Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2006-0695

Publication date:

15/02/2006

Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0696

Publication date:

15/02/2006

SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0698

Publication date:

15/02/2006

Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0699

Publication date:

15/02/2006

Cross-site scripting (XSS) vulnerability in search.php in QWikiWiki 1.5, and possibly 1.5.1 and other versions, allows remote attackers to inject arbitrary web script or HTML via the query parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0700

Publication date:

15/02/2006

imageVue 16.1 allows remote attackers to obtain folder permission settings via a direct request to dir.php, which returns an XML document that lists folders and their permissions.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0701

Publication date:

15/02/2006

readfolder.php in imageVue 16.1 allows remote attackers to list directories via modified path and ext parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0702

Publication date:

15/02/2006

admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0704

Publication date:

15/02/2006

iE Integrator 4.4.220114, when configured without a "bespoke error page" in acm.ini, allows remote attackers to obtain sensitive information via a URL that calls a non-existent .aspx script in the integrator/apps directory, which results in an error message that displays the installation path, web server name, IP, and port, session cookie information, and the IIS system username.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0705

Publication date:

15/02/2006

Format string vulnerability in a logging function as used by various SFTP servers, including (1) AttachmateWRQ Reflection for Secure IT UNIX Server before 6.0.0.9, (2) Reflection for Secure IT Windows Server before 6.0 build 38, (3) F-Secure SSH Server for Windows before 5.3 build 35, (4) F-Secure SSH Server for UNIX 3.0 through 5.0.8, (5) SSH Tectia Server 4.3.6 and earlier and 4.4.0, and (6) SSH Shell Server 3.2.9 and earlier, allows remote authenticated users to execute arbitrary commands via unspecified vectors, involving crafted filenames and the stat command.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0707

Publication date:

15/02/2006

PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0709

Publication date:

15/02/2006

Buffer overflow in Metamail 2.7-50 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via e-mail messages with a long boundary attribute, a different vulnerability than CVE-2004-0105.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

CVE-2006-0710

Publication date:

15/02/2006

Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP.

Severity CVSS v4.0: Pending analysis

Last modification:

20/07/2017

Subscribe to Vulnerabilities