UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. Medium 5.0

    CVE-2002-2212 · BIND 9

    The DNS resolver in unspecified versions of Fujitsu UXP/V, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more…

    Published 31 Dec 2002 · NVD
  2. Medium 5.0

    CVE-2002-2211 · BIND 9

    BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.

    Published 31 Dec 2002 · NVD
  3. High 10.0

    CVE-2002-2201 · Webmin

    The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name.

    Published 31 Dec 2002 · NVD
  4. High 7.5

    CVE-2002-2196 · Samba

    Samba before 2.2.5 does not properly terminate the enum_csc_policy data structure, which may allow remote attackers to execute arbitrary code via a buffer overflow attack.

    Published 31 Dec 2002 · NVD
  5. Medium 5.0

    CVE-2002-2103 · Apache HTTP Server

    Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.

    Published 31 Dec 2002 · NVD
  6. High 7.5

    CVE-2002-2029 · Apache HTTP Server

    PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.

    Published 31 Dec 2002 · NVD
  7. Medium 5.0

    CVE-2002-2012 · Apache HTTP Server

    Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.

    Published 31 Dec 2002 · NVD
  8. Medium 5.0

    CVE-2002-2009 · Apache Tomcat

    Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.

    Published 31 Dec 2002 · NVD
  9. Medium 5.0

    CVE-2002-2008 · Apache Tomcat

    Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.

    Published 31 Dec 2002 · NVD
  10. Medium 5.0

    CVE-2002-2007 · Apache Tomcat

    The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

    Published 31 Dec 2002 · NVD
  11. Medium 5.0

    CVE-2002-2006 · Apache Tomcat

    The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

    Published 31 Dec 2002 · NVD
  12. Medium 4.3

    CVE-2002-1954 · PHP

    Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinfo.php.

    Published 31 Dec 2002 · NVD
  13. Medium 6.4

    CVE-2002-1947 · Webmin

    Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session.

    Published 31 Dec 2002 · NVD
  14. High 7.5

    CVE-2002-1923 · MySQL

    The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to conduct activities without detection.

    Published 31 Dec 2002 · NVD
  15. High 7.5

    CVE-2002-1921 · MySQL

    The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database.

    Published 31 Dec 2002 · NVD
  16. Medium 5.0

    CVE-2002-1908 · Microsoft IIS

    Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of "/" (forward slash) characters.

    Published 31 Dec 2002 · NVD
  17. Medium 5.0

    CVE-2002-1895 · Apache Tomcat

    The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.

    Published 31 Dec 2002 · NVD
  18. Low 2.1

    CVE-2002-1876 · Microsoft Exchange Server

    Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS.

    Published 31 Dec 2002 · NVD
  19. Medium 5.0

    CVE-2002-1873 · Microsoft Exchange Server

    Microsoft Exchange 2000, when used with Microsoft Remote Procedure Call (MSRPC), allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.

    Published 31 Dec 2002 · NVD
  20. High 7.5

    CVE-2002-1850 · Apache HTTP Server

    mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.

    Published 31 Dec 2002 · NVD
  21. High 7.5

    CVE-2002-1809 · MySQL

    The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database.

    Published 31 Dec 2002 · NVD
  22. Medium 4.3

    CVE-2002-1806 · Drupal

    Cross-site scripting (XSS) vulnerability in Drupal 4.0.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.

    Published 31 Dec 2002 · NVD
  23. Medium 5.0

    CVE-2002-1790 · Microsoft Exchange Server, Microsoft IIS

    The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via encapsulated SMTP addresses, a similar vulnerability to CVE-1999-0682.

    Published 31 Dec 2002 · NVD
  24. Medium 5.0

    CVE-2002-1783 · PHP

    CRLF injection vulnerability in PHP 4.2.1 through 4.2.3, when allow_url_fopen is enabled, allows remote attackers to modify HTTP headers for outgoing requests by causing CRLF sequences to be injected into arguments that are passed to the (1) fopen or (2) file functions.

    Published 31 Dec 2002 · NVD
  25. High 7.5

    CVE-2002-1745 · Microsoft IIS

    Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files.

    Published 31 Dec 2002 · NVD
  26. Medium 5.0

    CVE-2002-1744 · Microsoft IIS

    Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." (dot dot).

