTA

Última modificación:

13/06/2023

CVE-2023-27990

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow an authenticated attacker with administrator privileges to store malicious scripts in a vulnerable device. A successful XSS attack could then result in the stored malicious scripts being executed when the user visits the Logs page of the GUI on the device.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/02/2026

CVE-2023-22918

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50(W) firmware versions 4.16 through 5.35, USG20(W)-VPN firmware versions 4.16 through 5.35, VPN series firmware versions 4.30 through 5.35, NWA110AX firmware version 6.50(ABTG.2) and earlier versions, WAC500 firmware version 6.50(ABVS.0) and earlier versions, and WAX510D firmware version 6.50(ABTF.2) and earlier versions, which could allow a remote authenticated attacker to retrieve encrypted information of the administrator on an affected device.

Gravedad CVSS v3.1: MEDIA

Última modificación:

12/06/2023

CVE-2012-10014

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232.

Gravedad CVSS v3.1: BAJA

Última modificación:

21/11/2024

CVE-2012-10013

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is named 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227231.

Gravedad CVSS v3.1: BAJA

Última modificación:

21/11/2024

CVE-2023-30544

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Gravedad CVSS v3.1: BAJA

Última modificación:

04/02/2025

CVE-2023-26494

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.<br /> <br />

Gravedad CVSS v3.1: MEDIA

Última modificación:

03/05/2023

CVE-2023-26060

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.

Gravedad CVSS v3.1: MEDIA

Última modificación:

04/02/2025

CVE-2023-26061

Fecha de publicación:

24/04/2023

Idioma:

Inglés

*** Pendiente de traducción *** An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can create a script to inject XSS. Input validation was missing during creation of a scheduled task. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.

Gravedad CVSS v3.1: MEDIA

Última modificación:

04/02/2025

Suscribirse a Vulnerabilidades