UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. Medium 5.0

    CVE-2002-1156 · Apache HTTP Server

    Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.

    Published 11 Oct 2002 · NVD
  2. Medium 5.0

    CVE-2002-1153 · IBM WebSphere Application Server

    IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host".

    Published 11 Oct 2002 · NVD
  3. Medium 5.0

    CVE-2002-1148 · Apache Tomcat

    The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

    Published 11 Oct 2002 · NVD
  4. Medium 5.0

    CVE-2002-1146 · GNU C Library

    The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).

    Published 11 Oct 2002 · NVD
  5. High 7.8

    CVE-2002-0969 · MySQL

    Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group.

    Published 11 Oct 2002 · Fixed in 3.23.50 · NVD
  6. High 7.5

    CVE-2002-0843 · Apache HTTP Server

    Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.

    Published 11 Oct 2002 · NVD
  7. Medium 6.8

    CVE-2002-0840 · Apache HTTP Server

    Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

    Published 11 Oct 2002 · NVD
  8. High 7.2

    CVE-2002-0839 · Apache HTTP Server

    The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.

    Published 11 Oct 2002 · Fixed in 1.3.27 · NVD
  9. Medium 4.6

    CVE-2002-1119 · Python

    os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack.

    Published 4 Oct 2002 · Fixed in 2.2.2 · NVD
  10. Medium 5.0

    CVE-2002-0936 · Apache Tomcat

    The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).

    Published 4 Oct 2002 · NVD
  11. Medium 5.0

    CVE-2002-0935 · Apache Tomcat

    Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.

    Published 4 Oct 2002 · NVD
  12. High 7.2

    CVE-2002-1642 · PostgreSQL

    PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VACUUM command.

    Published 3 Oct 2002 · NVD
  13. Medium 5.0

    CVE-2002-1593 · Apache HTTP Server

    mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.

    Published 25 Sept 2002 · NVD
  14. Medium 5.0

    CVE-2002-0986 · PHP

    The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

    Published 24 Sept 2002 · NVD
  15. High 7.5

    CVE-2002-0985 · PHP

    Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.

    Published 24 Sept 2002 · NVD
  16. Medium 4.6

    CVE-2002-0972 · PostgreSQL

    Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the functions (1) lpad or (2) rpad.

    Published 24 Sept 2002 · NVD
  17. Medium 5.0

    CVE-2002-0654 · Apache HTTP Server

    Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.

    Published 5 Sept 2002 · NVD
  18. High 7.5

    CVE-2002-0826 · WS_FTP Server

    Buffer overflow in WS_FTP FTP Server 3.1.1 allows remote authenticated users to execute arbitrary code via a long SITE CPWD command.

    Published 12 Aug 2002 · NVD
  19. High 7.5

    CVE-2002-0802 · PostgreSQL

    The multibyte support in PostgreSQL 6.5.x with SQL_ASCII encoding consumes an extra character when processing a character that cannot be converted, which could remove an escape character from the query and make the application subject to SQL injection attacks.

    Published 12 Aug 2002 · NVD
  20. High 7.5

    CVE-2002-0765 · OpenSSH

    sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.

    Published 12 Aug 2002 · NVD
  21. High 7.5

    CVE-2002-0757 · Webmin

    (1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.

    Published 12 Aug 2002 · NVD
  22. High 7.5

    CVE-2002-0756 · Webmin

    Cross-site scripting vulnerability in the authentication page for (1) Webmin 0.96 and (2) Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies.

    Published 12 Aug 2002 · NVD
  23. High 7.5

    CVE-2002-0698 · Microsoft Exchange Server

    Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.

    Published 12 Aug 2002 · NVD
  24. High 7.5

    CVE-2002-0684 · GNU C Library, BIND 9

    Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.

    Published 12 Aug 2002 · NVD
  25. High 7.5

    CVE-2002-0661 · Apache HTTP Server

    Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.

    Published 12 Aug 2002 · NVD
  26. Medium 5.0

    CVE-2002-0659 · OpenSSL

    The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.

    Published 12 Aug 2002 · NVD
  27. High 7.5

    CVE-2002-0657 · OpenSSL

    Buffer overflow in OpenSSL 0.9.7 before 0.9.7-beta3, with Kerberos enabled, allows attackers to execute arbitrary code via a long master key.

