UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,932
Published in 7 days
1,029
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,932 vulnerabilities
  1. Critical 9.8

    CVE-2016-7979 · Ghostscript

    Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.

    Published 23 May 2017 · NVD
  2. Critical 9.8

    CVE-2016-7978 · Ghostscript

    Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.

    Published 23 May 2017 · NVD
  3. Medium 5.5

    CVE-2016-7977 · Ghostscript

    Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.

    Published 23 May 2017 · NVD
  4. Medium 6.1

    CVE-2015-8477 · Redmine

    Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.

    Published 23 May 2017 · NVD
  5. High 7.5

    CVE-2015-5383 · Roundcube

    Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

    Published 23 May 2017 · NVD
  6. Medium 6.5

    CVE-2015-5382 · Roundcube

    program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.

    Published 23 May 2017 · NVD
  7. Medium 6.1

    CVE-2015-5381 · Roundcube

    Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.

    Published 23 May 2017 · NVD
  8. Medium 6.5

    CVE-2017-9144 · ImageMagick

    In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c.

    Published 22 May 2017 · NVD
  9. Medium 6.5

    CVE-2017-9143 · ImageMagick

    In ImageMagick 7.0.5-5, the ReadARTImage function in coders/art.c allows attackers to cause a denial of service (memory leak) via a crafted .art file.

    Published 22 May 2017 · NVD
  10. Medium 6.5

    CVE-2017-9142 · ImageMagick

    In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the WriteBlob function in MagickCore/blob.c because of missing checks in the ReadOneJNGImage function in coders/png.c.

    Published 22 May 2017 · NVD
  11. Medium 6.5

    CVE-2017-9141 · ImageMagick

    In ImageMagick 7.0.5-7 Q16, a crafted file could trigger an assertion failure in the ResetImageProfileIterator function in MagickCore/profile.c because of missing checks in the ReadDDSImage function in coders/dds.c.

    Published 22 May 2017 · NVD
  12. Critical 9.8

    CVE-2017-9119 · PHP

    The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures.

    Published 21 May 2017 · NVD
  13. High 7.5

    CVE-2017-9098 · ImageMagick

    ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image data on behalf of multiple users. This is caused by a missing initialization step in the ReadRLEImage…

    Published 19 May 2017 · Fixed in 6.9.8-1, 7.0.5-2 · NVD
  14. High 7.0

    CVE-2017-9067 · PHP

    In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

    Published 18 May 2017 · NVD
  15. High 8.6

    CVE-2017-9066 · WordPress

    In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.

    Published 18 May 2017 · NVD
  16. High 7.5

    CVE-2017-9065 · WordPress

    In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.

    Published 18 May 2017 · NVD
  17. High 8.8

    CVE-2017-9064 · WordPress

    In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.

    Published 18 May 2017 · NVD
  18. Medium 6.1

    CVE-2017-9063 · WordPress

    In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.

    Published 18 May 2017 · NVD
  19. High 8.6

    CVE-2017-9062 · WordPress

    In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.

    Published 18 May 2017 · NVD
  20. Medium 6.1

    CVE-2017-9061 · WordPress

    In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.

    Published 18 May 2017 · NVD
  21. High 7.5

    CVE-2017-9050 · libxml2

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

    Published 18 May 2017 · NVD
  22. High 7.5

    CVE-2017-9049 · libxml2

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

    Published 18 May 2017 · NVD
  23. High 7.5

    CVE-2017-9048 · libxml2

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes…

    Published 18 May 2017 · NVD
  24. High 7.5

    CVE-2017-9047 · libxml2

    A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits)…

    Published 18 May 2017 · NVD
  25. High 7.5

    CVE-2017-8338 · MikroTik RouterOS

    A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (used for L2TP over IPsec), preventing the affected router from accepting new connections; all devices will be disconnected from the router and all logs removed automatically.

    Published 18 May 2017 · NVD
  26. Critical 9.8

    CVE-2017-8917 · Joomla!

    SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 17 May 2017 · NVD
  27. High 8.8

    CVE-2016-3403 · Zimbra Collaboration

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that (1) add, (2) modify, or (3) remove accounts by leveraging failure to use of a CSRF token and perform referer header checks, aka bugs 100885 and 100899.

    Published 17 May 2017 · NVD
  28. Medium 6.5

    CVE-2017-7479 · OpenVPN

    OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

    Published 15 May 2017 · NVD
  29. High 7.5

    CVE-2017-7478 · OpenVPN

    OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

    Published 15 May 2017 · NVD
  30. Medium 4.3

    CVE-2017-7491 · Moodle

    In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

    Published 15 May 2017 · NVD
  31. Medium 5.3

    CVE-2017-7490 · Moodle

    In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.

    Published 15 May 2017 · NVD
  32. Medium 6.3

    CVE-2017-7489 · Moodle

    In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.

    Published 15 May 2017 · NVD
  33. Critical 9.8

    CVE-2017-8923 · PHP

    The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

    Published 12 May 2017 · Fixed in 7.4.24, 8.0.11 · NVD
  34. High 7.5

    CVE-2017-7486 · PostgreSQL

    PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

    Published 12 May 2017 · NVD
  35. Medium 5.9

    CVE-2017-7485 · PostgreSQL

    In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

    Published 12 May 2017 · NVD
  36. High 7.5

    CVE-2017-7484 · PostgreSQL

    It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to…

    Published 12 May 2017 · NVD
  37. Medium 6.1

    CVE-2016-4859 · Splunk Enterprise

    Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified…

    Published 12 May 2017 · NVD
  38. Medium 4.8

    CVE-2016-4858 · Splunk Enterprise

    Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 12 May 2017 · NVD
  39. Medium 6.1

    CVE-2016-4857 · Splunk Enterprise

    Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splunk Light prior to 6.4.2 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

    Published 12 May 2017 · NVD
  40. Medium 4.8

    CVE-2016-4856 · Splunk Enterprise

    Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.

    Published 12 May 2017 · NVD
  41. Medium 5.5

    CVE-2017-8908 · Ghostscript

    The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PostScript document.

    Published 12 May 2017 · NVD
  42. High 8.8

    CVE-2017-8905 · Xen

    Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.

    Published 11 May 2017 · NVD
  43. High 8.8

    CVE-2017-8904 · Xen

    Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.

    Published 11 May 2017 · NVD
  44. High 8.8

    CVE-2017-8903 · Xen

    Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.

    Published 11 May 2017 · NVD
  45. High 7.5

    CVE-2016-7476 · F5 BIG-IP

    The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak while handling certain types of TCP traffic. Remote attackers may cause a denial of service (DoS) by way of a crafted TCP packet.

    Published 11 May 2017 · NVD
  46. Medium 6.5

    CVE-2016-2126 · Samba

    Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.

    Published 11 May 2017 · Fixed in 4.3.13, 4.4.8, 4.5.3 · NVD
  47. Unrated

    WPV-02c6e05dce9d · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 11 May 2017 · Fixed in 3.3.2 · WPVulnerability
  48. Medium 6.8

    CVE-2017-8879 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.

    Published 10 May 2017 · NVD
  49. Critical 9.8

    CVE-2017-7888 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.

    Published 10 May 2017 · NVD
  50. Medium 6.1

    CVE-2017-7887 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.

    Published 10 May 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.