UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,033
Published in 7 days
1,072
Critical in 30 days
352
Actively exploited
423

Latest vulnerabilities

40,033 vulnerabilities
  1. Low 3.6

    CVE-2012-6150 · Samba

    The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

    Published 3 Dec 2013 · Fixed in 3.6.22, 4.0.13, 4.1.3 · NVD
  2. Medium 5.8

    CVE-2014-0173 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 3 Dec 2013 · Fixed in 2.9.3 · NVD, WPVulnerability
  3. Medium 5.0

    CVE-2013-6712 · PHP

    The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

    Published 28 Nov 2013 · Fixed in 5.3.29, 5.4.24, 5.5.8 · NVD
  4. High 7.5

    CVE-2013-6875 · Nagios XI

    SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.

    Published 26 Nov 2013 · NVD
  5. Low 3.5

    CVE-2013-4525 · Moodle

    Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question.

    Published 26 Nov 2013 · NVD
  6. Medium 6.8

    CVE-2013-4524 · Moodle

    Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.

    Published 26 Nov 2013 · NVD
  7. Low 3.5

    CVE-2013-4523 · Moodle

    Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.

    Published 26 Nov 2013 · NVD
  8. Medium 5.0

    CVE-2013-4522 · Moodle

    lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.

    Published 26 Nov 2013 · NVD
  9. Medium 4.3

    CVE-2013-6870 · Splunk Enterprise

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 25 Nov 2013 · NVD
  10. Medium 4.3

    CVE-2013-4573 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php.

    Published 25 Nov 2013 · NVD
  11. Medium 6.8

    CVE-2013-4164 · Ruby

    Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

    Published 23 Nov 2013 · NVD
  12. High 7.5

    CVE-2013-4547 · nginx

    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

    Published 23 Nov 2013 · Fixed in 1.4.4 · NVD
  13. High 9.3

    CVE-2013-0869 · FFmpeg

    The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  14. High 9.3

    CVE-2013-0868 · FFmpeg

    libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."

    Published 23 Nov 2013 · NVD
  15. High 9.3

    CVE-2013-0867 · FFmpeg

    The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1.2 does not properly check when the pixel format changes, which allows remote attackers to have unspecified impact via crafted H.264 video data, related to an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  16. High 9.3

    CVE-2013-0866 · FFmpeg

    The aac_decode_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large number of channels in an AAC file, which triggers an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  17. High 9.3

    CVE-2013-0865 · FFmpeg

    The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write.

    Published 23 Nov 2013 · NVD
  18. High 10.0

    CVE-2013-0864 · FFmpeg

    The gif_copy_img_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which allows remote attackers to have an unspecified impact via crafted GIF data that triggers an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  19. High 9.3

    CVE-2013-0863 · FFmpeg

    Buffer overflow in the rle_decode function in libavcodec/sanm.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via crafted LucasArts Smush video data.

    Published 23 Nov 2013 · NVD
  20. High 9.3

    CVE-2013-0862 · FFmpeg

    Multiple integer overflows in the process_frame_obj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data, which triggers an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  21. Medium 5.0

    CVE-2013-0861 · FFmpeg

    The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout.

    Published 23 Nov 2013 · NVD
  22. Medium 4.3

    CVE-2013-0860 · FFmpeg

    The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.

    Published 23 Nov 2013 · NVD
  23. High 10.0

    CVE-2013-4265 · FFmpeg

    The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors related to a "wrong return code" and a resultant NULL pointer dereference.

    Published 23 Nov 2013 · NVD
  24. Medium 4.3

    CVE-2013-4264 · FFmpeg

    The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.

    Published 23 Nov 2013 · NVD
  25. High 7.5

    CVE-2013-4263 · FFmpeg

    libavfilter in FFmpeg before 2.0.1 has unspecified impact and remote vectors related to a crafted "plane," which triggers an out-of-bounds heap write.

