UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
353
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. Medium 5.0

    CVE-2004-2587 · SmarterMail

    login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly due to a buffer overflow.

    Published 31 Dec 2004 · NVD
  2. Medium 5.0

    CVE-2004-2586 · SmarterMail

    Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename parameter.

    Published 31 Dec 2004 · NVD
  3. Medium 4.3

    CVE-2004-2585 · SmarterMail

    Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.

    Published 31 Dec 2004 · NVD
  4. Medium 4.0

    CVE-2004-2584 · SmarterMail

    frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name with a null byte ("%00"). NOTE: it is not clear whether this issue poses a vulnerability.

    Published 31 Dec 2004 · NVD
  5. High 7.8

    CVE-2004-2583 · SmarterMail

    SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.

    Published 31 Dec 2004 · NVD
  6. Medium 6.4

    CVE-2004-2546 · Samba

    Multiple memory leaks in Samba before 3.0.6 allow attackers to cause a denial of service (memory consumption).

    Published 31 Dec 2004 · NVD
  7. High 7.2

    CVE-2004-2343 · Apache HTTP Server

    Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations…

    Published 31 Dec 2004 · NVD
  8. Medium 4.3

    CVE-2004-2325 · DNN Platform

    Cross-site scripting (XSS) vulnerability in EditModule.aspx for DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to inject arbitrary web script or HTML.

    Published 31 Dec 2004 · NVD
  9. High 7.5

    CVE-2004-2324 · DNN Platform

    SQL injection vulnerability in DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to modify the backend database via the (1) table and (2) field parameters in LinkClick.aspx.

    Published 31 Dec 2004 · NVD
  10. Medium 5.0

    CVE-2004-2323 · DNN Platform

    DotNetNuke (formerly IBuySpy Workshop) 1.0.6 through 1.0.10d allows remote attackers to obtain sensitive information, including the SQL server username and password, via a GET request for source or configuration files such as Web.config.

    Published 31 Dec 2004 · NVD
  11. Medium 4.3

    CVE-2004-2308 · cPanel & WHM

    Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html.

    Published 31 Dec 2004 · NVD
  12. High 10.0

    CVE-2004-2237 · Moodle

    Unknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle texts."

    Published 31 Dec 2004 · NVD
  13. High 10.0

    CVE-2004-2236 · Moodle

    Unknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting.

    Published 31 Dec 2004 · NVD
  14. High 10.0

    CVE-2004-2235 · Moodle

    Unknown vulnerability in Moodle before 1.2 has unknown impact and attack vectors, related to improper filtering of text.

    Published 31 Dec 2004 · NVD
  15. High 10.0

    CVE-2004-2233 · Moodle

    Unknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors.

    Published 31 Dec 2004 · NVD
  16. High 7.5

    CVE-2004-2232 · Moodle

    SQL injection vulnerability in sql.php in the Glossary module in Moodle 1.4.1 and earlier allows remote attackers to modify SQL statements.

    Published 31 Dec 2004 · NVD
  17. Medium 5.0

    CVE-2004-2187 · MediaWiki

    Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.

    Published 31 Dec 2004 · NVD
  18. High 7.5

    CVE-2004-2186 · MediaWiki

    SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance.

    Published 31 Dec 2004 · NVD
  19. Medium 6.8

    CVE-2004-2185 · MediaWiki

    Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6) ImagePage.

    Published 31 Dec 2004 · NVD
  20. Medium 4.3

    CVE-2004-2152 · MediaWiki

    Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML.

    Published 31 Dec 2004 · NVD
  21. Medium 5.0

    CVE-2004-2149 · MySQL

    Buffer overflow in the prepared statements API in libmysqlclient for MySQL 4.1.3 beta and 4.1.4 allows remote attackers to cause a denial of service via a large number of placeholders.

    Published 31 Dec 2004 · NVD
  22. Medium 5.0

    CVE-2004-2069 · OpenSSH

    sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption).

    Published 31 Dec 2004 · NVD
  23. High 7.2

    CVE-2004-1885 · WS_FTP Server

    Ipswitch WS_FTP Server 4.0.2 allows remote authenticated users to execute arbitrary programs as SYSTEM by using the SITE command to modify certain iFtpSvc options that are handled by iftpmgr.exe.

    Published 31 Dec 2004 · NVD
  24. High 7.2

    CVE-2004-1883 · WS_FTP Server

    Multiple buffer overflows in Ipswitch WS_FTP Server 4.0.2 (1) allow remote authenticated users to execute arbitrary code by causing a large error string to be generated by the ALLO handler, or (2) may allow remote FTP administrators to execute arbitrary code by causing a long hostname or username to be inserted into a reply to a STAT command while a file is being transferred.

