UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,928
Published in 7 days
1,033
Critical in 30 days
362
Actively exploited
423

Latest vulnerabilities

39,928 vulnerabilities
  1. Medium 5.6

    CVE-2018-1695 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 145769.

    Published 6 Sept 2018 · NVD
  2. High 7.8

    CVE-2018-16585 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source…

    Published 6 Sept 2018 · Fixed in 9.24 · NVD
  3. High 8.8

    CVE-2017-1000600 · WordPress

    WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely…

    Published 6 Sept 2018 · Fixed in 4.9 · NVD
  4. Critical 9.8

    CVE-2018-14618 · curl

    curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On…

    Published 5 Sept 2018 · Fixed in 7.61.1 · NVD
  5. High 7.8

    CVE-2018-16543 · Ghostscript

    In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  6. Medium 5.5

    CVE-2018-16542 · Ghostscript

    In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  7. Medium 5.5

    CVE-2018-16541 · Ghostscript

    In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  8. High 7.8

    CVE-2018-16540 · Ghostscript

    In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  9. Medium 5.5

    CVE-2018-16539 · Ghostscript

    In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  10. Medium 5.9

    CVE-2018-9194 · Fortinet FortiOS

    A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.

    Published 5 Sept 2018 · NVD
  11. Medium 5.9

    CVE-2018-9192 · Fortinet FortiOS

    A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.

    Published 5 Sept 2018 · NVD
  12. High 7.8

    CVE-2018-16513 · Ghostscript

    In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  13. High 7.8

    CVE-2018-16511 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  14. High 7.8

    CVE-2018-16510 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  15. High 7.8

    CVE-2018-16509 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.

    Published 5 Sept 2018 · Fixed in 9.24 · NVD
  16. Medium 6.1

    CVE-2018-0672 · Movable Type

    Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 4 Sept 2018 · Fixed in 6.3.1 · NVD
  17. Critical 9.8

    CVE-2018-20979 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 4 Sept 2018 · Fixed in 5.0.4 · NVD, WPVulnerability
  18. High 8.8

    CVE-2018-16413 · ImageMagick

    ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the MagickCore/quantum-private.h PushShortPixel function when called from the coders/psd.c ParseImageResourceBlocks function.

    Published 3 Sept 2018 · NVD
  19. High 8.8

    CVE-2018-16412 · ImageMagick

    ImageMagick 7.0.8-11 Q16 has a heap-based buffer over-read in the coders/psd.c ParseImageResourceBlocks function.

    Published 3 Sept 2018 · NVD
  20. High 8.6

    CVE-2018-16409 · Gogs

    In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.

    Published 3 Sept 2018 · NVD
  21. Medium 4.9

    CVE-2018-16397 · LimeSurvey

    In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,

    Published 3 Sept 2018 · Fixed in 3.14.7 · NVD
  22. Critical 9.8

    CVE-2018-16329 · ImageMagick

    In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the GetMagickProperty function in MagickCore/property.c.

    Published 1 Sept 2018 · Fixed in 7.0.8-8 · NVD
  23. Critical 9.8

    CVE-2018-16328 · ImageMagick

    In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c.

    Published 1 Sept 2018 · Fixed in 7.0.8-8 · NVD
  24. Medium 6.5

    CVE-2018-16323 · ImageMagick

    ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If the affected code is used as a library loaded into a process that includes sensitive information, that information sometimes can be leaked via the image data.

    Published 1 Sept 2018 · Fixed in 6.9.10-9, 7.0.8-9 · NVD
  25. Medium 5.4

    CVE-2018-16316 · Portainer

    A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.

    Published 1 Sept 2018 · NVD
  26. High 8.8

    CVE-2018-15514 · Docker Engine

    HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\.\pipe\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the "docker-users" group (who may not otherwise have administrator access) to escalate to administrator privileges.

    Published 1 Sept 2018 · NVD
  27. Unrated

    WPV-0341df8ecd69 · WooCommerce

    Vulnerability in WooCommerce

    Published 1 Sept 2018 · Fixed in 3.4.5 · WPVulnerability
  28. Medium 6.1

    CVE-2018-16236 · cPanel & WHM

    cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.

    Published 30 Aug 2018 · NVD
  29. Critical 9.8

    CVE-2018-15727 · Grafana

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

    Published 29 Aug 2018 · Fixed in 4.6.4, 5.2.3 · NVD
  30. Medium 5.3

    CVE-2018-8040 · Apache Traffic Server

    Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

    Published 29 Aug 2018 · NVD
  31. High 7.5

    CVE-2018-8022 · Apache Traffic Server

    A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.

    Published 29 Aug 2018 · NVD
  32. Medium 5.3

    CVE-2018-8005 · Apache Traffic Server

    When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

    Published 29 Aug 2018 · NVD
  33. Medium 6.5

    CVE-2018-8004 · Apache Traffic Server

    There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

    Published 29 Aug 2018 · NVD
  34. High 7.5

    CVE-2018-1318 · Apache Traffic Server

    Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

    Published 29 Aug 2018 · NVD
  35. Medium 5.3

    CVE-2018-12807 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulnerability. Successful exploitation could lead to unauthorized information modification.

    Published 29 Aug 2018 · NVD
  36. Medium 6.1

    CVE-2018-12806 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Aug 2018 · NVD
  37. Critical 9.8

    CVE-2018-15882 · Joomla!

    An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter.

    Published 29 Aug 2018 · Fixed in 3.8.12 · NVD
  38. High 7.5

    CVE-2018-15881 · Joomla!

    An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation.

    Published 29 Aug 2018 · Fixed in 3.8.12 · NVD
  39. Medium 5.4

    CVE-2018-15880 · Joomla!

    An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.

    Published 29 Aug 2018 · Fixed in 3.8.12 · NVD
  40. Unrated

    WPV-48c496680d14 · WooCommerce

    Vulnerability in WooCommerce

    Published 29 Aug 2018 · Fixed in 3.4.5 · WPVulnerability
  41. Medium 6.1

    CVE-2018-15596 · MyBB

    An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles (within title elements of the generated XML documents) aren't sanitized, leading to XSS.

    Published 28 Aug 2018 · NVD
  42. High 8.8

    CVE-2017-15412 · libxml2

    Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Published 28 Aug 2018 · Fixed in 2.9.5 · NVD
  43. Medium 6.1

    CVE-2018-13395 · Jira

    Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the epic colour field of an issue…

    Published 28 Aug 2018 · Fixed in 7.9.3, 7.10.3, 7.11.1 · NVD
  44. Medium 5.3

    CVE-2018-13391 · Jira

    The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote attackers who can access & view an issue to obtain the email address of the reporter and assignee…

    Published 28 Aug 2018 · Fixed in 7.9.3, 7.10.3, 7.11.2 · NVD
  45. Medium 5.3

    CVE-2018-15919 · OpenSSH

    Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

    Published 28 Aug 2018 · NVD
  46. High 7.8

    CVE-2018-15911 · Ghostscript

    In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.

    Published 28 Aug 2018 · NVD
  47. High 7.8

    CVE-2018-15910 · Ghostscript

    In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code.

    Published 27 Aug 2018 · Fixed in 9.24 · NVD
  48. High 7.8

    CVE-2018-15909 · Ghostscript

    In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.

    Published 27 Aug 2018 · NVD
  49. High 7.8

    CVE-2018-15908 · Ghostscript

    In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files.

    Published 27 Aug 2018 · NVD
  50. Critical 9.8

    CVE-2014-10074 · Umbraco CMS

    Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.

    Published 27 Aug 2018 · Fixed in 7.2.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.