UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,025
Published in 7 days
1,067
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,025 vulnerabilities
  1. Medium 5.0

    CVE-2014-2324 · lighttpd

    Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

    Published 14 Mar 2014 · Fixed in 1.4.35 · NVD
  2. Critical 9.8

    CVE-2014-2323 · lighttpd

    SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

    Published 14 Mar 2014 · Fixed in 1.4.35 · NVD
  3. Medium 4.3

    CVE-2014-2270 · PHP

    softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.

    Published 14 Mar 2014 · Fixed in 5.4.26, 5.5.10 · NVD
  4. Medium 5.8

    CVE-2013-6442 · Samba

    The owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown or --chgrp option, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended administrative change.

    Published 14 Mar 2014 · NVD
  5. Medium 5.0

    CVE-2013-4496 · Samba

    Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.

    Published 14 Mar 2014 · Fixed in 3.6.23, 4.0.16, 4.1.6 · NVD
  6. Medium 4.3

    CVE-2013-7335 · DNN Platform

    Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

    Published 12 Mar 2014 · NVD
  7. Medium 4.3

    CVE-2013-4649 · DNN Platform

    Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.

    Published 12 Mar 2014 · NVD
  8. Low 3.5

    CVE-2013-3943 · DNN Platform

    Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile.

    Published 12 Mar 2014 · NVD
  9. High 7.8

    CVE-2014-0101 · F5 BIG-IP

    The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO…

    Published 11 Mar 2014 · NVD
  10. Medium 5.0

    CVE-2014-0094 · Apache Struts

    The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.

    Published 11 Mar 2014 · Fixed in 2.3.16.1 · NVD
  11. Medium 4.3

    CVE-2014-2314 · Jira

    Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.

    Published 9 Mar 2014 · NVD
  12. Medium 4.3

    CVE-2014-2313 · Jira

    Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors.

    Published 9 Mar 2014 · NVD
  13. Medium 6.4

    CVE-2012-6619 · MongoDB

    The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

    Published 6 Mar 2014 · NVD
  14. High 7.5

    CVE-2013-6668 · Node.js

    Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

    Published 5 Mar 2014 · Fixed in 0.10.31 · NVD
  15. Medium 4.3

    CVE-2014-1840 · MyBB

    Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message.

    Published 3 Mar 2014 · NVD
  16. Medium 4.3

    CVE-2014-2244 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.

    Published 2 Mar 2014 · NVD
  17. Medium 5.8

    CVE-2014-2243 · MediaWiki

    includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.

    Published 2 Mar 2014 · NVD
  18. Medium 4.3

    CVE-2014-2242 · MediaWiki

    includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

    Published 2 Mar 2014 · NVD
  19. Medium 6.8

    CVE-2014-2099 · FFmpeg

    The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data.

    Published 2 Mar 2014 · NVD
  20. Medium 6.8

    CVE-2014-2098 · FFmpeg

    libavcodec/wmalosslessdec.c in FFmpeg before 2.1.4 uses an incorrect data-structure size for certain coefficients, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted WMA data.

    Published 2 Mar 2014 · NVD
  21. Medium 6.8

    CVE-2014-2097 · FFmpeg

    The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before 2.1.4 does not properly validate a certain bits-per-sample value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted TAK (aka Tom's lossless Audio Kompressor) data.

    Published 2 Mar 2014 · NVD
  22. Medium 6.8

    CVE-2014-2263 · FFmpeg

    The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.

    Published 1 Mar 2014 · NVD
  23. High 7.5

    CVE-2014-1912 · Python

    Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

    Published 1 Mar 2014 · NVD
  24. Low 3.5

    CVE-2014-2067 · Jenkins

    Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."

    Published 1 Mar 2014 · NVD
  25. Medium 6.5

    CVE-2014-2059 · Jenkins

    Directory traversal vulnerability in the CLI job creation (hudson/cli/CreateJobCommand.java) in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to overwrite arbitrary files via the job name.

