UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,928
Published in 7 days
1,033
Critical in 30 days
362
Actively exploited
423

Latest vulnerabilities

39,928 vulnerabilities
  1. High 7.5

    CVE-2018-8292 · .NET

    An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

    Published 10 Oct 2018 · NVD
  2. High 7.8

    CVE-2018-8265 · Microsoft Exchange Server

    A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.

    Published 10 Oct 2018 · NVD
  3. Critical 9.8

    CVE-2018-18200 · REDAXO

    There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

    Published 9 Oct 2018 · Fixed in 5.6.4 · NVD
  4. Medium 6.1

    CVE-2018-18199 · REDAXO

    Mediamanager in REDAXO before 5.6.4 has XSS.

    Published 9 Oct 2018 · Fixed in 5.6.4 · NVD
  5. Medium 6.1

    CVE-2018-18198 · REDAXO

    The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request.

    Published 9 Oct 2018 · NVD
  6. Medium 4.3

    CVE-2018-17859 · Joomla!

    An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabled forms.

    Published 9 Oct 2018 · Fixed in 3.8.13 · NVD
  7. High 8.8

    CVE-2018-17858 · Joomla!

    An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend.

    Published 9 Oct 2018 · Fixed in 3.8.13 · NVD
  8. Medium 4.3

    CVE-2018-17857 · Joomla!

    An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation.

    Published 9 Oct 2018 · Fixed in 3.8.13 · NVD
  9. High 7.2

    CVE-2018-17856 · Joomla!

    An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.

    Published 9 Oct 2018 · Fixed in 3.8.13 · NVD
  10. High 8.8

    CVE-2018-17855 · Joomla!

    An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.

    Published 9 Oct 2018 · Fixed in 3.8.13 · NVD
  11. Medium 6.5

    CVE-2018-6977 · VMware ESXi

    VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader. Successfully exploiting this issue may allow an attacker with normal user privileges in the guest to make the VM unresponsive, and in some cases, possibly result other VMs on the host or the host itself becoming…

    Published 9 Oct 2018 · NVD
  12. High 7.5

    CVE-2016-7475 · F5 BIG-IP

    Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not properly clean-up pool member network connections when using SPDY or HTTP/2 virtual server profiles.

    Published 8 Oct 2018 · NVD
  13. Medium 6.5

    CVE-2018-18065 · Palo Alto Networks PAN-OS

    _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

    Published 8 Oct 2018 · NVD
  14. Critical 9.8

    CVE-2018-1000810 · Rust

    The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard library that can result in buffer overflow. This attack appear to be exploitable via str::repeat, passed a large number, can overflow an internal buffer. This vulnerability appears to have been fixed in…

    Published 8 Oct 2018 · NVD
  15. Medium 5.3

    CVE-2018-1000803 · Gitea

    Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.

    Published 8 Oct 2018 · Fixed in 1.5.1 · NVD
  16. Medium 6.5

    CVE-2018-18025 · ImageMagick

    In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file.

    Published 7 Oct 2018 · NVD
  17. Medium 6.5

    CVE-2018-18024 · ImageMagick

    In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

    Published 7 Oct 2018 · NVD
  18. Medium 6.5

    CVE-2018-18023 · ImageMagick

    In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.

    Published 7 Oct 2018 · NVD
  19. Medium 6.5

    CVE-2018-18016 · ImageMagick

    ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.

    Published 5 Oct 2018 · NVD
  20. Medium 6.8

    CVE-2018-15399 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust the 1550-byte buffers on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a missing boundary check in an internal function. An attacker could…

    Published 5 Oct 2018 · NVD
  21. Medium 4.0

    CVE-2018-15398 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass an access control list (ACL) that is configured for an interface of an affected device. The vulnerability is due to errors that could occur when the affected software constructs and applies…

    Published 5 Oct 2018 · NVD
  22. Medium 6.8

    CVE-2018-15397 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error that…

    Published 5 Oct 2018 · NVD
  23. High 7.5

    CVE-2018-15383 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of…

    Published 5 Oct 2018 · NVD
  24. High 7.8

    CVE-2018-17984 · ISPConfig

    An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.

