Inicio / Alerta Temprana / Vulnerabilidades
Suscribirse a INCIBE-CERT - Vulnerabilities RSS

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (http://nvd.nist.gov/) (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (http://cve.mitre.org/) (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS (https://www.incibe-cert.es/feed/vulnerabilities) o Boletines (https://www.incibe-cert.es/suscripciones) podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2019-1623

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root user. The vulnerability is due to insufficient input validation during the execution of a vulnerable CLI command. An attacker with administrator-level credentials could exploit this vulnerability by injecting crafted arguments during command execution. A successful exploit could allow the attacker to perform arbitrary code execution as root on an affected product.

CVE-2019-1624

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the vManage web-based UI (Web UI) in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the vManage Web UI. A successful exploit could allow the attacker to execute commands with root privileges.

CVE-2019-1625

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the CLI of Cisco SD-WAN Solution could allow an authenticated, local attacker to elevate lower-level privileges to the root user on an affected device. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. A successful exploit could allow the attacker to make configuration changes to the system as the root user.

CVE-2019-1626

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the vManage web-based UI (Web UI) of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected vManage device. The vulnerability is due to a failure to properly authorize certain user actions in the device configuration. An attacker could exploit this vulnerability by logging in to the vManage Web UI and sending crafted HTTP requests to vManage. A successful exploit could allow attackers to gain elevated privileges and make changes to the configuration that they would not normally be authorized to make.

CVE-2019-1627

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized access to sensitive user information from the configuration data that is stored on the affected system. The vulnerability is due to insufficient protection of data in the configuration file. An attacker could exploit this vulnerability by downloading the configuration file. An exploit could allow the attacker to use the sensitive information from the file to elevate privileges.

CVE-2019-1628

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect bounds checking. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. An exploit could allow the attacker to cause a buffer overflow, resulting in a process crash and DoS condition on the device.

CVE-2019-1629

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to have write access and upload arbitrary data to the filesystem. The vulnerability is due to a failure to delete temporarily uploaded files. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the affected device. An exploit could allow the attacker to fill up the filesystem or upload malicious scripts.

CVE-2019-1630

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient checking of an input buffer. An attacker could exploit this vulnerability by passing a crafted file to the affected system. A successful exploit could inhibit an administrator's ability to access the system.

CVE-2019-1631

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow an attacker to view sensitive system data.

CVE-2019-1632

Gravedad: 
Sin asignar
Fecha publicación : 
20/06/2019
Última modificación: 
19/06/2019
Descripción:  
*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to use a web browser and the privileges of the user to perform arbitrary actions on the affected device.

Páginas