Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-3704
Publication date:
07/02/2019
VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configured in sudores, a local authenticated malicious user could potentially execute arbitrary OS commands as root by exploiting this vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2019-7585
Publication date:
07/02/2019
An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
Severity CVSS v4.0: Pending analysis
Last modification:
08/02/2019

CVE-2019-7581
Publication date:
07/02/2019
The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure, a different vulnerability than CVE-2018-7876.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-7582
Publication date:
07/02/2019
The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-7580
Publication date:
07/02/2019
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
Severity CVSS v4.0: Pending analysis
Last modification:
08/02/2019

CVE-2019-7535
Publication date:
07/02/2019
index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology.
Severity CVSS v4.0: Pending analysis
Last modification:
08/02/2019

CVE-2019-4008
Publication date:
07/02/2019
API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files. IBM X-Force ID: 155626.
Severity CVSS v4.0: Pending analysis
Last modification:
03/12/2022

CVE-2018-1666
Publication date:
07/02/2019
IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2019-7578
Publication date:
07/02/2019
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-7559
Publication date:
07/02/2019
In btor2parser/btor2parser.c in Boolector Btor2Tools before 2019-01-15, opening a specially crafted input file leads to an out of bounds write in pusht_bfr.
Severity CVSS v4.0: Pending analysis
Last modification:
08/02/2019

CVE-2019-7566
Publication date:
07/02/2019
CSZ CMS 1.1.8 has CSRF via admin/users/new/add.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019

CVE-2019-7560
Publication date:
07/02/2019
In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.
Severity CVSS v4.0: Pending analysis
Last modification:
07/02/2019
Subscribe to Vulnerabilities