UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,932
Published in 7 days
1,027
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,932 vulnerabilities
  1. High 8.8

    CVE-2016-4319 · Jira

    Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings.

    Published 10 Apr 2017 · NVD
  2. Medium 4.8

    CVE-2016-4318 · Jira

    Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.

    Published 10 Apr 2017 · NVD
  3. Medium 6.5

    CVE-2017-7606 · ImageMagick

    coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.

    Published 9 Apr 2017 · NVD
  4. Critical 9.8Actively exploited

    CVE-2016-8735 · Apache Tomcat

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

    Published 6 Apr 2017 · Fixed in 7.0.73, 8.0.39, 8.5.7 · NVD
  5. High 8.6

    CVE-2017-7569 · vBulletin

    In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.

    Published 6 Apr 2017 · NVD
  6. High 7.7

    CVE-2017-7566 · MyBB

    MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.

    Published 6 Apr 2017 · NVD
  7. Medium 4.3

    CVE-2017-0888 · Nextcloud

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information.

    Published 5 Apr 2017 · NVD
  8. Medium 4.3

    CVE-2017-0887 · Nextcloud

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator.

    Published 5 Apr 2017 · Fixed in 9.0.55, 10.0.2 · NVD
  9. Medium 6.5

    CVE-2017-0886 · Nextcloud

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service.

    Published 5 Apr 2017 · Fixed in 9.0.55, 10.0.2 · NVD
  10. Medium 4.3

    CVE-2017-0885 · Nextcloud

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages.

    Published 5 Apr 2017 · Fixed in 9.0.55, 10.0.2 · NVD
  11. Medium 4.3

    CVE-2017-0884 · Nextcloud

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.

    Published 5 Apr 2017 · Fixed in 9.0.55, 10.0.2 · NVD
  12. Medium 6.4

    CVE-2017-0883 · Nextcloud

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. Note that this only affects folders and…

    Published 5 Apr 2017 · NVD
  13. Medium 6.5

    CVE-2014-9829 · ImageMagick

    coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted sun file.

    Published 5 Apr 2017 · Fixed in 6.9.4-0 · NVD
  14. Medium 5.5

    CVE-2017-7418 · ProFTPD

    ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic…

    Published 4 Apr 2017 · NVD
  15. Low 2.4

    CVE-2017-7407 · curl

    The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

    Published 3 Apr 2017 · NVD
  16. High 7.8

    CVE-2016-10317 · Ghostscript

    The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.

    Published 3 Apr 2017 · NVD
  17. High 7.5

    CVE-2017-6441 · PHP

    The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.

    Published 3 Apr 2017 · NVD
  18. High 7.5

    CVE-2017-6181 · Ruby

    The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.

    Published 3 Apr 2017 · NVD
  19. Medium 5.5

    CVE-2017-5951 · Ghostscript

    The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.

    Published 3 Apr 2017 · NVD
  20. Medium 5.5

    CVE-2016-10220 · Ghostscript

    The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.

    Published 3 Apr 2017 · NVD
  21. Medium 5.5

    CVE-2016-10219 · Ghostscript

    The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

    Published 3 Apr 2017 · NVD
  22. Medium 5.5

    CVE-2016-10218 · Ghostscript

    The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.

    Published 3 Apr 2017 · NVD
  23. Medium 5.5

    CVE-2016-10217 · Ghostscript

    The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.

    Published 3 Apr 2017 · NVD
  24. High 7.5

    CVE-2017-1001000 · WordPress

    The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld…

    Published 3 Apr 2017 · NVD
  25. High 7.8

    CVE-2014-9825 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9824.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  26. High 7.8

    CVE-2014-9824 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9825.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  27. High 7.8

    CVE-2014-9823 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9819.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  28. High 7.8

    CVE-2014-9822 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted quantum file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  29. High 7.8

    CVE-2014-9821 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  30. High 7.8

    CVE-2014-9820 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pnm file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  31. High 7.8

    CVE-2014-9819 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9823.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  32. Medium 5.5

    CVE-2014-9818 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a malformed sun file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  33. High 7.8

    CVE-2014-9817 · ImageMagick

    Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pdb file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  34. Medium 5.5

    CVE-2014-9816 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted viff file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  35. Medium 5.5

    CVE-2014-9815 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted wpg file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  36. Medium 5.5

    CVE-2014-9814 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted wpg file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  37. Medium 5.5

    CVE-2014-9813 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (application crash) via a crafted viff file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  38. Medium 5.5

    CVE-2014-9812 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted ps file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  39. Medium 5.5

    CVE-2014-9811 · ImageMagick

    The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  40. Medium 5.5

    CVE-2014-9810 · ImageMagick

    The dpx file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed dpx file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  41. Medium 5.5

    CVE-2014-9809 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted xwd image.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  42. Medium 5.5

    CVE-2014-9808 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted dpc image.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  43. Medium 5.5

    CVE-2014-9807 · ImageMagick

    The pdb coder in ImageMagick allows remote attackers to cause a denial of service (double free) via unspecified vectors.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  44. Medium 5.5

    CVE-2014-9806 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (file descriptor consumption) via a crafted file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  45. Medium 5.5

    CVE-2014-9805 · ImageMagick

    ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted pnm file.

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  46. High 7.5

    CVE-2014-9804 · ImageMagick

    vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object."

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  47. Medium 4.9

    CVE-2016-7542 · Fortinet FortiOS

    A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them.

    Published 30 Mar 2017 · NVD
  48. Medium 5.9

    CVE-2016-7541 · Fortinet FortiOS

    Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode (the default mode) are not affected.

    Published 30 Mar 2017 · NVD
  49. High 7.5

    CVE-2017-7285 · MikroTik RouterOS

    A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections.

    Published 29 Mar 2017 · NVD
  50. Critical 9.8

    CVE-2016-9924 · Zimbra Collaboration

    Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.

    Published 29 Mar 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.