Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-6743

Publication date:

03/06/2019

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WebAssembly.Instance method. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7466.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2022

CVE-2019-3567

Publication date:

03/06/2019

In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known &#39;safe&#39; permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the &#39;Program Files&#39; directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.

Severity CVSS v4.0: Pending analysis

Last modification:

06/03/2020

CVE-2019-12310

Publication date:

03/06/2019

ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including Base64 encoded &#39;support&#39; credentials, leading to administrative access of the device.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2019

CVE-2018-5406

Publication date:

03/06/2019

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. An unauthenticated, remote attacker could add an administrator-level account or change the appliance&#39;s settings.

Severity CVSS v4.0: Pending analysis

Last modification:

18/09/2020

CVE-2018-5404

Publication date:

03/06/2019

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges (&#39;User Console Only&#39; role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-5405

Publication date:

03/06/2019

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with &#39;User Console Only&#39; rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with &#39;user console only&#39; rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2019-10145

Publication date:

03/06/2019

rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.

Severity CVSS v4.0: Pending analysis

Last modification:

02/10/2020

CVE-2019-10147

Publication date:

03/06/2019

rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2020

CVE-2019-10144

Publication date:

03/06/2019

rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2020

CVE-2017-14852

Publication date:

03/06/2019

An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The attack allows for an eavesdropper to capture the communication and decrypt the data.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2019

CVE-2017-14853

Publication date:

03/06/2019

The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a direct shell command. By tampering with the request, an attacker is able to run shell commands and receive valid output from the device.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2019

CVE-2017-14728

Publication date:

03/06/2019

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this exploit. Also, the SiteOmat does not force administrators to switch passwords, leaving SSH and HTTP remote authentication open to public.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2019

Subscribe to Vulnerabilities