    Published 23 Nov 2013 · NVD
  26. High 9.3

    CVE-2013-0878 · FFmpeg

    The advance_line function in libavcodec/targa.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Targa image data, related to an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  27. High 9.3

    CVE-2013-0877 · FFmpeg

    The old_codec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted LucasArts Smush data that has a large size when decoded, related to an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  28. High 9.3

    CVE-2013-0876 · FFmpeg

    Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via crafted LucasArts Smush data, which triggers an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  29. High 9.3

    CVE-2013-0875 · FFmpeg

    The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG image, related to an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  30. High 9.3

    CVE-2013-0874 · FFmpeg

    The (1) doubles2str and (2) shorts2str functions in libavcodec/tiff.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via a crafted TIFF image, related to an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  31. High 10.0

    CVE-2013-0873 · FFmpeg

    The read_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid channel count, related to "freeing invalid addresses."

    Published 23 Nov 2013 · NVD
  32. High 10.0

    CVE-2013-0872 · FFmpeg

    The swr_init function in libswresample/swresample.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid or unsupported (1) input or (2) output channel layout, related to an out-of-bounds array access.

    Published 23 Nov 2013 · NVD
  33. High 7.9

    CVE-2013-6375 · Xen

    Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."

    Published 23 Nov 2013 · NVD
  34. Medium 4.3

    CVE-2013-4545 · curl

    cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

    Published 23 Nov 2013 · NVD
  35. Medium 5.0

    CVE-2013-4560 · lighttpd

    Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.

    Published 20 Nov 2013 · Fixed in 1.4.33 · NVD
  36. High 7.6

    CVE-2013-4559 · lighttpd

    lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.

    Published 20 Nov 2013 · Fixed in 1.4.33 · NVD
  37. Low 3.5

    CVE-2013-5418 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

    Published 18 Nov 2013 · NVD
  38. Medium 4.3

    CVE-2013-5417 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote attackers to inject arbitrary web script or HTML via HTTP response data.

    Published 18 Nov 2013 · NVD
  39. Low 3.5

    CVE-2013-5414 · IBM WebSphere Application Server

    The migration functionality in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 does not properly support the distinction between the admin role and the adminsecmanager role, which allows remote authenticated users to gain privileges in opportunistic circumstances by accessing resources in between a migration and a role evaluation.

    Published 18 Nov 2013 · NVD
  40. Medium 4.3

    CVE-2013-4006 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.

    Published 18 Nov 2013 · NVD
  41. High 7.5

    CVE-2013-4557 · SPIP

    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.

    Published 18 Nov 2013 · NVD
  42. Medium 4.3

    CVE-2013-4556 · SPIP

    Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.

    Published 18 Nov 2013 · NVD
  43. Medium 6.8

    CVE-2013-4555 · SPIP

    Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.

    Published 18 Nov 2013 · NVD
  44. Medium 5.7

    CVE-2013-4551 · Xen

    Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."

    Published 18 Nov 2013 · NVD
  45. Medium 6.8

    CVE-2013-2114 · MediaWiki

    Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.

    Published 18 Nov 2013 · NVD
  46. Low 2.6

    CVE-2013-2061 · OpenVPN

    The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

    Published 18 Nov 2013 · NVD
  47. Medium 5.0

    CVE-2013-2032 · MediaWiki

    MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.

    Published 18 Nov 2013 · NVD
  48. Medium 4.3

    CVE-2013-2031 · MediaWiki

    MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.

    Published 18 Nov 2013 · NVD
  49. Medium 6.4

    CVE-2013-6682 · Cisco ASA and Firepower Threat Defense

    The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 certificates, which allows remote attackers to cause a denial of service (connection-database corruption) via an invalid entry, aka Bug ID CSCui33299.

    Published 13 Nov 2013 · NVD
  50. Medium 6.8

    CVE-2013-6357 · Apache Tomcat

    Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache…

    Published 13 Nov 2013 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.