UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. High 10.0

    CVE-2004-1769 · cPanel & WHM

    The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

    Published 11 Mar 2004 · NVD
  2. Medium 5.0

    CVE-2004-0129 · phpMyAdmin

    Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter.

    Published 3 Mar 2004 · NVD
  3. High 7.5

    CVE-2004-0082 · Samba

    The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.

    Published 3 Mar 2004 · NVD
  4. High 7.5

    CVE-2003-0987 · Apache HTTP Server

    mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.

    Published 3 Mar 2004 · NVD
  5. High 7.5

    CVE-2004-1082 · Apache HTTP Server

    mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.

    Published 3 Feb 2004 · NVD
  6. Medium 6.0

    CVE-2003-0904 · Microsoft Exchange Server

    Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.

    Published 20 Jan 2004 · NVD
  7. Medium 6.5

    CVE-2003-1564 · libxml2

    libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

    Published 31 Dec 2003 · Fixed in 2.5.0 · NVD
  8. High 7.6

    CVE-2003-1562 · OpenSSH

    sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

    Published 31 Dec 2003 · NVD
  9. High 7.5

    CVE-2003-1530 · phpBB

    SQL injection vulnerability in privmsg.php in phpBB 2.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the mark[] parameter.

    Published 31 Dec 2003 · NVD
  10. Medium 4.3

    CVE-2003-1480 · MySQL

    MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods.

    Published 31 Dec 2003 · NVD
  11. Low 1.9

    CVE-2003-1447 · IBM WebSphere Application Server

    IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.

    Published 31 Dec 2003 · NVD
  12. Low 3.3

    CVE-2003-1426 · cPanel & WHM

    Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.

    Published 31 Dec 2003 · NVD
  13. High 10.0

    CVE-2003-1425 · cPanel & WHM

    guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

    Published 31 Dec 2003 · NVD
  14. Medium 4.3

    CVE-2003-1418 · Apache HTTP Server

    Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).

    Published 31 Dec 2003 · NVD
  15. High 7.5

    CVE-2003-1332 · Samba

    Stack-based buffer overflow in the reply_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2003-0201.

    Published 31 Dec 2003 · NVD
  16. Medium 4.0

    CVE-2003-1331 · MySQL

    Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysqlclient) 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453.

    Published 31 Dec 2003 · NVD
  17. Medium 4.3

    CVE-2003-1307 · Apache HTTP Server

    The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by…

    Published 31 Dec 2003 · NVD
  18. Medium 5.0

    CVE-2003-1303 · PHP

    Buffer overflow in the imap_fetch_overview function in the IMAP functionality (php_imap.c) in PHP before 4.3.3 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long e-mail address in a (1) To or (2) From header.

    Published 31 Dec 2003 · NVD
  19. Medium 5.0

    CVE-2003-1302 · PHP

    The IMAP functionality in PHP before 4.3.1 allows remote attackers to cause a denial of service via an e-mail message with a (1) To or (2) From header with an address that contains a large number of "\" (backslash) characters.

    Published 31 Dec 2003 · NVD
  20. High 7.5

    CVE-2003-1229 · Java

    X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely…

    Published 31 Dec 2003 · NVD
  21. High 7.5

    CVE-2003-0249 · PHP

    PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script…

    Published 31 Dec 2003 · NVD
  22. Medium 4.3

    CVE-2003-0914 · BIND 9

    ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.

    Published 15 Dec 2003 · NVD
  23. Medium 4.9

    CVE-2003-0859 · GNU C Library

    The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.

    Published 15 Dec 2003 · NVD
  24. Medium 5.0

    CVE-2003-0851 · OpenSSL

    OpenSSL 0.9.6k allows remote attackers to cause a denial of service (crash via large recursion) via malformed ASN.1 sequences.

    Published 1 Dec 2003 · NVD
  25. Medium 5.0

    CVE-2003-0866 · Apache Tomcat

    The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

    Published 17 Nov 2003 · NVD
  26. High 7.5

    CVE-2003-0863 · PHP

    The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.

