UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,928
Published in 7 days
1,033
Critical in 30 days
362
Actively exploited
423

Latest vulnerabilities

39,928 vulnerabilities
  1. High 7.2

    CVE-2018-13790 · Concrete CMS

    A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.

    Published 9 Jul 2018 · NVD
  2. High 7.2

    CVE-2018-1000623 · JFrog Artifactory

    JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint (/ui/artifactimport/upload) that can result in Directory traversal / file overwrite and remote code execution. This attack…

    Published 9 Jul 2018 · Fixed in 6.0.3 · NVD
  3. High 7.8

    CVE-2018-1000622 · Rust

    The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.

    Published 9 Jul 2018 · NVD
  4. Critical 9.8

    CVE-2018-1000613 · Oracle WebLogic Server

    Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack…

    Published 9 Jul 2018 · NVD
  5. Medium 6.5

    CVE-2018-13785 · Java

    In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

    Published 9 Jul 2018 · NVD
  6. Critical 9.1

    CVE-2018-13784 · PrestaShop

    PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.

    Published 9 Jul 2018 · Fixed in 1.6.1.20, 1.7.3.4 · NVD
  7. Critical 9.8

    CVE-2018-13450 · Dolibarr ERP CRM

    SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.

    Published 8 Jul 2018 · NVD
  8. Critical 9.8

    CVE-2018-13449 · Dolibarr ERP CRM

    SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.

    Published 8 Jul 2018 · NVD
  9. Critical 9.8

    CVE-2018-13448 · Dolibarr ERP CRM

    SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.

    Published 8 Jul 2018 · NVD
  10. Critical 9.8

    CVE-2018-13447 · Dolibarr ERP CRM

    SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.

    Published 8 Jul 2018 · NVD
  11. Medium 5.3

    CVE-2018-10892 · Docker Engine

    The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

    Published 6 Jul 2018 · NVD
  12. Medium 6.7

    CVE-2018-1621 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346.

    Published 6 Jul 2018 · NVD
  13. High 7.8

    CVE-2018-13405 · F5 BIG-IP

    The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the…

    Published 6 Jul 2018 · Fixed in 13.1.3.5, 14.1.3.1, 15.0.1.4 · NVD
  14. High 8.1

    CVE-2018-13305 · FFmpeg

    In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.

    Published 5 Jul 2018 · NVD
  15. Medium 6.5

    CVE-2018-13304 · FFmpeg

    In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.

    Published 5 Jul 2018 · NVD
  16. Medium 6.5

    CVE-2018-13303 · FFmpeg

    In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.

    Published 5 Jul 2018 · NVD
  17. High 8.8

    CVE-2018-13302 · FFmpeg

    In FFmpeg 4.0.1, improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to a denial of service or possibly unspecified other impact.

    Published 5 Jul 2018 · NVD
  18. Medium 6.5

    CVE-2018-13301 · FFmpeg

    In FFmpeg 4.0.1, due to a missing check of a profile value before setting it, the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service.

    Published 5 Jul 2018 · NVD
  19. High 8.1

    CVE-2018-13300 · FFmpeg

    In FFmpeg 3.2 and 4.0.1, an improper argument (AVCodecParameters) passed to the avpriv_request_sample function in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information disclosure.

    Published 5 Jul 2018 · NVD
  20. Medium 4.3

    CVE-2018-3762 · Nextcloud

    Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

    Published 5 Jul 2018 · Fixed in 12.0.8, 13.0.3 · NVD
  21. High 8.1

    CVE-2018-3761 · Nextcloud

    Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

    Published 5 Jul 2018 · Fixed in 12.0.8, 13.0.3 · NVD
  22. Medium 5.5

    CVE-2018-8026 · Apache Solr

    This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols…

    Published 5 Jul 2018 · NVD
  23. High 8.1

    CVE-2018-9185 · Fortinet FortiOS

    An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature.

    Published 5 Jul 2018 · NVD
  24. Medium 6.5

    CVE-2018-13153 · ImageMagick

    In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.

    Published 5 Jul 2018 · NVD
  25. Medium 5.4

    CVE-2018-9337 · Palo Alto Networks PAN-OS

    The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.

