Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-15556

Publication date:

26/08/2019

Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2019

CVE-2019-15304

Publication date:

26/08/2019

Lierda Grill Temperature Monitor V1.00_50006 has a default password of admin for the admin account, which allows an attacker to cause a Denial of Service or Information Disclosure via the undocumented access-point configuration page located on the device. This wifi thermometer app requests and requires excessive permissions to operate such as Fine GPS location, camera, applists, Serial number, IMEI. In addition to the "backdoor" login access for "admin" purposes, this accompanying app also establishes connections with several china based URLs to include Alibaba cloud computing. NOTE: this device also ships with ProGrade branding.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2020

CVE-2018-20992

Publication date:

26/08/2019

An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-20993

Publication date:

26/08/2019

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2018-20994

Publication date:

26/08/2019

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2020

CVE-2017-18587

Publication date:

26/08/2019

An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.

Severity CVSS v4.0: Pending analysis

Last modification:

03/09/2019

CVE-2016-10933

Publication date:

26/08/2019

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.

Severity CVSS v4.0: Pending analysis

Last modification:

29/08/2019

CVE-2016-10932

Publication date:

26/08/2019

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2021

CVE-2019-15506

Publication date:

26/08/2019

An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

CVE-2016-10931

Publication date:

26/08/2019

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2023