Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,928
- Published in 7 days
- 1,033
- Critical in 30 days
- 362
- Actively exploited
- 423
Latest vulnerabilities
39,928 vulnerabilities- Medium 6.5
CVE-2017-0369 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - Medium 5.3
CVE-2017-0368 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - High 8.8
CVE-2017-0367 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - Medium 5.4
CVE-2017-0366 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - Medium 4.7
CVE-2017-0365 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - Medium 6.1
CVE-2017-0364 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - Medium 6.1
CVE-2017-0363 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - High 8.8
CVE-2017-0362 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - High 7.8
CVE-2017-0361 · MediaWiki
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
Published 13 Apr 2018 · Fixed in 1.27.2, 1.28.1 · NVD - High 7.2
CVE-2018-5511 · F5 BIG-IP
On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
Published 13 Apr 2018 · NVD - High 7.5
CVE-2018-5510 · F5 BIG-IP
On F5 BIG-IP 11.5.4 HF4-11.5.5, the Traffic Management Microkernel (TMM) may restart when processing a specific sequence of packets on IPv6 virtual servers.
Published 13 Apr 2018 · NVD - High 7.5
CVE-2018-5507 · F5 BIG-IP
On F5 BIG-IP versions 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5, vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU.
Published 13 Apr 2018 · NVD - Critical 9.8
CVE-2018-5506 · F5 BIG-IP
In F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.1, 11.5.1-11.5.5, or 11.2.1 the Apache modules apache_auth_token_mod and mod_auth_f5_auth_token.cpp allow possible unauthenticated bruteforce on the em_server_ip authorization parameter to obtain which SSL client certificates used for mutual authentication between BIG-IQ or Enterprise Manager (EM) and managed BIG-IP devices.
Published 13 Apr 2018 · NVD - Medium 6.5
CVE-2017-6158 · F5 BIG-IP
In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses.
Published 13 Apr 2018 · NVD - Medium 6.4
CVE-2017-6156 · F5 BIG-IP
When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote attacker to disrupt or impersonate the tunnels that have completed phase 1 IPSec negotiations. The attacker must possess the necessary credentials to negotiate the phase 1 of the IPSec exchange to exploit this vulnerability; in many…
Published 13 Apr 2018 · NVD - High 7.5
CVE-2017-6155 · F5 BIG-IP
On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM. Data plane is only exposed when a SPDY or HTTP/2 profile is attached to a virtual server. There is no control plane exposure.
Published 13 Apr 2018 · NVD - High 7.5
CVE-2017-6148 · F5 BIG-IP
Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services provided by TMM. The data plane is impacted and exposed only when a SOCKS proxy profile is attached to a Virtual Server. The control plane is not impacted by this vulnerability.
Published 13 Apr 2018 · NVD - High 8.1
CVE-2014-6412 · WordPress
WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
Published 12 Apr 2018 · Fixed in 4.4.0 · NVD - Medium 5.4
CVE-2017-2599 · Jenkins
Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
Published 11 Apr 2018 · Fixed in 2.32.2, 2.44 · NVD - Medium 6.5
CVE-2018-10001 · FFmpeg
The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file.
Published 11 Apr 2018 · NVD - High 8.8
CVE-2017-9839 · Dolibarr ERP CRM
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
Published 11 Apr 2018 · Fixed in 5.0.4 · NVD - Medium 5.4
CVE-2017-9838 · Dolibarr ERP CRM
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).
Published 11 Apr 2018 · Fixed in 5.0.4 · NVD - High 8.8
CVE-2017-18260 · Dolibarr ERP CRM
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
Published 11 Apr 2018 · NVD - Medium 5.4
CVE-2017-18259 · Dolibarr ERP CRM
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
Published 11 Apr 2018 · NVD - Medium 6.5
CVE-2017-18101 · Jira
Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if an internal service exists through missing permission checks.
Published 10 Apr 2018 · Fixed in 7.6.5, 7.7.3, 7.8.3 · NVD - Medium 6.1
CVE-2017-18100 · Jira
The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters.
Published 10 Apr 2018 · Fixed in 7.8.1 · NVD - Low 3.7
CVE-2017-2826 · Zabbix
An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zabbix server to send the configuration information of any Zabbix proxy, resulting in information disclosure. An attacker can make requests from an active Zabbix proxy to trigger this vulnerability.
Published 9 Apr 2018 · NVD - High 7.5
CVE-2018-1308 · Apache Solr
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
Published 9 Apr 2018 · NVD - Medium 4.8
CVE-2018-6905 · TYPO3
The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
Published 8 Apr 2018 · Fixed in 8.7.11, 9.1.0 · NVD - Medium 6.5
CVE-2017-18258 · libxml2
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Published 8 Apr 2018 · Fixed in 2.9.6 · NVD - High 8.8
CVE-2018-9846 · Roundcube
In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later…
Published 7 Apr 2018 · NVD - High 8.8
CVE-2018-9841 · FFmpeg
The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a long filename.
Published 7 Apr 2018 · NVD - Medium 6.1
CVE-2017-18098 · Jira
The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields.
Published 6 Apr 2018 · Fixed in 7.6.1 · NVD - Medium 5.4
CVE-2017-18097 · Jira
The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello card.
Published 6 Apr 2018 · Fixed in 7.6.1 · NVD - Medium 6.1
CVE-2018-9244 · GitLab
GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
Published 5 Apr 2018 · Fixed in 10.4.7, 10.5.7, 10.6.3 · NVD - Medium 6.1
CVE-2018-9243 · GitLab
GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
Published 5 Apr 2018 · Fixed in 10.4.7, 10.5.7, 10.6.3 · NVD - High 8.1
CVE-2018-1082 · Moodle
A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.
Published 4 Apr 2018 · NVD - Medium 5.3
CVE-2018-1081 · Moodle
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.
Published 4 Apr 2018 · NVD - High 8.8
CVE-2018-0986 · Microsoft Exchange Server
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection,…
Published 4 Apr 2018 · NVD - Medium 5.3
CVE-2018-9251 · libxml2
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
Published 4 Apr 2018 · NVD - Critical 9.1
CVE-2018-8780 · Ruby
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD - High 7.5
CVE-2018-8779 · Ruby
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.
Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD - High 7.5
CVE-2018-8778 · Ruby
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD - High 7.5
CVE-2018-8777 · Ruby
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD - High 7.5
CVE-2018-6914 · Ruby
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD - Medium 5.3
CVE-2017-17742 · Ruby
Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
Published 3 Apr 2018 · Fixed in 2.3.7, 2.4.4, 2.5.1 · NVD - Critical 9.8
CVE-2018-9230 · OpenResty
In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngx_lua_waf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an…
Published 2 Apr 2018 · Fixed in 1.13.6.1 · NVD - Medium 6.1
CVE-2018-3821 · Kibana
Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Published 30 Mar 2018 · Fixed in 5.6.7, 6.1.3 · NVD - Medium 6.1
CVE-2018-3820 · Kibana
Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Published 30 Mar 2018 · Fixed in 6.1.3 · NVD - Medium 6.1
CVE-2018-3819 · Kibana
The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
Published 30 Mar 2018 · Fixed in 5.6.7, 6.1.3 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.