Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-17574
Publication date:
14/10/2019
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2019

CVE-2019-17552
Publication date:
14/10/2019
An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload.
Severity CVSS v4.0: Pending analysis
Last modification:
16/10/2019

CVE-2019-17553
Publication date:
14/10/2019
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.
Severity CVSS v4.0: Pending analysis
Last modification:
17/10/2019

CVE-2019-17408
Publication date:
14/10/2019
parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-17545
Publication date:
14/10/2019
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-17547
Publication date:
14/10/2019
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2019

CVE-2019-17546
Publication date:
14/10/2019
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
Severity CVSS v4.0: Pending analysis
Last modification:
20/12/2024

CVE-2019-17539
Publication date:
14/10/2019
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
Severity CVSS v4.0: Pending analysis
Last modification:
10/06/2021

CVE-2019-17542
Publication date:
14/10/2019
FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2021

CVE-2019-17543
Publication date:
14/10/2019
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2019-17544
Publication date:
14/10/2019
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.
Severity CVSS v4.0: Pending analysis
Last modification:
02/08/2021

CVE-2019-17501
Publication date:
14/10/2019
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2019
Subscribe to Vulnerabilities