    Published 17 Nov 2003 · NVD
  27. High 10.0

    CVE-2003-0861 · PHP

    Integer overflows in (1) base64_encode and (2) the GD library for PHP before 4.3.3 have unknown impact and unknown attack vectors.

    Published 17 Nov 2003 · NVD
  28. High 10.0

    CVE-2003-0860 · PHP

    Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.

    Published 17 Nov 2003 · NVD
  29. High 7.5

    CVE-2003-0787 · OpenSSH

    The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.

    Published 17 Nov 2003 · NVD
  30. High 10.0

    CVE-2003-0786 · OpenSSH

    The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.

    Published 17 Nov 2003 · NVD
  31. High 7.5

    CVE-2003-0714 · Microsoft Exchange Server

    The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.

    Published 17 Nov 2003 · NVD
  32. Medium 4.3

    CVE-2003-0712 · Microsoft Exchange Server

    Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

    Published 17 Nov 2003 · NVD
  33. Critical 9.8

    CVE-2003-0545 · OpenSSL

    Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding.

    Published 17 Nov 2003 · NVD
  34. Medium 5.0

    CVE-2003-0544 · OpenSSL

    OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.

    Published 17 Nov 2003 · NVD
  35. Medium 5.0

    CVE-2003-0543 · OpenSSL

    Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.

    Published 17 Nov 2003 · NVD
  36. Medium 5.0

    CVE-2002-1568 · OpenSSL

    OpenSSL 0.9.6e uses assertions when detecting buffer overflow attacks instead of less severe mechanisms, which allows remote attackers to cause a denial of service (crash) via certain messages that cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which are not properly handled in s2_srvr.c.

    Published 17 Nov 2003 · NVD
  37. High 7.5

    CVE-2003-0901 · PostgreSQL

    Buffer overflow in to_ascii for PostgreSQL 7.2.x, and 7.3.x before 7.3.4, allows remote attackers to execute arbitrary code.

    Published 3 Nov 2003 · NVD
  38. High 10.0

    CVE-2003-0789 · Apache HTTP Server

    mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.

    Published 3 Nov 2003 · Fixed in 2.0.48 · NVD
  39. High 7.2

    CVE-2003-0542 · Apache HTTP Server

    Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.

    Published 3 Nov 2003 · NVD
  40. High 7.5

    CVE-2003-0695 · OpenSSH

    Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693.

    Published 6 Oct 2003 · NVD
  41. High 7.5

    CVE-2003-0682 · OpenSSH

    "Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695.

    Published 6 Oct 2003 · NVD
  42. Medium 6.8

    CVE-2002-1567 · Apache Tomcat

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

    Published 6 Oct 2003 · NVD
  43. High 9.0

    CVE-2003-0780 · MySQL

    Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

    Published 22 Sept 2003 · NVD
  44. High 7.5

    CVE-2003-0772 · WS_FTP Server

    Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long (1) APPE (append) or (2) STAT (status) arguments.

    Published 22 Sept 2003 · NVD
  45. High 10.0

    CVE-2003-0693 · OpenSSH

    A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.

    Published 22 Sept 2003 · NVD
  46. Medium 5.0

    CVE-2003-0460 · Apache HTTP Server

    The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.

    Published 27 Aug 2003 · NVD
  47. High 7.5

    CVE-2003-0555 · ImageMagick

    ImageMagick 5.4.3.x and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a "%x" filename, possibly triggering a format string vulnerability.

    Published 18 Aug 2003 · NVD
  48. Medium 6.8

    CVE-2003-0521 · cPanel & WHM

    Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.

    Published 18 Aug 2003 · NVD
  49. Medium 5.0

    CVE-2003-0254 · Apache HTTP Server

    Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.

    Published 18 Aug 2003 · NVD
  50. Medium 5.0

    CVE-2003-0253 · Apache HTTP Server

    The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.

    Published 18 Aug 2003 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.