UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,262
Published in 7 days
277
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,262 vulnerabilities
  1. High 8.3

    CVE-2020-13321 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing for html tags to be added.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  2. Medium 6.5

    CVE-2020-13320 · GitLab

    An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  3. Medium 4.3

    CVE-2020-13319 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  4. High 8.8

    CVE-2020-13296 · GitLab

    An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper Access Control for Deploy Tokens

    Published 30 Sept 2020 · Fixed in 13.0.14, 13.1.8, 13.2.6 · NVD
  5. High 7.5

    CVE-2020-26121 · MediaWiki

    An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an upload restriction and a create restriction. An attacker cannot leverage this to overwrite anything, but can…

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  6. Medium 6.1

    CVE-2020-26120 · MediaWiki

    XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  7. High 7.5

    CVE-2020-25869 · MediaWiki

    An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  8. Medium 6.1

    CVE-2020-25828 · MediaWiki

    An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all…

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  9. High 7.5

    CVE-2020-25827 · MediaWiki

    An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  10. Medium 6.1

    CVE-2020-25815 · MediaWiki

    An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  11. Medium 6.1

    CVE-2020-25814 · MediaWiki

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object…

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  12. Medium 5.3

    CVE-2020-25813 · MediaWiki

    In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

    Published 27 Sept 2020 · Fixed in 1.31.10, 1.34.4 · NVD
  13. Medium 6.1

    CVE-2020-25812 · MediaWiki

    An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.

    Published 27 Sept 2020 · Fixed in 1.34.4 · NVD
  14. High 7.2

    CVE-2020-26116 · Python

    http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

    Published 27 Sept 2020 · Fixed in 3.6.12, 3.7.9, 3.8.5 · NVD
  15. High 7.8

    CVE-2020-8252 · Node.js

    The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

    Published 18 Sept 2020 · Fixed in 10.22.1, 12.18.4, 14.9.0 · NVD
  16. High 7.5

    CVE-2020-8251 · Node.js

    Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

    Published 18 Sept 2020 · Fixed in 14.11.0 · NVD
  17. High 7.4

    CVE-2020-8201 · Node.js

    Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return…

    Published 18 Sept 2020 · Fixed in 12.18.4, 14.11.0 · NVD
  18. Unrated

    WPV-70df3ea01c0b · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 17 Sept 2020 · Fixed in 2.2.1 · WPVulnerability
  19. Unrated

    WPV-08e53f658b62 · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 17 Sept 2020 · Fixed in 2.2.1 · WPVulnerability
  20. High 7.3

    CVE-2020-10733 · PostgreSQL

    The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's…

    Published 16 Sept 2020 · Fixed in 10.13, 11.8, 12.3 · NVD
  21. Low 2.7

    CVE-2020-13308 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance.

    Published 15 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  22. Medium 4.7

    CVE-2020-13307 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access.

    Published 15 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  23. Medium 6.5

    CVE-2020-13303 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.

    Published 15 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  24. High 7.5

    CVE-2020-13315 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  25. Medium 6.5

    CVE-2020-13310 · GitLab

    A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service.

    Published 14 Sept 2020 · Fixed in 13.1.3, 13.2.3, 13.3.1 · NVD
  26. High 8.8

    CVE-2020-13309 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  27. High 7.5

    CVE-2020-13306 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  28. Medium 4.3

    CVE-2020-13305 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  29. High 7.2

    CVE-2020-13304 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  30. High 7.2

    CVE-2020-13302 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  31. Medium 4.8

    CVE-2020-13301 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  32. Medium 5.8

    CVE-2020-13298 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  33. Medium 5.4

    CVE-2020-13297 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  34. Medium 4.9

    CVE-2020-13317 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  35. Medium 5.3

    CVE-2020-13314 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  36. Medium 4.3

    CVE-2020-13313 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  37. Critical 9.8

    CVE-2020-13312 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  38. Medium 4.3

    CVE-2020-13311 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  39. High 7.3

    CVE-2020-13318 · GitLab

    A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  40. Medium 4.3

    CVE-2020-13316 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  41. Critical 10.0

    CVE-2020-13300 · GitLab

    GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.

    Published 14 Sept 2020 · Fixed in 13.3.4 · NVD
  42. High 8.1

    CVE-2020-13299 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  43. Medium 5.4

    CVE-2020-13289 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  44. Medium 4.3

    CVE-2020-13287 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  45. Medium 6.5

    CVE-2020-13284 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  46. Medium 5.3

    CVE-2020-25286 · WordPress

    In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

    Published 13 Sept 2020 · Fixed in 5.4.2 · NVD
  47. High 7.5

    CVE-2020-1045 · .NET

    <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles…

    Published 11 Sept 2020 · Fixed in 3.1.8 · NVD
  48. Low 3.6

    CVE-2020-7068 · PHP

    In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

    Published 9 Sept 2020 · Fixed in 7.2.33, 7.3.21, 7.4.9 · NVD
  49. Low 3.7

    CVE-2020-1968 · OpenSSL

    The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation…

    Published 9 Sept 2020 · NVD
  50. Medium 6.5

    CVE-2020-8927 · Brotli, .NET

    A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to…

    Published 27 Aug 2020 · Fixed in 1.0.8 · NVD, releases

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.