Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-10767

Publication date:

06/05/2018

There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-10768

Publication date:

06/05/2018

There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu packages such as for Poppler 0.41.0 are not affected.

Severity CVSS v4.0: Pending analysis

Last modification:

25/04/2019

CVE-2018-0494

Publication date:

06/05/2018

GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Severity CVSS v4.0: Pending analysis

Last modification:

15/03/2019

CVE-2018-10686

Publication date:

06/05/2018

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST[&#39;path&#39;] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-10723

Publication date:

05/05/2018

Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2018

CVE-2018-10757

Publication date:

05/05/2018

CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2018

CVE-2018-10758

Publication date:

05/05/2018

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2018

CVE-2018-10752

Publication date:

05/05/2018

The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2019

CVE-2018-10754

Publication date:

05/05/2018

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-10753

Publication date:

05/05/2018

Stack-based buffer overflow in the delayed_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-9154

Publication date:

04/05/2018

There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745.

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2019

CVE-2017-15043

Publication date:

04/05/2018

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9 could allow an authenticated remote attacker to execute arbitrary code and gain full control of an affected system, including issuing commands with root privileges. This vulnerability is due to insufficient input validation on user-controlled input in an HTTP request to the targeted device. An attacker in possession of router login credentials could exploit this vulnerability by sending a crafted HTTP request to an affected system.

Severity CVSS v4.0: Pending analysis

Last modification:

13/06/2018

Subscribe to Vulnerabilities