    Published 12 Aug 2002 · NVD
  28. High 7.5

    CVE-2002-0656 · OpenSSL

    Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.

    Published 12 Aug 2002 · NVD
  29. High 7.5

    CVE-2002-0655 · OpenSSL

    OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code.

    Published 12 Aug 2002 · NVD
  30. Low 2.1

    CVE-2002-0507 · Microsoft Exchange Server

    An interaction between Microsoft Outlook Web Access (OWA) with RSA SecurID allows local users to bypass the SecurID authentication for a previous user via several submissions of an OWA Authentication request with the proper OWA password for the previous user, which is eventually accepted by OWA.

    Published 12 Aug 2002 · NVD
  31. High 7.5

    CVE-2002-0493 · Apache Tomcat

    Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

    Published 12 Aug 2002 · NVD
  32. Medium 5.0

    CVE-2002-0484 · PHP

    move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system.

    Published 12 Aug 2002 · NVD
  33. Low 2.6

    CVE-2002-0422 · Microsoft IIS

    IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response, or (2) via the WRITE or MKCOL method, which leaks the IP in the Location server header.

    Published 12 Aug 2002 · NVD
  34. Medium 5.0

    CVE-2002-0419 · Microsoft IIS

    Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which (2) in certain configurations, the server IP address is provided as the realm for Basic authentication, which could reveal real IP addresses that were obscured by NAT, or (3) when NTLM authentication is used,…

    Published 12 Aug 2002 · NVD
  35. High 7.5

    CVE-2002-0717 · PHP

    PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed.

    Published 26 Jul 2002 · NVD
  36. High 7.5

    CVE-2002-0682 · Apache Tomcat

    Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.

    Published 23 Jul 2002 · NVD
  37. High 7.5

    CVE-2002-0651 · BIND 9

    Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.

    Published 3 Jul 2002 · NVD
  38. High 10.0

    CVE-2002-0640 · OpenSSH

    Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).

    Published 3 Jul 2002 · NVD
  39. Critical 9.8

    CVE-2002-0639 · OpenSSH

    Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.

    Published 3 Jul 2002 · NVD
  40. High 7.5

    CVE-2002-0392 · Apache HTTP Server

    Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.

    Published 3 Jul 2002 · NVD
  41. High 7.5

    CVE-2002-0364 · Microsoft IIS

    Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."

    Published 3 Jul 2002 · NVD
  42. High 7.5

    CVE-2002-0575 · OpenSSH

    Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges.

    Published 18 Jun 2002 · NVD
  43. Medium 5.0

    CVE-2002-0400 · BIND 9

    ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL, aka DoS_findtype.

    Published 18 Jun 2002 · NVD
  44. Medium 5.0

    CVE-2002-0368 · Microsoft Exchange Server

    The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute, aka "Malformed Mail Attribute can Cause Exchange 2000 to Exhaust CPU Resources."

    Published 18 Jun 2002 · NVD
  45. High 7.5

    CVE-2002-0257 · Apache HTTP Server

    Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields (1) TITLE, (2) DESCTIT, (3) DESC, (4) searchstring, (5) ALIAS, (6) EMAIL, (7) ADDRESS1, (8) ADDRESS2, (9) ADDRESS3, (10) PHONE1, (11) PHONE2, (12) PHONE3, or (13) PHONE4.

    Published 29 May 2002 · NVD
  46. Medium 5.0

    CVE-2002-0253 · PHP

    PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and produces an error message that contains the path.

    Published 29 May 2002 · NVD
  47. Medium 5.0

    CVE-2002-0249 · Apache HTTP Server

    PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.

    Published 29 May 2002 · NVD
  48. Medium 5.0

    CVE-2002-0240 · Apache HTTP Server

    PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.

    Published 29 May 2002 · NVD
  49. High 7.5

    CVE-2002-0229 · PHP

    Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements.

    Published 16 May 2002 · NVD
  50. Medium 5.0

    CVE-2002-0224 · Microsoft IIS

    The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to cause a denial of service (crash or hang) via malformed (random) input.

    Published 16 May 2002 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.