Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 40,047
- Published in 7 days
- 1,084
- Critical in 30 days
- 353
- Actively exploited
- 423
Latest vulnerabilities
40,047 vulnerabilities- Medium 5.0
CVE-2012-6105 · Moodle
blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed.
Published 27 Jan 2013 · NVD - Medium 5.0
CVE-2012-6104 · Moodle
blog/rsslib.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by leveraging the guest role and reading an RSS feed.
Published 27 Jan 2013 · NVD - Medium 6.8
CVE-2012-6103 · Moodle
Multiple cross-site request forgery (CSRF) vulnerabilities in user/messageselect.php in the messaging system in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to hijack the authentication of arbitrary users for requests that send course messages.
Published 27 Jan 2013 · NVD - Medium 6.4
CVE-2012-6102 · Moodle
lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI.
Published 27 Jan 2013 · NVD - Medium 5.8
CVE-2012-6101 · Moodle
Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to (1) backup/backupfilesedit.php, (2) comment/comment_post.php, (3) course/switchrole.php, (4) mod/wiki/filesedit.php, (5) tag/coursetags_add.php, or (6) user/files.php.
Published 27 Jan 2013 · NVD - Medium 4.0
CVE-2012-6100 · Moodle
report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability requirement, which allows remote authenticated users to discover a hidden lastaccess value by reading an activity report.
Published 27 Jan 2013 · NVD - Medium 4.0
CVE-2012-6099 · Moodle
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
Published 27 Jan 2013 · NVD - Medium 4.0
CVE-2012-6098 · Moodle
grade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/grade:manage capability requirement, which allows remote authenticated users to convert custom outcomes into standard site-wide outcomes by leveraging the teacher role and using the re-editing feature.
Published 27 Jan 2013 · NVD - High 10.0
CVE-2013-0462 · IBM WebSphere Application Server
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors.
Published 27 Jan 2013 · NVD - Medium 4.3
CVE-2013-0461 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 27 Jan 2013 · NVD - Medium 6.8
CVE-2013-0460 · IBM WebSphere Application Server
Cross-site request forgery (CSRF) vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
Published 27 Jan 2013 · NVD - Medium 4.3
CVE-2013-0459 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 27 Jan 2013 · NVD - Medium 4.3
CVE-2013-0458 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 27 Jan 2013 · NVD - High 7.1
CVE-2012-5689 · BIND 9
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.
Published 25 Jan 2013 · NVD - Low 1.2
CVE-2012-6095 · ProFTPD
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
Published 24 Jan 2013 · NVD - High 7.5
CVE-2013-0209 · Movable Type
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
Published 23 Jan 2013 · NVD - Medium 6.5
CVE-2012-4414 · MariaDB, MySQL
Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that…
Published 22 Jan 2013 · NVD - Medium 5.0
CVE-2012-6113 · PHP
The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.
Published 19 Jan 2013 · NVD - Medium 6.3
CVE-2012-6395 · Cisco ASA and Firepower Threat Defense
Cisco Adaptive Security Appliances (ASA) devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service (device crash) via unknown vectors, aka Bug ID CSCuc65775.
Published 18 Jan 2013 · NVD - Medium 6.3
CVE-2012-5717 · Cisco ASA and Firepower Threat Defense
Cisco Adaptive Security Appliances (ASA) devices with firmware 8.x through 8.4(1) do not properly manage SSH sessions, which allows remote authenticated users to cause a denial of service (device crash) by establishing multiple sessions, aka Bug ID CSCtc59462.
Published 18 Jan 2013 · NVD - Low 3.5
CVE-2013-0172 · Samba
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
Published 17 Jan 2013 · NVD - High 7.8
CVE-2012-5419 · Cisco ASA and Firepower Threat Defense
Cisco Adaptive Security Appliance (ASA) software 8.7.1 and 8.7.1.1 for the Cisco ASA 1000V Cloud Firewall allows remote attackers to cause a denial of service (device reload) via a malformed H.225 H.323 IPv4 packet, aka Bug IDs CSCuc42812 and CSCuc88741.
Published 17 Jan 2013 · NVD - Medium 6.8
CVE-2013-0418 · Microsoft Exchange Server
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not commented on claims from an independent…
Published 17 Jan 2013 · NVD - Medium 6.8
CVE-2013-0389 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 6.8
CVE-2013-0386 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Stored Procedure.
Published 17 Jan 2013 · Fixed in 5.5.29 · NVD - Medium 6.6
CVE-2013-0385 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows local users to affect confidentiality and integrity via unknown vectors related to Server Replication.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 6.8
CVE-2013-0384 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Information Schema.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 4.3
CVE-2013-0383 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 5.4
CVE-2013-0375 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Server Replication.
Published 17 Jan 2013 · Fixed in 5.1.67, 5.2.14, 5.3.12 · NVD - Medium 4.0
CVE-2013-0371 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability, related to MyISAM.
Published 17 Jan 2013 · Fixed in 5.5.29 · NVD - Medium 4.0
CVE-2013-0368 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
Published 17 Jan 2013 · Fixed in 5.5.29 · NVD - Medium 4.0
CVE-2013-0367 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Partition.
Published 17 Jan 2013 · Fixed in 5.5.29 · NVD - Low 3.5
CVE-2012-5096 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users with Server Privileges to affect availability via unknown vectors.
Published 17 Jan 2013 · Fixed in 5.5.29 · NVD - Medium 6.8
CVE-2012-5060 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.65 and earlier and 5.5.27 and earlier allows remote authenticated users to affect availability, related to GIS Extension.
Published 17 Jan 2013 · Fixed in 5.1.66, 5.5.28 · NVD - Medium 4.0
CVE-2012-1705 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 5.0
CVE-2012-1702 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote attackers to affect availability via unknown vectors.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 4.0
CVE-2012-0578 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
Published 17 Jan 2013 · Fixed in 5.5.29 · NVD - Medium 4.0
CVE-2012-0574 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Medium 4.0
CVE-2012-0572 · MariaDB, MySQL
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
Published 17 Jan 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD - Critical 9.8Actively exploited
CVE-2013-0632 · Adobe ColdFusion
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
Published 17 Jan 2013 · NVD - High 10.0
CVE-2012-3174 · Java
Unspecified vulnerability in Oracle Java 7 before Update 11 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0422. NOTE: some parties have mapped CVE-2012-3174 to an issue involving recursive use of the Reflection API, but that issue is already covered as part of CVE-2013-0422. This identifier is for a…
Published 14 Jan 2013 · NVD - Low 1.9
CVE-2013-0154 · Xen
The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, when debugging is enabled, allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall.
Published 12 Jan 2013 · NVD - Critical 9.8Actively exploited
CVE-2013-0422 · Java
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a…
Published 10 Jan 2013 · NVD - High 7.5Actively exploited
CVE-2013-0631 · Adobe ColdFusion
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.
Published 9 Jan 2013 · NVD - High 7.5Actively exploited
CVE-2013-0629 · Adobe ColdFusion
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.
Published 9 Jan 2013 · NVD - Critical 9.8Actively exploited
CVE-2013-0625 · Adobe ColdFusion
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
Published 9 Jan 2013 · NVD - High 10.0
CVE-2011-3937 · FFmpeg
The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to "width/height changing with frame threads."
Published 5 Jan 2013 · NVD - Medium 6.0
CVE-2012-5653 · Drupal
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Published 3 Jan 2013 · NVD - Medium 5.0
CVE-2012-5652 · Drupal
Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.
Published 3 Jan 2013 · NVD - Medium 5.0
CVE-2012-5651 · Drupal
Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.
Published 3 Jan 2013 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.