UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,931
Published in 7 days
1,036
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,931 vulnerabilities
  1. Low 3.6

    CVE-2018-1000030 · Python

    Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For…

    Published 8 Feb 2018 · NVD
  2. Medium 5.4

    CVE-2018-6844 · MyBB

    MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.

    Published 8 Feb 2018 · NVD
  3. High 8.8

    CVE-2017-5130 · libxml2

    An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

    Published 7 Feb 2018 · Fixed in 2.9.5 · NVD
  4. High 7.5

    CVE-2018-6389 · WordPress

    In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

    Published 6 Feb 2018 · NVD
  5. High 8.1

    CVE-2014-5282 · Docker Engine

    Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.

    Published 6 Feb 2018 · Fixed in 1.3 · NVD
  6. Medium 6.5

    CVE-2018-6621 · FFmpeg

    The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.

    Published 5 Feb 2018 · NVD
  7. Medium 5.4

    CVE-2017-8783 · Zimbra Collaboration

    Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS.

    Published 4 Feb 2018 · Fixed in 8.7.10 · NVD
  8. Medium 6.1

    CVE-2017-17703 · Zimbra Collaboration

    Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.

    Published 4 Feb 2018 · Fixed in 8.8.3 · NVD
  9. Critical 9.8

    CVE-2018-6551 · GNU C Library

    The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

    Published 2 Feb 2018 · NVD
  10. Medium 6.1

    CVE-2017-18039 · Jira

    The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter.

    Published 2 Feb 2018 · Fixed in 7.4.4 · NVD
  11. Critical 9.8

    CVE-2014-3005 · Zabbix

    XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.

    Published 1 Feb 2018 · NVD
  12. Critical 9.8

    CVE-2018-6485 · GNU C Library

    An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

    Published 1 Feb 2018 · NVD
  13. High 7.0

    CVE-2017-1000409 · GNU C Library

    A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

    Published 1 Feb 2018 · NVD
  14. High 7.8

    CVE-2017-1000408 · GNU C Library

    A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

    Published 1 Feb 2018 · NVD
  15. High 7.8

    CVE-2018-1000001 · GNU C Library

    In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

    Published 31 Jan 2018 · NVD
  16. Medium 5.3

    CVE-2017-15706 · Apache Tomcat

    As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed…

    Published 31 Jan 2018 · NVD
  17. Medium 6.5

    CVE-2018-6405 · ImageMagick

    In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.

    Published 30 Jan 2018 · Fixed in 6.9.9-35, 7.0.7-23 · NVD
  18. High 8.8

    CVE-2017-1731 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated remote attacker could exploit this vulnerability to possibly gain elevated privileges.

    Published 30 Jan 2018 · NVD
  19. Medium 6.1

    CVE-2018-6380 · Joomla!

    In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.

    Published 30 Jan 2018 · Fixed in 3.8.4 · NVD
  20. Medium 6.1

    CVE-2018-6379 · Joomla!

    In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.

    Published 30 Jan 2018 · Fixed in 3.8.4 · NVD
  21. Medium 6.1

    CVE-2018-6377 · Joomla!

    In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox

    Published 30 Jan 2018 · Fixed in 3.8.4 · NVD
  22. Critical 9.8

    CVE-2018-6376 · Joomla!

    In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.

    Published 30 Jan 2018 · Fixed in 3.8.4 · NVD
  23. Critical 10.0

    CVE-2018-0101 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could…

    Published 29 Jan 2018 · Fixed in 9.7.1.21, 9.8.2.20, 9.9.1.2 · NVD
  24. Medium 6.5

    CVE-2018-6392 · FFmpeg

    The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1 allows remote attackers to cause a denial of service (out-of-array access) via a crafted MP4 file.

    Published 29 Jan 2018 · NVD
  25. High 8.8

    CVE-2017-1000356 · Jenkins

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.

    Published 29 Jan 2018 · NVD
  26. Medium 6.5

    CVE-2017-1000355 · Jenkins

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.

    Published 29 Jan 2018 · NVD
  27. High 8.8

    CVE-2017-1000354 · Jenkins

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and…

    Published 29 Jan 2018 · NVD
  28. Critical 9.8Actively exploited

    CVE-2017-1000353 · Jenkins

    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism.…

    Published 29 Jan 2018 · NVD
  29. Medium 6.1

    CVE-2017-14190 · Fortinet FortiOS

    A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests.

    Published 29 Jan 2018 · NVD
  30. High 7.5

    CVE-2017-12380 · ClamAV

    ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms in mbox.c during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this…

    Published 26 Jan 2018 · NVD
  31. Critical 9.8

    CVE-2017-12379 · ClamAV

    ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote…

    Published 26 Jan 2018 · NVD
  32. Medium 5.5

    CVE-2017-12378 · ClamAV

    ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition…

    Published 26 Jan 2018 · NVD
  33. Critical 9.8

    CVE-2017-12377 · ClamAV

    ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a…

    Published 26 Jan 2018 · NVD
  34. High 7.8

    CVE-2017-12376 · ClamAV

    ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An…

    Published 26 Jan 2018 · NVD
  35. High 7.5

    CVE-2017-12375 · ClamAV

    The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions (the rfc2047 function in mbox.c). An unauthenticated, remote attacker could exploit…

    Published 26 Jan 2018 · NVD
  36. High 7.5

    CVE-2017-12374 · ClamAV

    The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV…

    Published 26 Jan 2018 · NVD
  37. Low 2.2

    CVE-2017-1000401 · Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation…

    Published 26 Jan 2018 · NVD
  38. Medium 4.3

    CVE-2017-1000400 · Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.

    Published 26 Jan 2018 · NVD
  39. Medium 4.3

    CVE-2017-1000399 · Jenkins

    The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API endpoint is now only available for tasks that the current user has…

    Published 26 Jan 2018 · NVD
  40. Medium 4.3

    CVE-2017-1000398 · Jenkins

    The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only shows information about accessible tasks.

    Published 26 Jan 2018 · NVD
  41. Medium 5.9

    CVE-2017-1000396 · Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins plugins. The fix for CVE-2012-6153 was backported to the version of commons-httpclient that is bundled…

    Published 26 Jan 2018 · NVD
  42. Medium 4.3

    CVE-2017-1000395 · Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/(username)/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote API now no longer includes information beyond the most basic (user ID and name) unless the user…

    Published 26 Jan 2018 · NVD
  43. High 7.5

    CVE-2017-1000394 · Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jenkins.

    Published 26 Jan 2018 · NVD
  44. High 8.8

    CVE-2017-1000393 · Jenkins

    Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission…

    Published 26 Jan 2018 · NVD
  45. Medium 4.8

    CVE-2017-1000392 · Jenkins

    Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.

    Published 26 Jan 2018 · NVD
  46. High 7.3

    CVE-2017-1000391 · Jenkins

    Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.

    Published 26 Jan 2018 · NVD
  47. High 7.5

    CVE-2017-15132 · Dovecot

    A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.

    Published 25 Jan 2018 · NVD
  48. High 8.8

    CVE-2017-15365 · MariaDB

    sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with SQL access to bypass intended access restrictions and replicate data definition language (DDL) statements to cluster nodes by leveraging incorrect ordering of DDL replication and ACL checking.

    Published 25 Jan 2018 · Fixed in 10.1.30, 10.2.10 · NVD
  49. Medium 6.1

    CVE-2018-6200 · vBulletin

    vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.

    Published 25 Jan 2018 · NVD
  50. High 8.1

    CVE-2017-1000504 · Jenkins

    A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.

    Published 24 Jan 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.