    Published 1 Mar 2014 · NVD
  26. Medium 4.3

    CVE-2014-0033 · Apache Tomcat

    org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

    Published 26 Feb 2014 · NVD
  27. Medium 4.3

    CVE-2013-4590 · Apache Tomcat

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    Published 26 Feb 2014 · NVD
  28. Medium 4.3

    CVE-2013-4322 · Apache Tomcat

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for…

    Published 26 Feb 2014 · NVD
  29. Medium 5.8

    CVE-2013-4286 · Apache Tomcat

    Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a…

    Published 26 Feb 2014 · NVD
  30. Medium 5.0

    CVE-2014-2265 · Contact Form 7

    Vulnerability in Contact Form 7

    Published 26 Feb 2014 · Fixed in 3.7.2 · NVD, WPVulnerability
  31. Medium 4.3

    CVE-2014-0739 · Cisco ASA and Firepower Threat Defense

    Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766.

    Published 22 Feb 2014 · NVD
  32. Low 3.5

    CVE-2014-1879 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.

    Published 20 Feb 2014 · NVD
  33. Medium 5.0

    CVE-2014-1943 · PHP

    Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.

    Published 18 Feb 2014 · Fixed in 5.4.26, 5.5.10 · NVD
  34. Medium 5.0

    CVE-2014-2020 · PHP

    ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.

    Published 18 Feb 2014 · NVD
  35. Medium 5.8

    CVE-2013-7328 · PHP

    Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allow remote attackers to cause a denial of service (application crash) or obtain sensitive information via an imagecrop function call with a negative value for the (1) x or (2) y dimension, a different vulnerability than CVE-2013-7226.

    Published 18 Feb 2014 · NVD
  36. Medium 6.8

    CVE-2013-7327 · PHP

    The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via invalid imagecrop arguments that lead to use of a NULL pointer as a return value, a different vulnerability than CVE-2013-7226.

    Published 18 Feb 2014 · NVD
  37. Medium 6.8

    CVE-2013-7226 · PHP

    Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an imagecrop function call with a large x dimension value, leading to a heap-based buffer overflow.

    Published 18 Feb 2014 · NVD
  38. Low 2.1

    CVE-2013-0346 · Apache Tomcat

    Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."

    Published 15 Feb 2014 · NVD
  39. Medium 5.0

    CVE-2012-1171 · PHP

    The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper.

    Published 15 Feb 2014 · NVD
  40. Medium 4.6

    CVE-2014-1950 · Xen

    Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.

    Published 14 Feb 2014 · NVD
  41. Medium 4.4

    CVE-2014-1876 · Java

    The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.

    Published 10 Feb 2014 · NVD
  42. Medium 4.4

    CVE-2013-6024 · F5 BIG-IP

    The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.x, and FirePass 7.0.0 allow attackers to obtain sensitive information from process memory via unspecified vectors.

    Published 10 Feb 2014 · NVD
  43. Medium 6.8

    CVE-2012-3406 · GNU C Library

    The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a…

    Published 10 Feb 2014 · NVD
  44. Medium 5.0

    CVE-2012-3405 · GNU C Library

    The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers…

    Published 10 Feb 2014 · NVD
  45. Medium 5.0

    CVE-2012-3404 · GNU C Library

    The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.

    Published 10 Feb 2014 · NVD
  46. Medium 5.0

    CVE-2013-1904 · Roundcube

    Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

    Published 8 Feb 2014 · NVD
  47. Medium 4.3

    CVE-2013-1880 · Apache ActiveMQ

    Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.

    Published 5 Feb 2014 · NVD
  48. Low 3.5

    CVE-2014-1458 · Fortinet FortiWeb

    Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors.

    Published 4 Feb 2014 · NVD
  49. Medium 4.3

    CVE-2013-7182 · Fortinet FortiOS

    Cross-site scripting (XSS) vulnerability in firewall/schedule/recurrdlg in Fortinet FortiOS 5.0.5 allows remote attackers to inject arbitrary web script or HTML via the mkey parameter.

    Published 4 Feb 2014 · NVD
  50. Medium 4.3

    CVE-2013-7181 · Fortinet FortiWeb

    Cross-site scripting (XSS) vulnerability in user/ldap_user/add in Fortinet FortiOS 5.0.3 allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

    Published 4 Feb 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.