UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,937
Published in 7 days
1,032
Critical in 30 days
361
Actively exploited
423

Latest vulnerabilities

39,937 vulnerabilities
  1. High 7.5

    CVE-2014-9804 · ImageMagick

    vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object."

    Published 30 Mar 2017 · Fixed in 6.9.4-0 · NVD
  2. Medium 4.9

    CVE-2016-7542 · Fortinet FortiOS

    A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them.

    Published 30 Mar 2017 · NVD
  3. Medium 5.9

    CVE-2016-7541 · Fortinet FortiOS

    Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode (the default mode) are not affected.

    Published 30 Mar 2017 · NVD
  4. High 7.5

    CVE-2017-7285 · MikroTik RouterOS

    A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets, preventing the affected router from accepting new TCP connections.

    Published 29 Mar 2017 · NVD
  5. Critical 9.8

    CVE-2016-9924 · Zimbra Collaboration

    Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.

    Published 29 Mar 2017 · NVD
  6. High 7.3

    CVE-2009-5147 · Ruby

    DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.

    Published 29 Mar 2017 · NVD
  7. Medium 5.4

    CVE-2017-7298 · Moodle

    In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.

    Published 29 Mar 2017 · NVD
  8. High 8.8

    CVE-2017-7297 · Rancher

    Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

    Published 29 Mar 2017 · Fixed in 1.3.5, 1.4.3, 1.5.3 · NVD
  9. Medium 6.3

    CVE-2017-0882 · GitLab

    Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

    Published 28 Mar 2017 · NVD
  10. High 8.2

    CVE-2016-9469 · GitLab

    Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix was included in versions 8.14.3, 8.13.8, and 8.12.11, which were released on December 5th 2016 at…

    Published 28 Mar 2017 · NVD
  11. Medium 5.3

    CVE-2016-9468 · Nextcloud

    Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.

    Published 28 Mar 2017 · Fixed in 9.0.54 · NVD
  12. Medium 5.3

    CVE-2016-9467 · Nextcloud

    Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

    Published 28 Mar 2017 · Fixed in 9.0.54, 10.0.1 · NVD
  13. Medium 6.1

    CVE-2016-9466 · Nextcloud

    Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.

    Published 28 Mar 2017 · Fixed in 10.0.1 · NVD
  14. Medium 5.4

    CVE-2016-9465 · Nextcloud

    Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.

    Published 28 Mar 2017 · Fixed in 10.0.1 · NVD
  15. Medium 4.3

    CVE-2016-9464 · Nextcloud

    Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users…

    Published 28 Mar 2017 · Fixed in 9.0.54 · NVD
  16. High 8.1

    CVE-2016-9463 · Nextcloud

    Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the…

    Published 28 Mar 2017 · Fixed in 9.0.54, 10.0.1 · NVD
  17. Medium 4.3

    CVE-2016-9462 · Nextcloud

    Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.

    Published 28 Mar 2017 · Fixed in 9.0.52 · NVD
  18. Medium 4.3

    CVE-2016-9461 · Nextcloud

    Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.

    Published 28 Mar 2017 · Fixed in 9.0.52 · NVD
  19. Medium 6.1

    CVE-2016-9459 · Nextcloud

    Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows…

    Published 28 Mar 2017 · Fixed in 9.0.52 · NVD
  20. Medium 5.5

    CVE-2017-7275 · ImageMagick

    The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.

    Published 27 Mar 2017 · NVD
  21. High 7.5

    CVE-2016-9252 · F5 BIG-IP

    The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, which allows remote attackers to cause a denial-of-service (DoS) through unspecified vectors.

    Published 27 Mar 2017 · NVD
  22. High 7.4

    CVE-2017-7272 · PHP

    PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

    Published 27 Mar 2017 · NVD
  23. Medium 5.5

    CVE-2016-7474 · F5 BIG-IP

    In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to temporarily obtain normally unrecoverable information.

