UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,931
Published in 7 days
1,036
Critical in 30 days
362
Actively exploited
423

Latest vulnerabilities

39,931 vulnerabilities
  1. High 7.5

    CVE-2018-5314 · NetScaler ADC and Gateway

    Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load Balancing instance distributed with NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition 9.3.0 allows remote attackers to execute a system command or read arbitrary files via an SSH login…

    Published 1 Mar 2018 · NVD
  2. Medium 5.9

    CVE-2018-5501 · F5 BIG-IP

    In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control.

    Published 1 Mar 2018 · NVD
  3. Medium 5.9

    CVE-2018-5500 · F5 BIG-IP

    On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using TCP profile with Multipath TCP (MCTCP) feature enabled will be affected by this issue.

    Published 1 Mar 2018 · NVD
  4. High 7.5

    CVE-2017-6150 · F5 BIG-IP

    Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented packets may restart the Traffic Management Microkernel (TMM).

    Published 1 Mar 2018 · NVD
  5. Medium 6.5

    CVE-2017-18207 · Python

    The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of exceptions.

    Published 1 Mar 2018 · NVD
  6. Medium 5.9

    CVE-2018-1304 · Apache Tomcat

    The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that…

    Published 28 Feb 2018 · NVD
  7. Medium 6.5

    CVE-2018-7557 · FFmpeg

    The decode_init function in libavcodec/utvideodec.c in FFmpeg 2.8 through 3.4.2 allows remote attackers to cause a denial of service (Out of array read) via an AVI file with crafted dimensions within chroma subsampling data.

    Published 28 Feb 2018 · NVD
  8. Critical 9.1

    CVE-2018-7556 · LimeSurvey

    LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x before 3.4.2 mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file.

    Published 28 Feb 2018 · Fixed in 2.6.7, 2.73.1, 3.4.2 · NVD
  9. High 7.5

    CVE-2017-7671 · Apache Traffic Server

    There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.

    Published 27 Feb 2018 · NVD
  10. High 8.6

    CVE-2017-5660 · Apache Traffic Server

    There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.

    Published 27 Feb 2018 · NVD
  11. Medium 6.5

    CVE-2018-7542 · Xen

    An issue was discovered in Xen 4.8.x through 4.10.x allowing x86 PVH guest OS users to cause a denial of service (NULL pointer dereference and hypervisor crash) by leveraging the mishandling of configurations that lack a Local APIC.

    Published 27 Feb 2018 · NVD
  12. High 8.8

    CVE-2018-7541 · Xen

    An issue was discovered in Xen through 4.10.x allowing guest OS users to cause a denial of service (hypervisor crash) or gain privileges by triggering a grant-table transition from v2 to v1.

    Published 27 Feb 2018 · NVD
  13. Medium 6.5

    CVE-2018-7540 · Xen

    An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing.

    Published 27 Feb 2018 · NVD
  14. Medium 6.1

    CVE-2018-4876 · Adobe Experience Manager

    Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPI#getValidHref function.

    Published 27 Feb 2018 · NVD
  15. Medium 6.1

    CVE-2018-4875 · Adobe Experience Manager

    Adobe Experience Manager versions 6.1 and 6.0 are vulnerable to a reflected cross-site scripting vulnerability related to the handling of malicious content embedded in image files uploaded to the DAM.

    Published 27 Feb 2018 · NVD
  16. High 7.5

    CVE-2018-7491 · PrestaShop

    In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values.

    Published 26 Feb 2018 · NVD
  17. Medium 5.3

    CVE-2017-18195 · Concrete CMS

    An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.

    Published 26 Feb 2018 · Fixed in 8.3.0 · NVD
  18. Medium 6.5

    CVE-2018-7470 · ImageMagick

    An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c allows attackers to cause a denial of service (segmentation violation) via a crafted file.

    Published 25 Feb 2018 · NVD
  19. Medium 6.5

    CVE-2018-1305 · Apache Tomcat

    Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints…

    Published 23 Feb 2018 · NVD
  20. Medium 6.5

    CVE-2018-7443 · ImageMagick

    The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which allows remote attackers to cause a denial of service (memory allocation failure in the AcquireMagickMemory function in MagickCore/memory.c).

    Published 23 Feb 2018 · NVD
  21. Unrated

    WPV-e752d999513d · WooCommerce

    Vulnerability in WooCommerce

    Published 23 Feb 2018 · Fixed in 3.2.4 · WPVulnerability
  22. Medium 4.9

    CVE-2018-7305 · MyBB

    MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts.

