Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2004-1494

Publication date:

31/12/2004

Buffer overflow in the Screen Fetch option in XDICT 2002 through 2005 allows remote attackers to cause a denial of service ( CPU consumption or application exit) and possibly execute arbitrary code via a long string.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1495

Publication date:

31/12/2004

The Repair Archive command in WinRAR 3.40 allows remote attackers to cause a denial of service (application crash) via a corrupt ZIP archive.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1499

Publication date:

31/12/2004

Cross-site scripting (XSS) vulnerability in the compose message form in HELM 3.1.19 and earlier allows remote attackers to execute arbitrary web script or HTML via the Subject field.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1500

Publication date:

31/12/2004

Format string vulnerability in the Lithtech engine, as used in multiple games, allows remote authenticated users to cause a denial of service (application crash) via format string specifiers in (1) a nickname or (2) a message.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1501

Publication date:

31/12/2004

The webmail service in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) by sending a POST request with a large Content-Length value, then disconnecting without sending that amount of data.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1143

Publication date:

31/12/2004

The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1146

Publication date:

31/12/2004

Multiple cross-site scripting (XSS) vulnerabilities in (1) main.c and (2) login.c for CVSTrac before 1.1.5 allow remote attackers to inject arbitrary HTML and web script.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1150

Publication date:

31/12/2004

Stack-based buffer overflow in the in_cdda.dll plugin for Winamp 5.0 through 5.08c allows attackers to execute arbitrary code via a cda:// URL with a long (1) device name or (2) sound track number, as demonstrated with a .m3u or .pls playlist file.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1200

Publication date:

31/12/2004

Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1383

Publication date:

31/12/2004

Multiple SQL injection vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to execute arbitrary SQL statements via the (1) order, (2) project_id, (3) pro_main, or (4) hours_id parameters to index.php or (5) ticket_id to viewticket_details.php.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1384

Publication date:

31/12/2004

Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3, (2) type, (3) msg, (4) forum_id, (5) pos, (6) cats_app, (7) cat_id, (8) msgball[msgnum], (9) fldball[acctnum] parameters to index.php or (10) ticket_id to viewticket_details.php.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

CVE-2004-1385

Publication date:

31/12/2004

phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters in the session ID such as shell metacharacters, (2) an invalid appname parameter to preferences.php or (3) an invalid menuaction parameter to index.php, which reveals the web server path in an error message.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2017

Subscribe to Vulnerabilities