    Published 31 Dec 2002 · NVD
  27. Medium 5.0

    CVE-2002-1718 · Microsoft IIS

    Microsoft Internet Information Server (IIS) 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension (FPSE) file, as claimed using an HTTP request for colegal.htm that contains .. (dot dot) sequences.

    Published 31 Dec 2002 · NVD
  28. Medium 5.0

    CVE-2002-1717 · Microsoft IIS

    Microsoft Internet Information Server (IIS) 5.1 allows remote attackers to view path information via a GET request to (1) /_vti_pvt/access.cnf, (2) /_vti_pvt/botinfs.cnf, (3) /_vti_pvt/bots.cnf, or (4) /_vti_pvt/linkinfo.cnf.

    Published 31 Dec 2002 · NVD
  29. Medium 4.3

    CVE-2002-1700 · Microsoft IIS

    Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

    Published 31 Dec 2002 · NVD
  30. Medium 5.0

    CVE-2002-1695 · Microsoft IIS

    Norton Internet Security 2001 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while Norton Internet Security is running.

    Published 31 Dec 2002 · NVD
  31. Medium 5.0

    CVE-2002-1694 · Microsoft IIS

    Microsoft Internet Information Server (IIS) 4.0 opens log files with FILE_SHARE_READ and FILE_SHARE_WRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running.

    Published 31 Dec 2002 · NVD
  32. Low 3.6

    CVE-2002-1673 · Webmin

    The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd file.

    Published 31 Dec 2002 · NVD
  33. Low 2.1

    CVE-2002-1672 · Webmin

    Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials.

    Published 31 Dec 2002 · NVD
  34. Medium 4.6

    CVE-2002-1658 · Apache HTTP Server

    Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.

    Published 31 Dec 2002 · NVD
  35. High 7.5

    CVE-2002-1657 · PostgreSQL

    PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.

    Published 31 Dec 2002 · NVD
  36. High 7.5

    CVE-2002-1376 · MySQL

    libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

    Published 23 Dec 2002 · NVD
  37. High 7.5

    CVE-2002-1375 · MySQL

    The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.

    Published 23 Dec 2002 · NVD
  38. High 7.5

    CVE-2002-1374 · MySQL

    The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

    Published 23 Dec 2002 · NVD
  39. Medium 5.0

    CVE-2002-1373 · MySQL

    Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call.

    Published 23 Dec 2002 · NVD
  40. High 10.0

    CVE-2002-1318 · Samba

    Buffer overflow in samba 2.2.2 through 2.2.6 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an encrypted password that causes the overflow during decryption in which a DOS codepage string is converted to a little-endian UCS2 unicode string.

    Published 11 Dec 2002 · NVD
  41. Medium 5.0

    CVE-2002-1221 · BIND 9

    BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.

    Published 29 Nov 2002 · NVD
  42. Medium 5.0

    CVE-2002-1220 · BIND 9

    BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.

    Published 29 Nov 2002 · NVD
  43. High 7.5

    CVE-2002-1219 · BIND 9

    Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).

    Published 29 Nov 2002 · NVD
  44. High 7.5

    CVE-2002-0029 · BIND 9

    Buffer overflows in the DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10, and other derived libraries such as BSD libc and GNU glibc, allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the (1) getnetbyname, or (2) getnetbyaddr functions, aka "LIBRESOLV: buffer overrun" and a different vulnerability than CVE-2002-0684.

    Published 29 Nov 2002 · NVD
  45. Medium 5.0

    CVE-2002-1265 · GNU C Library

    The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang).

    Published 12 Nov 2002 · NVD
  46. Medium 5.0

    CVE-2002-1182 · Microsoft IIS

    IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.

    Published 12 Nov 2002 · NVD
  47. Medium 6.8

    CVE-2002-1181 · Microsoft IIS

    Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.

    Published 12 Nov 2002 · NVD
  48. High 7.5

    CVE-2002-1180 · Microsoft IIS

    A typographical error in the script source access permissions for Internet Information Server (IIS) 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."

    Published 12 Nov 2002 · NVD
  49. High 7.5

    CVE-2002-0869 · Microsoft IIS

    Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."

    Published 12 Nov 2002 · NVD
  50. Low 2.6

    CVE-2002-1233 · Apache HTTP Server

    A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and…

    Published 4 Nov 2002 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.