UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,921
Published in 7 days
1,026
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,921 vulnerabilities
  1. Medium 6.7

    CVE-2018-19792 · OpenLiteSpeed

    The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.

    Published 3 Dec 2018 · NVD
  2. Medium 6.5

    CVE-2018-19791 · OpenLiteSpeed

    The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.

    Published 3 Dec 2018 · Fixed in 1.5.0 · NVD
  3. Critical 9.8

    CVE-2018-18649 · GitLab

    An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for remote code execution.

    Published 29 Nov 2018 · Fixed in 11.3.8, 11.4.3 · NVD
  4. Unrated

    WPV-c3dc76e07403 · WooCommerce

    Vulnerability in WooCommerce

    Published 29 Nov 2018 · Fixed in 3.5.2 · WPVulnerability
  5. Medium 4.3

    CVE-2018-12123 · Node.js

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the…

    Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD
  6. High 7.5

    CVE-2018-12122 · Node.js

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

    Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD
  7. High 7.5

    CVE-2018-12121 · Node.js

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load…

    Published 28 Nov 2018 · Fixed in 8.14.0, 10.14.0, 11.3.0 · NVD
  8. High 8.1

    CVE-2018-12120 · Node.js

    Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the…

    Published 28 Nov 2018 · Fixed in 6.15.0 · NVD
  9. High 7.5

    CVE-2018-12116 · Node.js

    Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

    Published 28 Nov 2018 · Fixed in 6.15.0, 8.14.0 · NVD
  10. Medium 5.9

    CVE-2018-16857 · Samba

    Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an…

    Published 28 Nov 2018 · Fixed in 4.9.3 · NVD
  11. Medium 5.9

    CVE-2018-16853 · Samba

    Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12,…

    Published 28 Nov 2018 · Fixed in 4.7.12, 4.8.7, 4.9.3 · NVD
  12. Medium 4.4

    CVE-2018-16852 · Samba

    Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no…

    Published 28 Nov 2018 · Fixed in 4.9.3 · NVD
  13. Medium 6.5

    CVE-2018-16851 · Samba

    Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating…

    Published 28 Nov 2018 · Fixed in 4.7.12, 4.8.7, 4.9.3 · NVD
  14. Medium 6.5

    CVE-2018-16841 · Samba

    Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is…

    Published 28 Nov 2018 · Fixed in 4.7.12, 4.8.7, 4.9.3 · NVD
  15. Medium 6.5

    CVE-2018-14629 · Samba

    A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service.

    Published 28 Nov 2018 · Fixed in 4.7.12, 4.8.7, 4.9.3 · NVD
  16. Medium 4.8

    CVE-2018-17256 · Umbraco CMS

    Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.

    Published 27 Nov 2018 · NVD
  17. High 7.5

    CVE-2018-13376 · Fortinet FortiOS

    An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer response web pages, potentially causing sensitive data to be displayed in the HTTP response.

    Published 27 Nov 2018 · NVD
  18. High 8.8

    CVE-2018-16854 · Moodle

    A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

    Published 26 Nov 2018 · Fixed in 3.3.9, 3.4.6, 3.5.3 · NVD
  19. High 7.1

    CVE-2018-1905 · IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.

    Published 26 Nov 2018 · NVD
  20. High 8.8

    CVE-2018-19520 · PHP

    An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.

    Published 25 Nov 2018 · NVD
  21. High 7.5

    CVE-2018-19518 · PHP

    University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g.,…

    Published 25 Nov 2018 · NVD
  22. High 7.8

    CVE-2018-19477 · Ghostscript

    psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.

    Published 23 Nov 2018 · Fixed in 9.26 · NVD
  23. High 7.8

    CVE-2018-19476 · Ghostscript

    psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.

    Published 23 Nov 2018 · Fixed in 9.26 · NVD
  24. High 7.8

    CVE-2018-19475 · Ghostscript

    psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.

    Published 23 Nov 2018 · Fixed in 9.26 · NVD
  25. Critical 9.8

    CVE-2018-19409 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.

    Published 21 Nov 2018 · Fixed in 9.26 · NVD
  26. High 7.5

    CVE-2018-19396 · PHP

    ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.

    Published 20 Nov 2018 · NVD
  27. High 7.5

    CVE-2018-19395 · PHP

    ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").

    Published 20 Nov 2018 · NVD
  28. Medium 6.1

    CVE-2018-18774 · Control Web Panel

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.

    Published 20 Nov 2018 · NVD
  29. High 8.8

    CVE-2018-18773 · Control Web Panel

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.

    Published 20 Nov 2018 · NVD
  30. High 8.8

    CVE-2018-18772 · Control Web Panel

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.

    Published 20 Nov 2018 · NVD
  31. Critical 9.8

    CVE-2018-19367 · Portainer

    Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.

    Published 20 Nov 2018 · NVD
  32. Unrated

    WPV-deceef5f25eb · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Nov 2018 · Fixed in 9.2.0 · WPVulnerability
  33. Critical 9.8

    CVE-2018-19355 · PrestaShop

    modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a php file via modules/orderfiles/upload.php with auptype equal to product (for upload destinations under modules/productfiles), order (for upload destinations under modules/files), or cart (for upload destinations under…

    Published 19 Nov 2018 · NVD
  34. High 7.2

    CVE-2018-19274 · phpBB

    Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

    Published 17 Nov 2018 · Fixed in 3.2.4 · NVD
  35. High 8.1

    CVE-2018-16396 · Ruby

    An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

    Published 16 Nov 2018 · NVD
  36. Critical 9.8

    CVE-2018-16395 · Ruby

    An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a…

    Published 16 Nov 2018 · NVD
  37. Medium 5.5

    CVE-2018-1797 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as…

    Published 16 Nov 2018 · NVD
  38. High 8.8

    CVE-2018-19296 · PHPMailer, WordPress

    PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

    Published 16 Nov 2018 · Fixed in 5.2.27, 6.0.6 · NVD
  39. Medium 4.7

    CVE-2018-5407 · Node.js, OpenSSL

    Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

    Published 15 Nov 2018 · Fixed in 6.14.4, 8.11.4, 10.9.0 · NVD
  40. High 7.2

    CVE-2018-16621 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.

    Published 15 Nov 2018 · Fixed in 3.14.0 · NVD
  41. High 7.5

    CVE-2018-16620 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.

    Published 15 Nov 2018 · Fixed in 3.14.0 · NVD
  42. Medium 6.1

    CVE-2018-16619 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager before 3.14 allows XSS.

    Published 15 Nov 2018 · Fixed in 3.14.0 · NVD
  43. Medium 6.1

    CVE-2018-1643 · IBM WebSphere Application Server

    The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144588

    Published 15 Nov 2018 · NVD
  44. Medium 6.1

    CVE-2018-0697 · Metabase

    Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 15 Nov 2018 · NVD
  45. Medium 6.1

    CVE-2018-15714 · Nagios XI

    Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.

    Published 14 Nov 2018 · NVD
  46. Medium 5.4

    CVE-2018-15713 · Nagios XI

    Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.

    Published 14 Nov 2018 · NVD
  47. Medium 6.1

    CVE-2018-15712 · Nagios XI

    Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.

    Published 14 Nov 2018 · NVD
  48. High 8.8

    CVE-2018-15711 · Nagios XI

    Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.

    Published 14 Nov 2018 · NVD
  49. High 7.8

    CVE-2018-15710 · Nagios XI

    Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.

    Published 14 Nov 2018 · NVD
  50. High 8.8

    CVE-2018-15709 · Nagios XI

    Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.

    Published 14 Nov 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.