Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2001-0911
Publication date:
21/11/2001
PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it.
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2017

CVE-2001-0909
Publication date:
21/11/2001
Buffer overflow in helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2017

CVE-2001-0914
Publication date:
21/11/2001
Linux kernel before 2.4.11pre3 in multiple Linux distributions allows local users to cause a denial of service (crash) by starting the core vmlinux kernel, possibly related to poor error checking during ELF loading.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2017

CVE-2001-0921
Publication date:
21/11/2001
Netscape 4.79 and earlier for MacOS allows an attacker with access to the browser to obtain passwords from form fields by printing the document into which the password has been typed, which is printed in cleartext.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2017

CVE-2001-0904
Publication date:
20/11/2001
Internet Explorer 5.5 and 6 with the Q312461 (MS01-055) patch modifies the HTTP_USER_AGENT (UserAgent) information that indicates that the patch has been installed, which could allow remote malicious web sites to more easily identify and exploit vulnerable clients.
Severity CVSS v4.0: Pending analysis
Last modification:
23/07/2021

CVE-2001-0903
Publication date:
20/11/2001
Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, avoid device blacklists, clone devices, and create new device keyvectors by computing and using alternate key combinations for authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
18/10/2016

CVE-2001-0902
Publication date:
20/11/2001
Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2018

CVE-2001-0901
Publication date:
19/11/2001
Hypermail allows remote attackers to execute arbitrary commands on a server supporting SSI via an attachment with a .shtml extension, which is archived on the server and can then be executed by requesting the URL for the attachment.
Severity CVSS v4.0: Pending analysis
Last modification:
26/01/2024

CVE-2001-1463
Publication date:
19/11/2001
The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, which allows remote attackers to sniff passwords.
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2020

CVE-2001-1228
Publication date:
18/11/2001
Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2008

CVE-2001-0900
Publication date:
18/11/2001
Directory traversal vulnerability in modules.php in Gallery before 1.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the include parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2017

CVE-2001-0899
Publication date:
16/11/2001
Network Tools 0.2 for PHP-Nuke allows remote attackers to execute commands on the server via shell metacharacters in the $hostinput variable.
Severity CVSS v4.0: Pending analysis
Last modification:
01/07/2019
Subscribe to Vulnerabilities