UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,795
Published in 7 days
548
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,795 vulnerabilities
  1. Medium 5.4

    CVE-2023-43876 · October CMS

    A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.

    Published 28 Sept 2023 · NVD
  2. Medium 4.3

    CVE-2023-43664 · PrestaShop

    Employee without any access rights can list all installed modules

    Published 28 Sept 2023 · Fixed in 8.1, 8.1.2 · NVD, Project advisories (GitHub)
  3. Medium 4.3

    CVE-2023-43663 · PrestaShop

    Uninstall modules from backoffice, even with low rights

    Published 28 Sept 2023 · Fixed in 8.1.1, 8.1.2 · NVD, Project advisories (GitHub)
  4. Medium 5.4

    CVE-2023-44276 · OPNsense

    OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.

    Published 28 Sept 2023 · Fixed in 23.7.5 · NVD
  5. Medium 5.4

    CVE-2023-44275 · OPNsense

    OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.

    Published 28 Sept 2023 · Fixed in 23.7.5 · NVD
  6. High 8.8

    CVE-2023-43320 · Proxmox VE

    An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component.

    Published 27 Sept 2023 · NVD
  7. High 8.2

    CVE-2023-43125 · F5 BIG-IP

    BIG-IP APM clients may send IP traffic outside of the VPN tunnel.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 27 Sept 2023 · NVD
  8. High 7.1

    CVE-2023-43124 · F5 BIG-IP

    BIG-IP APM clients may send IP traffic outside of the VPN tunnel.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 27 Sept 2023 · NVD
  9. Medium 4.3

    CVE-2023-40026 · Argo CD

    Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

    Published 27 Sept 2023 · Fixed in 2.3.0, 2.3 · NVD, Project advisories (GitHub)
  10. High 7.5

    CVE-2023-5157 · MariaDB

    A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.

    Published 27 Sept 2023 · Fixed in 10.6.9, 10.7.5, 10.8.4 · NVD
  11. Critical 9.6

    CVE-2023-42657 · WS_FTP Server

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path.  Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations…

    Published 27 Sept 2023 · Fixed in 8.7.4, 8.8.2 · NVD
  12. Critical 9.1

    CVE-2023-42462 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  13. Critical 9.8

    CVE-2023-42461 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  14. Medium 5.4

    CVE-2023-41888 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to transmit a malicious URL of login page that can be used to attempt a phishing attack on user credentials. Users are advised to upgrade to…

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  15. High 8.8

    CVE-2023-41326 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with stealing its account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for…

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  16. High 8.8

    CVE-2023-41324 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  17. Medium 5.3

    CVE-2023-41323 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  18. High 8.8

    CVE-2023-41322 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter's password and then take control of their account. Users are advised to upgrade to version 10.0.10. There are no known work…

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  19. Medium 6.5

    CVE-2023-41321 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user can enumerate sensitive fields values on resources on which he has read access. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  20. Critical 9.8

    CVE-2023-41320 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to takeover an administrator account. Users are advised to upgrade to version 10.0.10. There are no known…

    Published 27 Sept 2023 · Fixed in 10.0.10 · NVD
  21. Medium 5.3

    CVE-2023-40049 · WS_FTP Server

    In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.

    Published 27 Sept 2023 · Fixed in 8.8.2 · NVD
  22. Medium 6.5

    CVE-2023-40048 · WS_FTP Server

    In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.

    Published 27 Sept 2023 · Fixed in 8.8.2 · NVD
  23. Medium 4.8

    CVE-2023-40047 · WS_FTP Server

    In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads.  Once the cross-site scripting payload is successfully stored,  an attacker could leverage this vulnerability to target…

    Published 27 Sept 2023 · Fixed in 8.8.2 · NVD
  24. High 7.2

    CVE-2023-40046 · WS_FTP Server

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

    Published 27 Sept 2023 · Fixed in 8.7.4, 8.8.2 · NVD
  25. Medium 6.1

    CVE-2023-40045 · WS_FTP Server

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module.  An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.

    Published 27 Sept 2023 · Fixed in 8.7.4, 8.8.2 · NVD
  26. High 8.8Actively exploited

    CVE-2023-40044 · WS_FTP Server

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

    Published 27 Sept 2023 · Fixed in 8.7.4, 8.8.2 · NVD
  27. High 8.8

    CVE-2023-2315 · OpenCart

    Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server

    Published 27 Sept 2023 · NVD
  28. High 7.5

    CVE-2023-46728 · Squid

    SQUID-2021:8 Denial of Service in Gopher gateway

    Published 27 Sept 2023 · Fixed in 6.0.1 · NVD, Project advisories (GitHub)
  29. High 7.5

    CVE-2023-5156 · GNU C Library

    A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

    Published 25 Sept 2023 · Fixed in 2.39 · NVD
  30. High 7.3

    CVE-2023-3550 · MediaWiki

    Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.

