UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,931
Published in 7 days
1,035
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,931 vulnerabilities
  1. High 8.6

    CVE-2017-17697 · Harbor

    The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.

    Published 15 Dec 2017 · Fixed in 1.3.0 · NVD
  2. High 8.8

    CVE-2017-17405 · Ruby

    Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary…

    Published 15 Dec 2017 · NVD
  3. High 8.8

    CVE-2017-17522 · Python

    Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting

    Published 14 Dec 2017 · NVD
  4. Medium 6.5

    CVE-2017-17682 · ImageMagick

    In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted wpg image file that triggers a ReadWPGImage call.

    Published 14 Dec 2017 · NVD
  5. Medium 6.5

    CVE-2017-17681 · ImageMagick

    In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service (CPU exhaustion) via a crafted psd image file.

    Published 14 Dec 2017 · NVD
  6. Medium 6.5

    CVE-2017-17680 · ImageMagick

    In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted xpm image file.

    Published 14 Dec 2017 · NVD
  7. Critical 9.8

    CVE-2017-17672 · vBulletin

    In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.

    Published 14 Dec 2017 · NVD
  8. Critical 9.8

    CVE-2017-17671 · vBulletin

    vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an…

    Published 14 Dec 2017 · NVD
  9. High 7.8

    CVE-2017-17566 · Xen

    An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.

    Published 12 Dec 2017 · NVD
  10. Medium 5.6

    CVE-2017-17565 · Xen

    An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P.

    Published 12 Dec 2017 · NVD
  11. High 7.8

    CVE-2017-17564 · Xen

    An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.

    Published 12 Dec 2017 · NVD
  12. High 7.8

    CVE-2017-17563 · Xen

    An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.

    Published 12 Dec 2017 · NVD
  13. High 8.1

    CVE-2017-11932 · Microsoft Exchange Server

    Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".

    Published 12 Dec 2017 · NVD
  14. Medium 5.9

    CVE-2017-1000385 · Erlang/OTP

    The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).

    Published 12 Dec 2017 · NVD
  15. Medium 6.5

    CVE-2017-17555 · FFmpeg

    The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.

    Published 12 Dec 2017 · NVD
  16. Low 3.1

    CVE-2017-15897 · Node.js

    Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

    Published 11 Dec 2017 · Fixed in 8.9.3, 9.2.1 · NVD
  17. Critical 9.1

    CVE-2017-15896 · Node.js

    Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

    Published 11 Dec 2017 · Fixed in 6.12.2, 8.9.3, 9.2.1 · NVD
  18. Critical 9.8Actively exploited

    CVE-2017-15944 · Palo Alto Networks PAN-OS

    Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.

    Published 11 Dec 2017 · Fixed in 7.0.19, 7.1.14, 8.0.6 · NVD
  19. Medium 5.3

    CVE-2017-15943 · Palo Alto Networks PAN-OS

    The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities.

    Published 11 Dec 2017 · Fixed in 6.1.19, 7.0.19, 7.1.14 · NVD
  20. High 7.5

    CVE-2017-15942 · Palo Alto Networks PAN-OS

    Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a denial of service via vectors related to the management interface.

    Published 11 Dec 2017 · Fixed in 7.0.19, 7.1.13, 8.0.6 · NVD
  21. Critical 9.8

    CVE-2017-15940 · Palo Alto Networks PAN-OS

    The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors.

    Published 11 Dec 2017 · Fixed in 7.0.19, 7.1.14, 8.0.6 · NVD
  22. Medium 6.5

    CVE-2017-17504 · ImageMagick

    ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage.

    Published 11 Dec 2017 · Fixed in 6.9.9-24, 7.0.7-12 · NVD
  23. Critical 9.8

    CVE-2017-17499 · ImageMagick

    ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.

    Published 11 Dec 2017 · Fixed in 6.9.9-24, 7.0.7-12 · NVD
  24. High 7.5

    CVE-2017-3111 · Adobe Experience Manager

    An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances.

