UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,046
Published in 7 days
1,085
Critical in 30 days
352
Actively exploited
423

Latest vulnerabilities

40,046 vulnerabilities
  1. Medium 6.8

    CVE-2013-2067 · Apache Tomcat

    java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a…

    Published 1 Jun 2013 · NVD
  2. Medium 5.0

    CVE-2012-3544 · Apache Tomcat

    Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

    Published 1 Jun 2013 · NVD
  3. High 7.5

    CVE-2013-3735 · PHP

    The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php…

    Published 31 May 2013 · NVD
  4. Medium 4.3

    CVE-2013-0482 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, related to a "Signature Wrap attack," a different vulnerability than CVE-2011-1377 and CVE-2013-0489.

    Published 29 May 2013 · NVD
  5. Medium 5.0

    CVE-2013-2083 · Moodle

    The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.

    Published 25 May 2013 · NVD
  6. Medium 5.0

    CVE-2013-2082 · Moodle

    Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.

    Published 25 May 2013 · NVD
  7. Medium 4.3

    CVE-2013-2081 · Moodle

    Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.

    Published 25 May 2013 · NVD
  8. Medium 4.0

    CVE-2013-2080 · Moodle

    The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.

    Published 25 May 2013 · NVD
  9. Medium 4.0

    CVE-2013-2079 · Moodle

    mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.

    Published 25 May 2013 · NVD
  10. Medium 6.9

    CVE-2013-1964 · Xen

    Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possibly have other impacts via unspecified vectors.

    Published 21 May 2013 · NVD
  11. High 10.0

    CVE-2013-1389 · Adobe ColdFusion

    Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.

    Published 16 May 2013 · NVD
  12. Medium 4.3

    CVE-2013-2021 · ClamAV

    pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

    Published 13 May 2013 · NVD
  13. Medium 5.0

    CVE-2013-2020 · ClamAV

    Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.

    Published 13 May 2013 · NVD
  14. Low 1.9

    CVE-2013-1952 · Xen

    Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.

    Published 13 May 2013 · NVD
  15. Low 3.3

    CVE-2013-1922 · Xen

    qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.

    Published 13 May 2013 · NVD
  16. Medium 4.7

    CVE-2013-1919 · Xen

    Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."

    Published 13 May 2013 · NVD
  17. Medium 4.7

    CVE-2013-1918 · Xen

    Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."

    Published 13 May 2013 · NVD
  18. Low 1.9

    CVE-2013-1917 · Xen

    Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.

    Published 13 May 2013 · NVD
  19. Medium 6.5

    CVE-2013-3522 · vBulletin

    SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.

    Published 10 May 2013 · NVD
  20. Medium 5.0

    CVE-2013-3336 · Adobe ColdFusion

    Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.

    Published 9 May 2013 · NVD
  21. Medium 4.3

    CVE-2013-3267 · Joomla!

    Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 3 May 2013 · NVD
  22. Medium 5.5

    CVE-2013-3242 · Joomla!

    plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.

    Published 3 May 2013 · NVD
  23. Medium 4.3

    CVE-2013-3059 · Joomla!

    Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 3 May 2013 · NVD
  24. Medium 4.3

    CVE-2013-3058 · Joomla!

    Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 3 May 2013 · NVD
  25. Medium 4.0

    CVE-2013-3057 · Joomla!

    Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.

    Published 3 May 2013 · NVD
  26. Medium 4.0

    CVE-2013-3056 · Joomla!

    Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.

    Published 3 May 2013 · NVD
  27. Medium 4.3

    CVE-2012-4481 · Ruby

    The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.

    Published 2 May 2013 · NVD
  28. Medium 6.8

    CVE-2012-0864 · GNU C Library

    Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments.

    Published 2 May 2013 · NVD
  29. Medium 5.0

    CVE-2011-4609 · GNU C Library

    The svc_run function in the RPC implementation in glibc before 2.15 allows remote attackers to cause a denial of service (CPU consumption) via a large number of RPC connections.

    Published 2 May 2013 · NVD
  30. Medium 6.8

    CVE-2009-5029 · GNU C Library

    Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.

    Published 2 May 2013 · NVD
  31. Unrated

    WPV-b7d84268101e · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 May 2013 · Fixed in 0.9.2.9 · WPVulnerability
  32. Medium 5.0

    CVE-2013-1944 · curl

    The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

    Published 29 Apr 2013 · NVD
  33. Medium 5.0

    CVE-2013-1914 · GNU C Library

    Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.

    Published 29 Apr 2013 · NVD
  34. Medium 4.0

    CVE-2013-3241 · phpMyAdmin

    export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request.

    Published 26 Apr 2013 · NVD
  35. Medium 6.5

    CVE-2013-3240 · phpMyAdmin

    Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type.

    Published 26 Apr 2013 · NVD
  36. Medium 4.6

    CVE-2013-3239 · phpMyAdmin

    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.

    Published 26 Apr 2013 · NVD
  37. Medium 6.0

    CVE-2013-3238 · phpMyAdmin

    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.

    Published 26 Apr 2013 · NVD
  38. High 7.5

    CVE-2013-1969 · libxml2

    Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.

    Published 25 Apr 2013 · NVD
  39. High 7.5

    CVE-2013-1915 · ModSecurity

    ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.

    Published 25 Apr 2013 · Fixed in 2.7.3 · NVD
  40. Medium 4.3

    CVE-2013-0338 · libxml2

    libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.

    Published 25 Apr 2013 · NVD
  41. Medium 5.0

    CVE-2012-4466 · Ruby

    Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

    Published 25 Apr 2013 · NVD
  42. Medium 5.0

    CVE-2012-4464 · Ruby

    Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466. NOTE: this issue might exist because of a CVE-2011-1005 regression.

    Published 25 Apr 2013 · NVD
  43. Medium 4.3

    CVE-2013-0565 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in the RPC adapter for the Web 2.0 and Mobile toolkit in IBM WebSphere Application Server (WAS) 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted response.

    Published 24 Apr 2013 · NVD
  44. Medium 4.0

    CVE-2013-0544 · IBM WebSphere Application Server

    Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.

    Published 24 Apr 2013 · NVD
  45. Medium 6.8

    CVE-2013-0543 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

    Published 24 Apr 2013 · NVD
  46. Medium 4.3

    CVE-2013-0542 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values.

    Published 24 Apr 2013 · NVD
  47. Low 1.9

    CVE-2013-0541 · IBM WebSphere Application Server

    Buffer overflow in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry is used in conjunction with WebSphere Identity Manger (WIM), allows local users to cause a denial of service (daemon crash) via unspecified vectors.

    Published 24 Apr 2013 · NVD
  48. Low 3.5

    CVE-2013-0540 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.

    Published 24 Apr 2013 · NVD
  49. Unrated

    WPV-461ca88e6b36 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 24 Apr 2013 · Fixed in 1.3 · WPVulnerability
  50. Medium 6.4

    CVE-2013-3060 · Apache ActiveMQ

    The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

    Published 21 Apr 2013 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.