    Published 21 Feb 2018 · NVD
  23. Medium 5.4

    CVE-2018-7260 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

    Published 21 Feb 2018 · Fixed in 4.7.8 · NVD
  24. Medium 6.5

    CVE-2018-6356 · Jenkins

    Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating…

    Published 20 Feb 2018 · Fixed in 2.89.4, 2.107 · NVD
  25. Critical 9.8

    CVE-2017-7376 · libxml2

    Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

    Published 19 Feb 2018 · Fixed in 2.9.5 · NVD
  26. Critical 9.8

    CVE-2017-7375 · libxml2

    A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP…

    Published 19 Feb 2018 · NVD
  27. Medium 6.5

    CVE-2015-9253 · PHP

    An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error…

    Published 19 Feb 2018 · Fixed in 7.1.20, 7.2.8 · NVD
  28. Medium 6.1

    CVE-2018-7198 · October CMS

    October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.

    Published 18 Feb 2018 · NVD
  29. Medium 5.3

    CVE-2018-1000068 · Jenkins

    An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.

    Published 16 Feb 2018 · NVD
  30. Medium 5.3

    CVE-2018-1000067 · Jenkins

    An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.

    Published 16 Feb 2018 · NVD
  31. Low 3.7

    CVE-2017-15709 · Apache ActiveMQ

    When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

    Published 13 Feb 2018 · NVD
  32. Medium 6.5

    CVE-2018-6930 · ImageMagick

    A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0.7-22 allows a remote attacker to cause a denial of service (application crash) via a maliciously crafted pict file.

    Published 13 Feb 2018 · NVD
  33. High 7.8

    CVE-2016-8742 · Apache CouchDB

    The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service launcher, or CouchDB batch or binary files. A subsequent service or server restart will then run that binary with…

    Published 12 Feb 2018 · NVD
  34. Medium 6.5

    CVE-2018-6912 · FFmpeg

    The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

    Published 12 Feb 2018 · NVD
  35. High 8.8

    CVE-2018-1000053 · LimeSurvey

    LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be used to send a GET request to the affected endpoint.

    Published 9 Feb 2018 · NVD
  36. High 7.5

    CVE-2018-1000027 · Squid

    The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This…

    Published 9 Feb 2018 · Fixed in 4.0.23 · NVD
  37. High 7.5

    CVE-2018-1000024 · Squid

    The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability…

    Published 9 Feb 2018 · NVD
  38. Medium 5.4

    CVE-2017-1000509 · Dolibarr ERP CRM

    Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.

    Published 9 Feb 2018 · NVD
  39. Medium 6.1

    CVE-2018-5307 · Sonatype Nexus Repository

    Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a…

    Published 9 Feb 2018 · Fixed in 2.14.6 · NVD
  40. Medium 6.1

    CVE-2018-5306 · Sonatype Nexus Repository

    Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a…

    Published 9 Feb 2018 · Fixed in 3.8 · NVD
  41. Medium 6.1

    CVE-2012-6346 · Fortinet FortiWeb

    Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) redir or (2) mkey parameter to waf/pcre_expression/validate.

    Published 9 Feb 2018 · Fixed in 4.4.4 · NVD
  42. Medium 6.5

    CVE-2018-6876 · ImageMagick

    The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service (stack-based buffer under-read) via a crafted bmp image.

    Published 9 Feb 2018 · NVD
  43. High 7.0

    CVE-2018-1053 · PostgreSQL

    In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or…

    Published 9 Feb 2018 · Fixed in 9.4.16, 9.5.11, 9.6.7 · NVD
  44. Medium 6.5

    CVE-2018-1052 · PostgreSQL

    Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of server memory via purpose-crafted insert to a partitioned table.

    Published 9 Feb 2018 · NVD
  45. High 7.5

    CVE-2016-10712 · PHP

    In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a "$uri = stream_get_meta_data(fopen($file, "r"))['uri']" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker.

    Published 9 Feb 2018 · NVD
  46. Critical 9.8Actively exploited

    CVE-2018-6789 · Exim

    An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.

    Published 8 Feb 2018 · Fixed in 4.90.1 · NVD
  47. High 8.8

    CVE-2012-5360 · FFmpeg

    Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file.

    Published 8 Feb 2018 · Fixed in 0.11 · NVD
  48. High 8.8

    CVE-2012-5359 · FFmpeg

    Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file.

    Published 8 Feb 2018 · Fixed in 0.11 · NVD
  49. Medium 6.1

    CVE-2012-0941 · Fortinet FortiOS

    Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Endpoint Monitor, (2) Dialup List, or (3) Log&Report Display modules, or the fields_sorted_opt parameter to (4) user/auth/list or (5)…

    Published 8 Feb 2018 · Fixed in 4.3.6 · NVD
  50. Critical 9.8

    CVE-2011-4889 · IBM WebSphere Application Server

    The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 does not properly update passwords on a configuration using Tivoli Directory Server, which might allow remote attackers to gain access to an application by leveraging knowledge of an old password. IBM…

    Published 8 Feb 2018 · Fixed in 6.1.0.43, 7.0.0.21, 8.0.0.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.