Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2008-10002
Fecha de publicación:
05/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability has been found in cfire24 ajaxlife up to 0.3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.3.3 is able to address this issue. The patch is identified as 9fb53b67312fe3f4336e01c1e3e1bedb4be0c1c8. It is recommended to upgrade the affected component. VDB-222286 is the identifier assigned to this vulnerability.
Gravedad CVSS v3.1: BAJA
Última modificación:
21/11/2024

CVE-2014-125091
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.
Gravedad CVSS v3.1: MEDIA
Última modificación:
17/06/2026

CVE-2014-125090
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.
Gravedad CVSS v3.1: BAJA
Última modificación:
17/06/2026

CVE-2020-36665
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability was found in Artesãos SEOTools up to 0.17.1 and classified as critical. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The identifier of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier VDB-222233 was assigned to this vulnerability.
Gravedad CVSS v3.1: MEDIA
Última modificación:
17/05/2024

CVE-2020-36664
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222232.
Gravedad CVSS v3.1: MEDIA
Última modificación:
17/05/2024

CVE-2023-1175
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
Gravedad CVSS v3.1: MEDIA
Última modificación:
03/11/2025

CVE-2020-36663
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The patch is named ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222231.
Gravedad CVSS v3.1: MEDIA
Última modificación:
17/05/2024

CVE-2023-26481
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context[&amp;#39;is_restored&amp;#39;]`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.<br />
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/11/2023

CVE-2023-25819
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches &gt;= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.
Gravedad CVSS v3.1: MEDIA
Última modificación:
09/03/2023

CVE-2021-36689
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The PIN is 5 to 8 digits, which may be insufficient in this situation.
Gravedad CVSS v3.1: MEDIA
Última modificación:
10/03/2023

CVE-2023-23929
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.<br />
Gravedad CVSS v3.1: ALTA
Última modificación:
07/11/2023

CVE-2023-26486
Fecha de publicación:
04/03/2023
Idioma:
Inglés
*** Pendiente de traducción *** Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.
Gravedad CVSS v3.1: MEDIA
Última modificación:
09/03/2023
Suscribirse a Vulnerabilidades