UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
12,758
Published in 7 days
561
Critical in 30 days
124
Actively exploited
67

Latest vulnerabilities

12,758 vulnerabilities
  1. Medium 4.3

    CVE-2014-3470 · MariaDB, OpenSSL

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

    Published 5 Jun 2014 · Fixed in 1.0.0m, 1.0.1h, 10.0.13 · NVD
  2. High 7.4

    CVE-2014-0224 · MariaDB, Node.js, OpenSSL and 1 more

    OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

    Published 5 Jun 2014 · Fixed in 2.7.8, 3.4.2, 10.0.13 · NVD
  3. Medium 4.3

    CVE-2014-0221 · MariaDB, OpenSSL

    The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

    Published 5 Jun 2014 · Fixed in 1.0.0m, 1.0.1h, 10.0.13 · NVD
  4. Medium 6.8

    CVE-2014-0195 · MariaDB, OpenSSL

    The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

    Published 5 Jun 2014 · Fixed in 1.0.0m, 1.0.1h, 10.0.13 · NVD
  5. Medium 5.0

    CVE-2013-1818 · MediaWiki

    maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.

    Published 2 Jun 2014 · NVD
  6. Medium 6.8

    CVE-2012-5395 · MediaWiki

    Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie.

    Published 2 Jun 2014 · NVD
  7. Medium 6.8

    CVE-2012-5391 · MediaWiki

    Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.

    Published 2 Jun 2014 · NVD
  8. Medium 5.0

    CVE-2014-0238 · PHP

    The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.

    Published 1 Jun 2014 · Fixed in 5.3.29, 5.4.29, 5.5.13 · NVD
  9. Medium 5.0

    CVE-2014-0237 · PHP

    The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.

    Published 1 Jun 2014 · Fixed in 5.3.29, 5.4.29, 5.5.13 · NVD
  10. Medium 4.3

    CVE-2014-0119 · Apache Tomcat

    Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue,…

    Published 31 May 2014 · NVD
  11. Medium 4.3

    CVE-2014-0099 · Apache Tomcat

    Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

    Published 31 May 2014 · NVD
  12. Medium 4.3

    CVE-2014-0096 · Apache Tomcat

    java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity…

    Published 31 May 2014 · NVD
  13. Medium 5.0

    CVE-2014-0095 · Apache Tomcat

    java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.

    Published 31 May 2014 · NVD
  14. Medium 5.0

    CVE-2014-0075 · Apache Tomcat

    Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

    Published 31 May 2014 · NVD
  15. Unrated

    WPV-f4afdd785a17 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 31 May 2014 · Fixed in 2.2.5 · WPVulnerability
  16. Unrated

    WPV-797c57d433a6 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 31 May 2014 · Fixed in 2.1.6 · WPVulnerability
  17. Unrated

    WPV-47ebb01c66d9 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 31 May 2014 · Fixed in 2.1.6 · WPVulnerability
  18. Medium 4.3

    CVE-2013-7040 · Python

    Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists…

    Published 19 May 2014 · NVD
  19. Medium 6.5

    CVE-2013-4489 · GitLab

    The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.

    Published 17 May 2014 · NVD
  20. High 10.0

    CVE-2014-2405 · Java

    Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.

    Published 14 May 2014 · NVD
  21. High 10.0

    CVE-2014-0462 · Java

    Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.

    Published 14 May 2014 · NVD
  22. Medium 4.3

    CVE-2014-3456 · GitLab

    Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 13 May 2014 · NVD
  23. Medium 6.5

    CVE-2013-4546 · GitLab

    The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary commands via the import URL.

    Published 13 May 2014 · NVD
  24. Medium 6.5

    CVE-2013-4490 · GitLab

    The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.

    Published 13 May 2014 · NVD
  25. Medium 6.8

    CVE-2012-6342 · Confluence

    Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment.

    Published 13 May 2014 · NVD
  26. Medium 6.8

    CVE-2014-3455 · MediaWiki

    Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.

    Published 12 May 2014 · NVD
  27. Medium 6.8

    CVE-2014-3454 · MediaWiki

    Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vectors.

    Published 12 May 2014 · NVD
  28. Medium 5.0

    CVE-2013-6472 · MediaWiki

    MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.

    Published 12 May 2014 · NVD
  29. Medium 4.3

    CVE-2013-6454 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.

    Published 12 May 2014 · NVD
  30. High 7.5

    CVE-2013-6453 · MediaWiki

    MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.

    Published 12 May 2014 · NVD
  31. Medium 4.3

    CVE-2013-6452 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.

    Published 12 May 2014 · NVD
  32. Medium 6.8

    CVE-2013-4581 · GitLab

    GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a crafted change using SSH.

    Published 12 May 2014 · NVD
  33. Medium 6.8

    CVE-2013-4580 · GitLab

    GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.

    Published 12 May 2014 · NVD
  34. Medium 4.3

    CVE-2013-4574 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos.

    Published 12 May 2014 · NVD
  35. High 7.5

    CVE-2013-4571 · MediaWiki

    Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.

    Published 12 May 2014 · NVD
  36. Medium 5.0

    CVE-2013-4570 · MediaWiki

    The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function.

    Published 12 May 2014 · NVD
  37. Medium 4.3

    CVE-2014-0198 · MariaDB, OpenSSL

    The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

    Published 6 May 2014 · Fixed in 10.0.13 · NVD
  38. High 7.2

    CVE-2014-0185 · PHP

    sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.

    Published 6 May 2014 · Fixed in 5.3.28, 5.4.28, 5.5.12 · NVD
  39. Medium 4.3

    CVE-2014-2853 · MediaWiki

    Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.

    Published 29 Apr 2014 · NVD
  40. High 7.5

    CVE-2014-0088 · nginx

    The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.

    Published 29 Apr 2014 · NVD
  41. Medium 5.8

    CVE-2014-2734 · Ruby

    The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the…

    Published 24 Apr 2014 · NVD
  42. Medium 5.0

    CVE-2011-5279 · Microsoft IIS

    CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.

    Published 23 Apr 2014 · NVD
  43. High 7.1

    CVE-2013-7338 · Python

    Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

    Published 22 Apr 2014 · NVD
  44. Medium 4.0

    CVE-2014-2665 · MediaWiki

    includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the…

    Published 20 Apr 2014 · NVD
  45. Medium 4.0

    CVE-2014-2522 · curl

    curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid…

    Published 18 Apr 2014 · NVD
  46. Low 3.5

    CVE-2014-2451 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges.

    Published 16 Apr 2014 · NVD
  47. Medium 4.0

    CVE-2014-2450 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 16 Apr 2014 · NVD
  48. Medium 6.5

    CVE-2014-2444 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB.

    Published 16 Apr 2014 · NVD
  49. Medium 4.0

    CVE-2014-2442 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to MyISAM.

    Published 16 Apr 2014 · NVD
  50. Medium 5.1

    CVE-2014-2440 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 16 Apr 2014 · Fixed in 5.5.37, 10.0.11 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.