UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,047
Published in 7 days
1,084
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,047 vulnerabilities
  1. Medium 4.0

    CVE-2012-1734 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

    Published 17 Jul 2012 · Fixed in 5.1.66, 5.5.24 · NVD
  2. Medium 4.0

    CVE-2012-1689 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

    Published 17 Jul 2012 · Fixed in 5.1.66, 5.5.23 · NVD
  3. Medium 4.0

    CVE-2012-0540 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier and 5.5.23 and earlier allows remote authenticated users to affect availability, related to GIS Extension.

    Published 17 Jul 2012 · Fixed in 5.1.66, 5.5.24 · NVD
  4. High 7.5

    CVE-2012-0801 · Moodle

    lib/formslib.php in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 does not properly handle multiple instances of a form element, which has unspecified impact and remote attack vectors.

    Published 17 Jul 2012 · NVD
  5. Low 2.1

    CVE-2012-0800 · Moodle

    The form-autocompletion functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 makes it easier for physically proximate attackers to discover passwords by reading the contents of a non-password field, as demonstrated by accessing a create-groups page with Safari on an iPad device.

    Published 17 Jul 2012 · NVD
  6. Medium 4.3

    CVE-2012-0799 · Moodle

    Moodle 2.0.x before 2.0.7 and 2.1.x before 2.1.4, when an anonymous front-page forum is enabled, allows remote attackers to obtain session keys for their sessions by visiting the front page.

    Published 17 Jul 2012 · NVD
  7. Medium 5.5

    CVE-2012-0798 · Moodle

    The self-enrolment functionality in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 allows remote authenticated users to obtain the manager role by leveraging the teacher role.

    Published 17 Jul 2012 · NVD
  8. Medium 5.5

    CVE-2012-0797 · Moodle

    The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token.

    Published 17 Jul 2012 · NVD
  9. Medium 4.0

    CVE-2012-0796 · Moodle

    class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.

    Published 17 Jul 2012 · NVD
  10. Medium 6.5

    CVE-2012-0795 · Moodle

    Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address.

    Published 17 Jul 2012 · NVD
  11. Medium 5.0

    CVE-2012-0794 · Moodle

    The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution.

    Published 17 Jul 2012 · NVD
  12. Medium 5.0

    CVE-2012-0793 · Moodle

    Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors.

    Published 17 Jul 2012 · NVD
  13. Medium 4.0

    CVE-2012-0792 · Moodle

    mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts.

    Published 17 Jul 2012 · NVD
  14. Medium 6.4

    CVE-2011-4297 · Moodle

    comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity.

    Published 16 Jul 2012 · NVD
  15. Medium 5.5

    CVE-2011-4296 · Moodle

    lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role.

    Published 16 Jul 2012 · NVD
  16. Medium 6.5

    CVE-2011-4295 · Moodle

    The moodle_enrol_external:role_assign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment.

    Published 16 Jul 2012 · NVD
  17. Medium 5.8

    CVE-2011-4294 · Moodle

    The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.

    Published 16 Jul 2012 · NVD
  18. Medium 6.4

    CVE-2011-4293 · Moodle

    The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors.

    Published 16 Jul 2012 · NVD
  19. Medium 4.0

    CVE-2011-4292 · Moodle

    Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted comments operations.

    Published 16 Jul 2012 · NVD
  20. Medium 4.0

    CVE-2011-4291 · Moodle

    Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted ratings operations.

    Published 16 Jul 2012 · NVD
  21. Medium 4.3

    CVE-2011-4290 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to URL encoding.

    Published 16 Jul 2012 · NVD
  22. Medium 4.0

    CVE-2011-4289 · Moodle

    Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page.

    Published 16 Jul 2012 · NVD
  23. Medium 4.0

    CVE-2011-4288 · Moodle

    Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.

    Published 16 Jul 2012 · NVD
  24. Medium 6.8

    CVE-2011-4287 · Moodle

    admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.

    Published 16 Jul 2012 · NVD
  25. Medium 4.3

    CVE-2011-4286 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.

    Published 16 Jul 2012 · NVD
  26. Medium 5.5

    CVE-2011-4285 · Moodle

    The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role.

    Published 16 Jul 2012 · NVD
  27. Medium 5.0

    CVE-2011-4284 · Moodle

    Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user-context page.

    Published 16 Jul 2012 · NVD
  28. Medium 5.0

    CVE-2011-4283 · Moodle

    Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.

    Published 16 Jul 2012 · NVD
  29. Medium 4.3

    CVE-2011-4282 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags_more.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sort or (2) show parameter.

    Published 16 Jul 2012 · NVD
  30. Medium 6.8

    CVE-2011-4281 · Moodle

    Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.

    Published 16 Jul 2012 · NVD
  31. Medium 4.3

    CVE-2011-4280 · Moodle

    Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 16 Jul 2012 · NVD
  32. Medium 5.0

    CVE-2011-4279 · Moodle

    Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search functionality of Google, Yahoo!, Wrensoft Zoom, MSN, Yandex, and AltaVista.

    Published 16 Jul 2012 · NVD
  33. Medium 4.3

    CVE-2011-4278 · Moodle

    Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 16 Jul 2012 · NVD
  34. Medium 6.8

    CVE-2011-4133 · Moodle

    Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.

    Published 16 Jul 2012 · NVD
  35. Medium 6.5

    CVE-2012-1037 · GLPI

    PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.

    Published 12 Jul 2012 · NVD
  36. Medium 5.0

    CVE-2011-4309 · Moodle

    Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL.

    Published 11 Jul 2012 · NVD
  37. Medium 4.0

    CVE-2011-4308 · Moodle

    mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.

    Published 11 Jul 2012 · NVD
  38. Medium 4.3

    CVE-2011-4307 · Moodle

    Cross-site scripting (XSS) vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

    Published 11 Jul 2012 · NVD
  39. Medium 4.3

    CVE-2011-4306 · Moodle

    Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.

    Published 11 Jul 2012 · NVD
  40. Medium 4.0

    CVE-2011-4305 · Moodle

    message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service (infinite request loop) via a URL that specifies a zero wait time for message refreshing.

    Published 11 Jul 2012 · NVD
  41. Medium 4.0

    CVE-2011-4304 · Moodle

    The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation.

    Published 11 Jul 2012 · NVD
  42. Medium 4.3

    CVE-2011-4303 · Moodle

    lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.

    Published 11 Jul 2012 · NVD
  43. Medium 6.8

    CVE-2011-4302 · Moodle

    mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate.

    Published 11 Jul 2012 · NVD
  44. Medium 5.0

    CVE-2011-4301 · Moodle

    The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.

    Published 11 Jul 2012 · NVD
  45. Medium 5.0

    CVE-2011-4300 · Moodle

    The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.

    Published 11 Jul 2012 · NVD
  46. Medium 4.3

    CVE-2011-4299 · Moodle

    Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.

    Published 11 Jul 2012 · NVD
  47. Medium 6.8

    CVE-2011-4298 · Moodle

    Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.

    Published 11 Jul 2012 · NVD
  48. High 7.8

    CVE-2012-1493 · F5 BIG-IP

    F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins…

    Published 9 Jul 2012 · NVD
  49. High 7.5

    CVE-2012-2386 · PHP

    Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

    Published 7 Jul 2012 · Fixed in 5.4.4 · NVD
  50. Medium 4.3

    CVE-2012-2143 · PHP, PostgreSQL

    The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a…

    Published 5 Jul 2012 · Fixed in 8.4.12, 9.0.8, 9.1.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.