Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-0178
Publication date:
05/11/2019
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-18631
Publication date:
05/11/2019
The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 (18.8), 3.5.2 (18.11), and 3.6.0 (19.6) does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers to execute arbitrary code inside the Centrify process via (1) a crafted application that makes a pipe connection to the process and sends malicious serialized data or (2) a crafted Microsoft Management Console snap-in control file.
Severity CVSS v4.0: Pending analysis
Last modification:
13/09/2021

CVE-2019-17211
Publication date:
05/11/2019
An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() is used to calculate the required memory for the CoAP message from the sn_coap_hdr_s data structure. Both returned_byte_count and src_coap_msg_ptr->payload_len are of type uint16_t. When added together, the result returned_byte_count can wrap around the maximum uint16_t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2019

CVE-2019-17062
Publication date:
05/11/2019
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.
Severity CVSS v4.0: Pending analysis
Last modification:
08/11/2019

CVE-2019-17212
Publication date:
05/11/2019
Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-17598
Publication date:
05/11/2019
An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2013-6460
Publication date:
05/11/2019
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
Severity CVSS v4.0: Pending analysis
Last modification:
15/07/2021

CVE-2013-6461
Publication date:
05/11/2019
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Severity CVSS v4.0: Pending analysis
Last modification:
15/07/2021

CVE-2013-6365
Publication date:
05/11/2019
Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
Severity CVSS v4.0: Pending analysis
Last modification:
18/08/2020

CVE-2016-1000002
Publication date:
05/11/2019
gdm3 3.14.2 and possibly later has an information leak before screen lock
Severity CVSS v4.0: Pending analysis
Last modification:
18/08/2020

CVE-2013-6364
Publication date:
05/11/2019
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
Severity CVSS v4.0: Pending analysis
Last modification:
18/08/2020

CVE-2019-17221
Publication date:
05/11/2019
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
Severity CVSS v4.0: Pending analysis
Last modification:
08/11/2019
Subscribe to Vulnerabilities