UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,022
Published in 7 days
1,069
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,022 vulnerabilities
  1. Medium 4.3

    CVE-2014-5139 · OpenSSL

    The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

    Published 13 Aug 2014 · NVD
  2. High 7.5

    CVE-2014-3512 · OpenSSL

    Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

    Published 13 Aug 2014 · NVD
  3. Medium 4.3

    CVE-2014-3511 · OpenSSL

    The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.

    Published 13 Aug 2014 · NVD
  4. Medium 4.3

    CVE-2014-3510 · OpenSSL

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

    Published 13 Aug 2014 · NVD
  5. Medium 6.8

    CVE-2014-3509 · OpenSSL

    Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

    Published 13 Aug 2014 · NVD
  6. Medium 4.3

    CVE-2014-3508 · OpenSSL

    The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other…

    Published 13 Aug 2014 · NVD
  7. Medium 5.0

    CVE-2014-3507 · OpenSSL

    Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

    Published 13 Aug 2014 · NVD
  8. Medium 5.0

    CVE-2014-3506 · OpenSSL

    d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

    Published 13 Aug 2014 · NVD
  9. Medium 5.0

    CVE-2014-3505 · OpenSSL

    Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

    Published 13 Aug 2014 · NVD
  10. Medium 4.3

    CVE-2014-5198 · Splunk Enterprise

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.1.x before 6.1.3 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.

    Published 12 Aug 2014 · NVD
  11. Medium 4.0

    CVE-2014-5197 · Splunk Enterprise

    Directory traversal vulnerability in (1) Splunk Web or the (2) Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URI, related to search ids.

    Published 12 Aug 2014 · NVD
  12. High 9.0

    CVE-2013-7394 · Splunk Enterprise

    The "runshellscript echo.sh" script in Splunk before 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string. NOTE: this issue was SPLIT from CVE-2013-6771 per ADT2 due to different vulnerability types.

    Published 7 Aug 2014 · NVD
  13. High 9.3

    CVE-2013-6771 · Splunk Enterprise

    Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2013-7394 is for the issue in the "runshellscript echo.sh" script.

    Published 7 Aug 2014 · NVD
  14. High 7.9

    CVE-2014-3560 · Samba

    NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.

    Published 6 Aug 2014 · NVD
  15. Unrated

    WPV-f3fc02351c8c · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 1 Aug 2014 · Fixed in 1.0.13 · WPVulnerability
  16. Unrated

    WPV-ba50a8a61674 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 1 Aug 2014 · Fixed in 3.8.3 · WPVulnerability
  17. Unrated

    WPV-9d84ac5c78b3 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 1 Aug 2014 · Fixed in 3.5.3 · WPVulnerability
  18. Unrated

    WPV-381339795444 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 1 Aug 2014 · Fixed in 3.5.3 · WPVulnerability
  19. Unrated

    WPV-16e7168763e1 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 1 Aug 2014 · Fixed in 1.4.7 · WPVulnerability
  20. High 8.8

    CVE-2014-2550 · Disable Comments (WordPress plugin)

    Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]: Cross-Site Request Forgery (CSRF)

    Published 1 Aug 2014 · Fixed in 1.0.4 · WPVulnerability
  21. Medium 6.1

    CVE-2013-5988 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 2.0.3.1 · NVD, WPVulnerability
  22. High 8.8

    CVE-2013-2011 · WP Super Cache (WordPress plugin)

    WP Super Cache: Improper Encoding or Escaping of Output

    Published 1 Aug 2014 · Fixed in 1.3.2 · WPVulnerability
  23. Critical 9.8

    CVE-2013-2010 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Injection

    Published 1 Aug 2014 · Fixed in 0.9.2.9 · WPVulnerability
  24. High 8.8

    CVE-2013-2009 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 1 Aug 2014 · Fixed in 1.3.2 · WPVulnerability
  25. Medium 6.1

    CVE-2013-2008 · WP Super Cache (WordPress plugin)

    WP Super Cache: Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 1.3.1 · WPVulnerability
  26. Medium 6.1

    CVE-2011-5329 · Redirection (WordPress plugin)

    Redirection: Cross-site Scripting

    Published 1 Aug 2014 · Fixed in 2.2.9 · WPVulnerability
  27. Medium 6.8

    CVE-2014-0475 · GNU C Library

    Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

    Published 29 Jul 2014 · NVD
  28. Medium 4.9

    CVE-2014-3553 · Moodle

    mod/forum/classes/post_form.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce the moodle/site:accessallgroups capability requirement before proceeding with a post to all groups, which allows remote authenticated users to bypass intended access restrictions by leveraging two or more group memberships.

    Published 29 Jul 2014 · NVD
  29. Medium 6.0

    CVE-2014-3552 · Moodle

    The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.

    Published 29 Jul 2014 · NVD
  30. Low 3.5

    CVE-2014-3551 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.

    Published 29 Jul 2014 · NVD
  31. Medium 4.3

    CVE-2014-3550 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task.

    Published 29 Jul 2014 · NVD
  32. Medium 4.3

    CVE-2014-3549 · Moodle

    Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt.

    Published 29 Jul 2014 · NVD
  33. Medium 4.3

    CVE-2014-3548 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog.

    Published 29 Jul 2014 · NVD
  34. Medium 4.3

    CVE-2014-3547 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge.

    Published 29 Jul 2014 · NVD
  35. Medium 5.0

    CVE-2014-3546 · Moodle

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a modified URL.

    Published 29 Jul 2014 · NVD
  36. Medium 6.0

    CVE-2014-3545 · Moodle

    Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

    Published 29 Jul 2014 · NVD
  37. Low 3.5

    CVE-2014-3544 · Moodle

    Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.

    Published 29 Jul 2014 · NVD
  38. Medium 4.3

    CVE-2014-3543 · Moodle

    mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.

    Published 29 Jul 2014 · NVD
  39. Medium 4.3

    CVE-2014-3542 · Moodle

    mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    Published 29 Jul 2014 · NVD
  40. High 7.5

    CVE-2014-3541 · Moodle

    The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

    Published 29 Jul 2014 · NVD
  41. High 8.1Actively exploited

    CVE-2014-3120 · Elasticsearch

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

    Published 28 Jul 2014 · Fixed in 1.2.0 · NVD
  42. Medium 4.3

    CVE-2014-5108 · Concrete CMS

    Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

    Published 28 Jul 2014 · NVD
  43. Medium 5.0

    CVE-2014-5107 · Concrete CMS

    concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9)…

    Published 28 Jul 2014 · NVD
  44. High 7.5

    CVE-2014-5102 · vBulletin

    SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

    Published 25 Jul 2014 · NVD
  45. Medium 4.3

    CVE-2014-5022 · Drupal

    Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.

    Published 22 Jul 2014 · NVD
  46. Low 2.1

    CVE-2014-5021 · Drupal

    Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.

    Published 22 Jul 2014 · NVD
  47. Medium 4.9

    CVE-2014-5020 · Drupal

    The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.

    Published 22 Jul 2014 · NVD
  48. Medium 5.0

    CVE-2014-5019 · Drupal

    The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.

    Published 22 Jul 2014 · NVD
  49. Medium 4.3

    CVE-2014-5018 · LimeSurvey

    Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

    Published 21 Jul 2014 · NVD
  50. High 7.5

    CVE-2014-5017 · LimeSurvey

    SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter.

    Published 21 Jul 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.