UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,525
Published in 7 days
368
Critical in 30 days
105
Actively exploited
66

Latest vulnerabilities

11,525 vulnerabilities
  1. Medium 5.0

    CVE-2014-3572 · OpenSSL

    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

    Published 9 Jan 2015 · NVD
  2. Medium 5.0

    CVE-2014-3571 · OpenSSL

    OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.

    Published 9 Jan 2015 · NVD
  3. Medium 5.0

    CVE-2014-3570 · OpenSSL

    The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

    Published 9 Jan 2015 · NVD
  4. Unrated

    CVE-2015-0902 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Exposure of Sensitive Information to an Unauthorized Actor

    Published 8 Jan 2015 · Fixed in 2.2.6 · WPVulnerability
  5. Low 2.6

    CVE-2014-9507 · MediaWiki

    MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.

    Published 4 Jan 2015 · NVD
  6. High 7.5

    CVE-2014-9277 · MediaWiki

    The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.

    Published 4 Jan 2015 · NVD
  7. Medium 5.1

    CVE-2014-9276 · MediaWiki

    Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly…

    Published 4 Jan 2015 · NVD
  8. High 7.5

    CVE-2014-9427 · PHP

    sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive…

    Published 3 Jan 2015 · NVD
  9. High 7.3

    CVE-2014-9426 · PHP

    The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard…

    Published 31 Dec 2014 · NVD
  10. High 7.5

    CVE-2014-9425 · PHP

    Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

    Published 31 Dec 2014 · NVD
  11. Medium 4.3

    CVE-2014-8109 · Apache HTTP Server

    mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a…

    Published 29 Dec 2014 · NVD
  12. Medium 6.8

    CVE-2014-3556 · nginx

    The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a…

    Published 29 Dec 2014 · Fixed in 1.6.1, 1.7.4 · NVD
  13. Medium 5.0

    CVE-2014-3971 · MongoDB

    The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

    Published 25 Dec 2014 · NVD
  14. Medium 5.0

    CVE-2014-3569 · OpenSSL

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue…

    Published 24 Dec 2014 · NVD
  15. High 7.5

    CVE-2014-8142 · PHP

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

    Published 20 Dec 2014 · NVD
  16. Medium 4.3

    CVE-2015-5151 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 17 Dec 2014 · Fixed in 4.2.3 · NVD, WPVulnerability
  17. Medium 6.4

    CVE-2014-9358 · Docker Engine

    Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

    Published 16 Dec 2014 · NVD
  18. High 10.0

    CVE-2014-9357 · Docker Engine

    Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

    Published 16 Dec 2014 · NVD
  19. Medium 5.0

    CVE-2014-8964 · MariaDB

    Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.

    Published 16 Dec 2014 · Fixed in 10.0.18 · NVD
  20. Medium 5.0

    CVE-2014-3583 · Apache HTTP Server

    The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.

    Published 15 Dec 2014 · NVD
  21. Medium 5.0

    CVE-2014-6408 · Docker Engine

    Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.

    Published 12 Dec 2014 · NVD
  22. High 7.5

    CVE-2014-6407 · Docker Engine

    Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

    Published 12 Dec 2014 · NVD
  23. Medium 5.8

    CVE-2014-9365 · Python

    The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows…

    Published 12 Dec 2014 · NVD
  24. Medium 4.3

    CVE-2014-3616 · nginx

    nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

    Published 8 Dec 2014 · Fixed in 1.6.2, 1.7.5 · NVD
  25. High 7.5

    CVE-2014-1693 · Erlang/OTP

    Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17)…

    Published 8 Dec 2014 · NVD
  26. Medium 6.1

    CVE-2014-4932 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 8 Dec 2014 · Fixed in 5.1.5 · NVD, WPVulnerability
  27. Unrated

    WPV-142c04a3f0ff · Slider Revolution

    Vulnerability in Slider Revolution

    Published 26 Nov 2014 · Fixed in 3.0.96 · WPVulnerability
  28. Medium 4.3

    CVE-2014-9039 · WordPress

    wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

    Published 25 Nov 2014 · NVD
  29. Medium 6.4

    CVE-2014-9038 · WordPress

    wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

    Published 25 Nov 2014 · NVD
  30. Medium 6.8

    CVE-2014-9037 · WordPress

    WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

    Published 25 Nov 2014 · NVD
  31. Medium 4.3

    CVE-2014-9036 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.

    Published 25 Nov 2014 · NVD
  32. Medium 4.3

    CVE-2014-9035 · WordPress

    Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 25 Nov 2014 · NVD
  33. Medium 5.0

    CVE-2014-9034 · WordPress

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

    Published 25 Nov 2014 · NVD
  34. Medium 6.8

    CVE-2014-9033 · WordPress

    Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.

    Published 25 Nov 2014 · NVD
  35. Medium 4.3

    CVE-2014-9032 · WordPress

    Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 25 Nov 2014 · NVD
  36. Medium 4.3

    CVE-2014-9031 · WordPress

    Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.

    Published 25 Nov 2014 · NVD
  37. High 7.5

    CVE-2014-9735 · Slider Revolution

    Vulnerability in Slider Revolution

    Published 25 Nov 2014 · Fixed in 3.0.96 · NVD, WPVulnerability
  38. High 7.5

    CVE-2014-8626 · PHP

    Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

    Published 23 Nov 2014 · NVD
  39. Medium 5.0

    CVE-2014-8090 · Ruby

    The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists…

    Published 21 Nov 2014 · NVD
  40. Medium 5.0

    CVE-2014-3620 · curl

    cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

    Published 18 Nov 2014 · NVD
  41. Medium 5.0

    CVE-2014-3613 · curl

    cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.

    Published 18 Nov 2014 · NVD
  42. Medium 5.0

    CVE-2014-5277 · Docker Engine

    Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.

    Published 17 Nov 2014 · NVD
  43. Low 3.3

    CVE-2014-2667 · Python

    Race condition in the _get_masked_mode function in Lib/os.py in Python 3.2 through 3.5, when exist_ok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the expected value.

    Published 16 Nov 2014 · NVD
  44. Medium 5.0

    CVE-2014-4975 · Ruby

    Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

    Published 15 Nov 2014 · NVD
  45. Medium 4.3

    CVE-2014-3707 · curl

    The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

    Published 15 Nov 2014 · NVD
  46. Medium 5.1

    CVE-2014-4078 · Microsoft IIS

    The IP Security feature in Microsoft Internet Information Services (IIS) 8.0 and 8.5 does not properly process wildcard allow and deny rules for domains within the "IP Address and Domain Restrictions" list, which makes it easier for remote attackers to bypass an intended rule set via an HTTP request, aka "IIS Security Feature Bypass Vulnerability."

    Published 11 Nov 2014 · NVD
  47. Unrated

    CVE-2014-8724 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 10 Nov 2014 · Fixed in 0.9.4.1 · WPVulnerability
  48. Medium 5.0

    CVE-2014-3710 · PHP

    The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

    Published 5 Nov 2014 · Fixed in 5.4.35, 5.5.19, 5.6.3 · NVD
  49. High 7.5

    CVE-2014-7228 · Joomla!

    Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an…

    Published 3 Nov 2014 · NVD
  50. Medium 5.0

    CVE-2014-8080 · Ruby

    The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

    Published 3 Nov 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.