    Published 9 Dec 2017 · NVD
  25. Medium 6.1

    CVE-2017-3109 · Adobe Experience Manager

    An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Adobe Experience Manager has a reflected cross-site scripting vulnerability in the HtmlRendererServlet.

    Published 9 Dec 2017 · NVD
  26. Medium 6.1

    CVE-2017-11296 · Adobe Experience Manager

    An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20 has been resolved in Adobe Experience Manager.

    Published 9 Dec 2017 · NVD
  27. Medium 6.1

    CVE-2017-11482 · Kibana

    The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

    Published 8 Dec 2017 · NVD
  28. Medium 6.1

    CVE-2017-11481 · Kibana

    Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

    Published 8 Dec 2017 · NVD
  29. Medium 5.9

    CVE-2017-3738 · Node.js, OpenSSL

    There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce…

    Published 7 Dec 2017 · Fixed in 6.12.2, 8.9.3, 9.2.1 · NVD
  30. Medium 5.9

    CVE-2017-3737 · OpenSSL

    OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a…

    Published 7 Dec 2017 · NVD
  31. High 8.8

    CVE-2017-17384 · ISPConfig

    ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

    Published 7 Dec 2017 · NVD
  32. Medium 4.7

    CVE-2017-17383 · Jenkins

    Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624.

    Published 6 Dec 2017 · NVD
  33. Critical 9.8

    CVE-2017-17434 · rsync

    The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended…

    Published 6 Dec 2017 · NVD
  34. Low 3.7

    CVE-2017-17433 · rsync

    The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

    Published 6 Dec 2017 · NVD
  35. High 8.1

    CVE-2017-17426 · GNU C Library

    The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.

    Published 5 Dec 2017 · NVD
  36. Medium 5.4

    CVE-2017-17094 · WordPress

    wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

    Published 2 Dec 2017 · Fixed in 4.9.1 · NVD
  37. Medium 5.4

    CVE-2017-17093 · WordPress

    wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

    Published 2 Dec 2017 · Fixed in 4.9.1 · NVD
  38. Medium 5.4

    CVE-2017-17092 · WordPress

    wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

    Published 2 Dec 2017 · Fixed in 4.9.1 · NVD
  39. High 8.8

    CVE-2017-17091 · WordPress

    wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

    Published 2 Dec 2017 · NVD
  40. Unrated

    WPV-eb935a36f3ce · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 2 Dec 2017 · Fixed in 1.8.0 · WPVulnerability
  41. Unrated

    WPV-5d36808e7f71 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 2 Dec 2017 · Fixed in 1.8.8 · WPVulnerability
  42. Medium 6.2

    CVE-2017-15707 · Apache Struts, Oracle WebLogic Server

    In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.

    Published 1 Dec 2017 · NVD
  43. High 7.5

    CVE-2017-11286 · Adobe ColdFusion

    Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

    Published 1 Dec 2017 · NVD
  44. Medium 6.1

    CVE-2017-11285 · Adobe ColdFusion

    Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

    Published 1 Dec 2017 · NVD
  45. Critical 9.8

    CVE-2017-11284 · Adobe ColdFusion

    Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

    Published 1 Dec 2017 · NVD
  46. Critical 9.8

    CVE-2017-11283 · Adobe ColdFusion

    Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

    Published 1 Dec 2017 · NVD
  47. Medium 6.5

    CVE-2017-17081 · FFmpeg

    The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.

    Published 30 Nov 2017 · NVD
  48. Critical 9.8

    CVE-2017-17067 · Splunk Enterprise

    Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks.

    Published 30 Nov 2017 · Fixed in 6.5.6, 6.6.3.2, 7.0.0.1 · NVD
  49. Medium 5.4

    CVE-2017-14186 · Fortinet FortiOS

    A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.

    Published 29 Nov 2017 · NVD
  50. Critical 9.8

    CVE-2017-8818 · curl

    curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.

    Published 29 Nov 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.