UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,527
Published in 7 days
366
Critical in 30 days
105
Actively exploited
66

Latest vulnerabilities

11,527 vulnerabilities
  1. Medium 4.0

    CVE-2014-4207 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  2. Medium 4.0

    CVE-2014-2494 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

    Published 17 Jul 2014 · Fixed in 5.5.38, 10.0.12 · NVD
  3. High 9.3

    CVE-2014-2490 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE 7u60 and SE 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 17 Jul 2014 · NVD
  4. Medium 6.5

    CVE-2014-2484 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRFTS.

    Published 17 Jul 2014 · NVD
  5. High 9.3

    CVE-2014-2483 · Java

    Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor's claim that the issue is related…

    Published 17 Jul 2014 · NVD
  6. High 7.2

    CVE-2014-3499 · Docker Engine

    Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

    Published 11 Jul 2014 · NVD
  7. Medium 4.6

    CVE-2014-4698 · PHP

    Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.

    Published 10 Jul 2014 · Fixed in 5.4.32, 5.5.15 · NVD
  8. Medium 4.6

    CVE-2014-4670 · PHP

    Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.

    Published 10 Jul 2014 · NVD
  9. High 7.5

    CVE-2014-3515 · PHP

    The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  10. Medium 4.3

    CVE-2014-3487 · PHP

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  11. Medium 6.5

    CVE-2014-3480 · PHP

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  12. Medium 4.3

    CVE-2014-3479 · PHP

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  13. Medium 6.5

    CVE-2014-3478 · PHP

    Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

    Published 9 Jul 2014 · NVD
  14. Medium 6.5

    CVE-2014-0207 · PHP

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

    Published 9 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  15. Low 2.6

    CVE-2014-4721 · PHP

    The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion"…

    Published 6 Jul 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  16. Medium 5.0

    CVE-2014-3538 · PHP

    file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

    Published 3 Jul 2014 · Fixed in 5.4.32, 5.5.16 · NVD
  17. Unrated

    CVE-2014-4664 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 26 Jun 2014 · Fixed in 5.2.5 · WPVulnerability
  18. Medium 5.1

    CVE-2014-4049 · PHP

    Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

    Published 18 Jun 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  19. Low 3.3

    CVE-2014-3981 · PHP

    acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

    Published 8 Jun 2014 · Fixed in 5.3.29, 5.4.30, 5.5.14 · NVD
  20. Low 2.6

    CVE-2014-3966 · MediaWiki

    Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.

    Published 6 Jun 2014 · NVD
  21. Medium 4.3

    CVE-2014-3470 · MariaDB, OpenSSL

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

    Published 5 Jun 2014 · Fixed in 1.0.0m, 1.0.1h, 10.0.13 · NVD
  22. High 7.4

    CVE-2014-0224 · MariaDB, Node.js, OpenSSL and 1 more

    OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

    Published 5 Jun 2014 · Fixed in 2.7.8, 3.4.2, 10.0.13 · NVD
  23. Medium 4.3

    CVE-2014-0221 · MariaDB, OpenSSL

    The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

    Published 5 Jun 2014 · Fixed in 1.0.0m, 1.0.1h, 10.0.13 · NVD
  24. Medium 6.8

    CVE-2014-0195 · MariaDB, OpenSSL

    The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

    Published 5 Jun 2014 · Fixed in 1.0.0m, 1.0.1h, 10.0.13 · NVD
  25. Medium 5.0

    CVE-2013-1818 · MediaWiki

    maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.

    Published 2 Jun 2014 · NVD
  26. Medium 6.8

    CVE-2012-5395 · MediaWiki

    Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie.

    Published 2 Jun 2014 · NVD
  27. Medium 6.8

    CVE-2012-5391 · MediaWiki

    Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.

    Published 2 Jun 2014 · NVD
  28. Medium 5.0

    CVE-2014-0238 · PHP

    The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.

    Published 1 Jun 2014 · Fixed in 5.3.29, 5.4.29, 5.5.13 · NVD
  29. Medium 5.0

    CVE-2014-0237 · PHP

    The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.

    Published 1 Jun 2014 · Fixed in 5.3.29, 5.4.29, 5.5.13 · NVD
  30. Medium 4.3

    CVE-2014-0119 · Apache Tomcat

    Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue,…

    Published 31 May 2014 · NVD
  31. Medium 4.3

    CVE-2014-0099 · Apache Tomcat

    Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

    Published 31 May 2014 · NVD
  32. Medium 4.3

    CVE-2014-0096 · Apache Tomcat

    java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity…

    Published 31 May 2014 · NVD
  33. Medium 5.0

    CVE-2014-0095 · Apache Tomcat

    java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.

    Published 31 May 2014 · NVD
  34. Medium 5.0

    CVE-2014-0075 · Apache Tomcat

    Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

    Published 31 May 2014 · NVD
  35. Unrated

    WPV-f4afdd785a17 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 31 May 2014 · Fixed in 2.2.5 · WPVulnerability
  36. Unrated

    WPV-797c57d433a6 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 31 May 2014 · Fixed in 2.1.6 · WPVulnerability
  37. Unrated

    WPV-47ebb01c66d9 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 31 May 2014 · Fixed in 2.1.6 · WPVulnerability
  38. Medium 4.3

    CVE-2013-7040 · Python

    Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists…

    Published 19 May 2014 · NVD
  39. Medium 6.5

    CVE-2013-4489 · GitLab

    The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.

    Published 17 May 2014 · NVD
  40. High 10.0

    CVE-2014-2405 · Java

    Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.

    Published 14 May 2014 · NVD
  41. High 10.0

    CVE-2014-0462 · Java

    Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.

    Published 14 May 2014 · NVD
  42. Medium 4.3

    CVE-2014-3456 · GitLab

    Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 13 May 2014 · NVD
  43. Medium 6.5

    CVE-2013-4546 · GitLab

    The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.

    Published 13 May 2014 · NVD
  44. Medium 6.5

    CVE-2013-4490 · GitLab

    The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.

    Published 13 May 2014 · NVD
  45. Medium 6.8

    CVE-2012-6342 · Confluence

    Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment.

    Published 13 May 2014 · NVD
  46. Medium 6.8

    CVE-2014-3455 · MediaWiki

    Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.

    Published 12 May 2014 · NVD
  47. Medium 6.8

    CVE-2014-3454 · MediaWiki

    Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vectors.

    Published 12 May 2014 · NVD
  48. Medium 5.0

    CVE-2013-6472 · MediaWiki

    MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.

    Published 12 May 2014 · NVD
  49. Medium 4.3

    CVE-2013-6454 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.

    Published 12 May 2014 · NVD
  50. High 7.5

    CVE-2013-6453 · MediaWiki

    MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.

    Published 12 May 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.