    Published 3 Jul 2018 · NVD
  26. Medium 5.4

    CVE-2018-9335 · Palo Alto Networks PAN-OS

    The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML.

    Published 3 Jul 2018 · NVD
  27. Medium 5.5

    CVE-2018-9334 · Palo Alto Networks PAN-OS

    The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the GlobalProtect password hashes of local users via manipulation of the HTML markup.

    Published 3 Jul 2018 · NVD
  28. Medium 5.5

    CVE-2018-9242 · Palo Alto Networks PAN-OS

    The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters.

    Published 3 Jul 2018 · NVD
  29. Medium 6.1

    CVE-2018-7636 · Palo Alto Networks PAN-OS

    The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs.

    Published 3 Jul 2018 · NVD
  30. High 7.5

    CVE-2017-0929 · DNN Platform

    DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.

    Published 3 Jul 2018 · Fixed in 9.2.0 · NVD
  31. High 8.1

    CVE-2017-0921 · GitLab

    GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromised.

    Published 3 Jul 2018 · Fixed in 10.1.6, 10.2.6, 10.3.4 · NVD
  32. High 7.5

    CVE-2017-0919 · GitLab

    GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.

    Published 3 Jul 2018 · Fixed in 10.1.6, 10.2.6, 10.3.4 · NVD
  33. Medium 6.1

    CVE-2018-13065 · ModSecurity

    ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured

    Published 3 Jul 2018 · NVD
  34. Critical 9.1

    CVE-2017-2615 · Xen

    Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

    Published 3 Jul 2018 · NVD
  35. High 8.8

    CVE-2018-13067 · OpenCart

    /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.

    Published 2 Jul 2018 · NVD
  36. Medium 6.5

    CVE-2018-12893 · Xen

    An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only…

    Published 2 Jul 2018 · NVD
  37. Critical 9.9

    CVE-2018-12892 · Xen

    An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an…

    Published 2 Jul 2018 · NVD
  38. Medium 6.5

    CVE-2018-12891 · Xen

    An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an…

    Published 2 Jul 2018 · NVD
  39. High 8.8

    CVE-2018-13049 · GLPI

    The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php.

    Published 2 Jul 2018 · NVD
  40. Medium 5.3

    CVE-2018-5528 · F5 BIG-IP

    Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7.

    Published 27 Jun 2018 · NVD
  41. High 7.5

    CVE-2018-5527 · F5 BIG-IP

    On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel (tmm) to leak memory. As a result, system memory usage increases over time, which may eventually cause a decrease in performance or a system reboot due to…

    Published 27 Jun 2018 · NVD
  42. High 7.5

    CVE-2018-1553 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO feature. IBM X-Force ID: 142890.

    Published 27 Jun 2018 · Fixed in 18.0.0.2 · NVD
  43. Medium 5.3

    CVE-2018-12536 · Eclipse Jetty

    In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet…

    Published 27 Jun 2018 · Fixed in 9.3.24, 9.4.11 · NVD
  44. High 7.5

    CVE-2018-1614 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote attacker to obtain sensitive information. IBM X-Force ID: 144270.

    Published 26 Jun 2018 · NVD
  45. High 8.8

    CVE-2018-12895 · WordPress

    WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are…

    Published 26 Jun 2018 · Fixed in 4.9.7 · NVD
  46. High 8.8

    CVE-2018-12712 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.

    Published 26 Jun 2018 · NVD
  47. Medium 6.1

    CVE-2018-12711 · Joomla!

    An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.

    Published 26 Jun 2018 · NVD
  48. Critical 9.8

    CVE-2017-7658 · Eclipse Jetty

    In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on…

    Published 26 Jun 2018 · Fixed in 9.3.24, 9.4.11 · NVD
  49. High 7.5

    CVE-2018-1000538 · MinIO

    Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-(pre)signed requests with large bodies . This vulnerability appears to have been fixed in after commit…

    Published 26 Jun 2018 · Fixed in 2018-05-16t23-35-33z · NVD
  50. High 7.2

    CVE-2018-1000527 · Froxlor

    Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.

    Published 26 Jun 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.