    Published 4 Oct 2018 · Fixed in 3.1.13 · NVD
  25. Medium 5.3

    CVE-2018-13258 · MediaWiki

    Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible.

    Published 4 Oct 2018 · NVD
  26. Medium 6.5

    CVE-2018-0505 · MediaWiki

    Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock

    Published 4 Oct 2018 · Fixed in 1.31.1 · NVD
  27. Medium 6.5

    CVE-2018-0504 · MediaWiki

    Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid

    Published 4 Oct 2018 · Fixed in 1.31.1 · NVD
  28. Medium 4.3

    CVE-2018-0503 · MediaWiki

    Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'.

    Published 4 Oct 2018 · Fixed in 1.31.1 · NVD
  29. Medium 4.3

    CVE-2018-11784 · Apache Tomcat

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

    Published 4 Oct 2018 · NVD
  30. Medium 6.5

    CVE-2018-17967 · ImageMagick

    ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c.

    Published 3 Oct 2018 · NVD
  31. Medium 6.5

    CVE-2018-17966 · ImageMagick

    ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c.

    Published 3 Oct 2018 · NVD
  32. Medium 6.5

    CVE-2018-17965 · ImageMagick

    ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c.

    Published 3 Oct 2018 · NVD
  33. Medium 6.5

    CVE-2018-16051 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload Files Exposure.

    Published 3 Oct 2018 · Fixed in 11.0.6, 11.1.5, 11.2.2 · NVD
  34. Medium 6.1

    CVE-2018-16050 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.

    Published 3 Oct 2018 · Fixed in 11.1.5, 11.2.2 · NVD
  35. Critical 9.8

    CVE-2018-16049 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Logs through an Error Message.

    Published 3 Oct 2018 · Fixed in 11.0.6, 11.1.5, 11.2.2 · NVD
  36. Medium 6.5

    CVE-2018-16048 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorization Control for API Repository Storage.

    Published 3 Oct 2018 · Fixed in 11.0.6, 11.1.5, 11.2.2 · NVD
  37. Medium 6.1

    CVE-2018-1794 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148949.

    Published 3 Oct 2018 · NVD
  38. Medium 6.1

    CVE-2018-1793 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148948.

    Published 3 Oct 2018 · NVD
  39. Medium 5.3

    CVE-2018-17938 · Zimbra Collaboration

    Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.

    Published 3 Oct 2018 · Fixed in 8.8.10 · NVD
  40. Unrated

    WPV-b0684bf7a8f8 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 2 Oct 2018 · Fixed in 7.1.14 · WPVulnerability
  41. Critical 9.8

    CVE-2018-17831 · REDAXO

    In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rex_list were used.

    Published 1 Oct 2018 · Fixed in 5.6.3 · NVD
  42. Medium 5.4

    CVE-2018-17830 · REDAXO

    The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=&args[ substring.

    Published 1 Oct 2018 · NVD
  43. High 8.8

    CVE-2018-16055 · pfSense

    An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr" and "ipv" to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root…

    Published 26 Sept 2018 · Fixed in 2.4.4 · NVD
  44. High 7.5

    CVE-2018-1683 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. IBM X-Force ID: 145455.

    Published 26 Sept 2018 · Fixed in 18.0.0.3 · NVD
  45. High 7.8Actively exploited

    CVE-2018-14634 · F5 BIG-IP, Palo Alto Networks PAN-OS

    An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

    Published 25 Sept 2018 · Fixed in 13.1.1.5, 14.0.1.1, 14.1.0.6 · NVD
  46. Medium 5.9

    CVE-2018-11763 · Apache HTTP Server

    In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

    Published 25 Sept 2018 · NVD
  47. Critical 9.8

    CVE-2018-15965 · Adobe ColdFusion

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 25 Sept 2018 · NVD
  48. High 7.5

    CVE-2018-15964 · Adobe ColdFusion

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure.

    Published 25 Sept 2018 · NVD
  49. Medium 5.3

    CVE-2018-15963 · Adobe ColdFusion

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation.

    Published 25 Sept 2018 · NVD
  50. Medium 5.3

    CVE-2018-15962 · Adobe ColdFusion

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful exploitation could lead to information disclosure.

    Published 25 Sept 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.