    Published 25 Sept 2023 · NVD
  31. High 8.8

    CVE-2023-5002 · pgAdmin

    A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

    Published 22 Sept 2023 · Fixed in 7.7 · NVD
  32. High 7.8

    CVE-2023-34319 · Xen

    The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to…

    Published 22 Sept 2023 · NVD
  33. Medium 6.1Actively exploited

    CVE-2023-43770 · Roundcube

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

    Published 22 Sept 2023 · Fixed in 1.4.14, 1.5.4, 1.6.3 · NVD
  34. High 8.8Actively exploited

    CVE-2023-41993 · Java

    The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

    Published 21 Sept 2023 · NVD
  35. Medium 4.8

    CVE-2023-43309 · Webmin

    There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.

    Published 21 Sept 2023 · NVD
  36. Medium 6.1

    CVE-2018-5478 · Contao

    Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

    Published 21 Sept 2023 · Fixed in 3.5.32 · NVD
  37. High 8.1

    CVE-2023-43498 · Jenkins

    In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.

    Published 20 Sept 2023 · Fixed in 2.414.2, 2.424 · NVD
  38. High 8.1

    CVE-2023-43497 · Jenkins

    In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.

    Published 20 Sept 2023 · Fixed in 2.414.2, 2.424 · NVD
  39. High 8.8

    CVE-2023-43496 · Jenkins

    Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

    Published 20 Sept 2023 · Fixed in 2.414.2, 2.424 · NVD
  40. Medium 5.4

    CVE-2023-43495 · Jenkins

    Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.

    Published 20 Sept 2023 · Fixed in 2.414.2, 2.424 · NVD
  41. Medium 4.3

    CVE-2023-43494 · Jenkins

    Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.

    Published 20 Sept 2023 · Fixed in 2.414.2, 2.424 · NVD
  42. High 8.8

    CVE-2023-42660 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer machine interface that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to the MOVEit Transfer machine…

    Published 20 Sept 2023 · Fixed in 2022.0.8, 2022.1.9, 2023.0.6 · NVD
  43. Medium 6.1

    CVE-2023-42656 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a reflected cross-site scripting (XSS) vulnerability has been identified in MOVEit Transfer's web interface.  An attacker could craft a malicious payload targeting MOVEit Transfer users during the package composition procedure.  If a MOVEit user interacts with the…

    Published 20 Sept 2023 · Fixed in 2022.0.8, 2022.1.9, 2023.0.6 · NVD
  44. High 7.2

    CVE-2023-40043 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), 2023.0.6 (15.0.6), a SQL injection vulnerability has been identified in the MOVEit Transfer web interface that could allow a MOVEit system administrator account to gain unauthorized access to the MOVEit Transfer database. A MOVEit system administrator could submit a crafted payload to…

    Published 20 Sept 2023 · Fixed in 2022.0.8, 2022.1.9, 2023.0.6 · NVD
  45. High 7.5

    CVE-2023-4236 · BIND 9

    A flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure. This happens when internal data structures are incorrectly reused under significant DNS-over-TLS query load. This issue affects BIND 9 versions 9.18.0 through 9.18.18 and 9.18.11-S1 through 9.18.18-S1.

    Published 20 Sept 2023 · Fixed in 9.18.18 · NVD
  46. High 7.5

    CVE-2023-3341 · BIND 9

    The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully…

    Published 20 Sept 2023 · Fixed in 9.16.44, 9.18.19, 9.19.17 · NVD
  47. Critical 9.0

    CVE-2023-0829 · Plesk

    Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription.

    Published 20 Sept 2023 · NVD
  48. Medium 6.1

    CVE-2023-5084 · Hestia Control Panel

    Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.

    Published 20 Sept 2023 · Fixed in 1.8.8 · NVD
  49. Critical 9.6

    CVE-2023-38888 · Dolibarr ERP CRM

    Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

    Published 20 Sept 2023 · NVD
  50. High 8.8

    CVE-2023-38887 · Dolibarr ERP CRM

    File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.

    Published 20 Sept 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.