    Published 31 Dec 2004 · NVD
  25. Medium 5.0

    CVE-2004-1848 · WS_FTP Server

    Ipswitch WS_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a REST command with a large size argument, followed by a STOR of a smaller file.

    Published 31 Dec 2004 · NVD
  26. Medium 5.0

    CVE-2004-1584 · WordPress

    CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.

    Published 31 Dec 2004 · NVD
  27. Medium 4.3

    CVE-2004-1559 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter…

    Published 31 Dec 2004 · NVD
  28. High 7.5

    CVE-2004-1468 · Webmin

    The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.

    Published 31 Dec 2004 · NVD
  29. Low 2.1

    CVE-2004-1453 · GNU C Library

    GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.

    Published 31 Dec 2004 · NVD
  30. Medium 5.0

    CVE-2004-1425 · Moodle

    Directory traversal vulnerability in file.php in Moodle 1.4.2 and earlier allows remote attackers to read arbitrary session files for known session IDs via a .. (dot dot) in the file parameter.

    Published 31 Dec 2004 · NVD
  31. Medium 4.3

    CVE-2004-1424 · Moodle

    Cross-site scripting (XSS) vulnerability in view.php in Moodle 1.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.

    Published 31 Dec 2004 · NVD
  32. High 7.5

    CVE-2004-1405 · MediaWiki

    MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.

    Published 31 Dec 2004 · NVD
  33. Medium 5.0

    CVE-2004-1392 · PHP

    PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

    Published 31 Dec 2004 · NVD
  34. Low 2.1

    CVE-2004-1387 · Apache HTTP Server

    The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.

    Published 31 Dec 2004 · NVD
  35. Low 2.1

    CVE-2004-1382 · GNU C Library

    The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.

    Published 31 Dec 2004 · NVD
  36. Medium 5.0

    CVE-2004-0829 · Samba

    smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous FindFirstPrintChangeNotify, as demonstrated by the SMB client in Windows XP SP2.

    Published 31 Dec 2004 · NVD
  37. High 7.5

    CVE-2004-0817 · ImageMagick

    Multiple heap-based buffer overflows in the imlib BMP image handler allow remote attackers to execute arbitrary code via a crafted BMP file.

    Published 31 Dec 2004 · NVD
  38. High 7.5

    CVE-2004-0811 · Apache HTTP Server

    Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.

    Published 31 Dec 2004 · NVD
  39. Medium 5.0

    CVE-2004-0808 · Samba

    The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier, when domain logons are enabled, allows remote attackers to cause a denial of service via a SAM_UAS_CHANGE request with a length value that is larger than the number of structures that are provided.

    Published 31 Dec 2004 · NVD
  40. Medium 5.1

    CVE-2004-0802 · ImageMagick

    Buffer overflow in the BMP loader in imlib2 before 1.1.2 allows remote attackers to execute arbitrary code via a specially-crafted BMP image, a different vulnerability than CVE-2004-0817.

    Published 31 Dec 2004 · NVD
  41. High 7.8

    CVE-2004-0346 · ProFTPD

    Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.

    Published 23 Nov 2004 · Fixed in 1.2.9 · NVD
  42. Medium 5.0

    CVE-2004-0263 · Apache HTTP Server

    PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.

    Published 23 Nov 2004 · NVD
  43. Medium 4.3

    CVE-2004-0203 · Microsoft Exchange Server

    Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.

    Published 23 Nov 2004 · NVD
  44. Medium 5.0

    CVE-2004-0112 · LiteSpeed Web Server, OpenSSL

    The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.

    Published 23 Nov 2004 · NVD
  45. Medium 5.0

    CVE-2004-0081 · OpenSSL

    OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.

    Published 23 Nov 2004 · NVD
  46. High 7.5

    CVE-2004-0079 · OpenSSL

    The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

    Published 23 Nov 2004 · NVD
  47. Low 2.1

    CVE-2004-0959 · PHP

    rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified.

    Published 3 Nov 2004 · NVD
  48. Medium 5.0

    CVE-2004-0958 · PHP

    php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.

    Published 3 Nov 2004 · NVD
  49. High 7.5

    CVE-2004-0885 · Apache HTTP Server

    The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.

    Published 3 Nov 2004 · NVD
  50. High 10.0

    CVE-2004-0840 · Microsoft Exchange Server

    The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.

    Published 3 Nov 2004 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.