    Published 27 Mar 2017 · NVD
  24. Critical 9.8Actively exploited

    CVE-2017-7269 · Microsoft IIS

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

    Published 27 Mar 2017 · NVD
  25. Medium 6.1

    CVE-2017-2645 · Moodle

    In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

    Published 26 Mar 2017 · NVD
  26. Medium 6.1

    CVE-2017-2644 · Moodle

    In Moodle 3.x, XSS can occur via evidence of prior learning.

    Published 26 Mar 2017 · NVD
  27. Medium 5.3

    CVE-2017-2643 · Moodle

    In Moodle 3.2.x, global search displays user names for unauthenticated users.

    Published 26 Mar 2017 · NVD
  28. Critical 9.8

    CVE-2017-2641 · Moodle

    In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

    Published 26 Mar 2017 · NVD
  29. Critical 9.8

    CVE-2017-5511 · ImageMagick

    coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.

    Published 24 Mar 2017 · Fixed in 6.9.7-3, 7.0.4-3 · NVD
  30. High 7.8

    CVE-2017-5510 · ImageMagick

    coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.

    Published 24 Mar 2017 · Fixed in 6.9.7-4, 7.0.4-4 · NVD
  31. High 7.8

    CVE-2017-5509 · ImageMagick

    coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.

    Published 24 Mar 2017 · Fixed in 6.9.7-4, 7.0.4-4 · NVD
  32. Medium 5.5

    CVE-2017-5508 · ImageMagick

    Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.

    Published 24 Mar 2017 · NVD
  33. High 7.5

    CVE-2017-5507 · ImageMagick

    Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.

    Published 24 Mar 2017 · NVD
  34. High 7.8

    CVE-2017-5506 · ImageMagick

    Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.

    Published 24 Mar 2017 · NVD
  35. High 7.5

    CVE-2016-10146 · ImageMagick

    Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

    Published 24 Mar 2017 · Fixed in 6.9.6-8 · NVD
  36. Critical 9.8

    CVE-2016-10145 · ImageMagick

    Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.

    Published 24 Mar 2017 · Fixed in 6.9.7-1 · NVD
  37. Critical 9.8

    CVE-2016-10144 · ImageMagick

    coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.

    Published 24 Mar 2017 · Fixed in 6.9.7-1 · NVD
  38. Medium 5.3

    CVE-2015-8628 · MediaWiki

    The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.

    Published 23 Mar 2017 · NVD
  39. Medium 5.3

    CVE-2015-8627 · MediaWiki

    MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.

    Published 23 Mar 2017 · NVD
  40. Critical 9.8

    CVE-2015-8626 · MediaWiki

    The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.

    Published 23 Mar 2017 · NVD
  41. High 7.5

    CVE-2015-8625 · MediaWiki

    MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.

    Published 23 Mar 2017 · NVD
  42. High 8.8

    CVE-2015-8624 · MediaWiki

    The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than…

    Published 23 Mar 2017 · NVD
  43. High 8.8

    CVE-2015-8623 · MediaWiki

    The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.

    Published 23 Mar 2017 · NVD
  44. Medium 6.1

    CVE-2015-8622 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."

    Published 23 Mar 2017 · NVD
  45. Medium 5.5

    CVE-2016-9556 · ImageMagick

    The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.

    Published 23 Mar 2017 · NVD
  46. High 7.8

    CVE-2016-10059 · ImageMagick

    Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or have unspecified other impact via a crafted TIFF file.

    Published 23 Mar 2017 · NVD
  47. Medium 5.5

    CVE-2016-10058 · ImageMagick

    Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.

    Published 23 Mar 2017 · NVD
  48. High 7.8

    CVE-2016-10057 · ImageMagick

    Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 23 Mar 2017 · NVD
  49. High 7.8

    CVE-2016-10056 · ImageMagick

    Buffer overflow in the sixel_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 23 Mar 2017 · NVD
  50. High 7.8

    CVE-2016-10055 · ImageMagick

    Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

    Published 23 Mar 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.