UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,265
Published in 7 days
280
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,265 vulnerabilities
  1. Critical 9.8

    CVE-2019-19088 · GitLab

    Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  2. Medium 4.3

    CVE-2019-19087 · GitLab

    Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  3. Medium 4.3

    CVE-2019-19086 · GitLab

    Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).

    Published 3 Jan 2020 · Fixed in 12.5.1 · NVD
  4. Critical 9.8

    CVE-2014-0048 · Docker Engine

    An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.

    Published 2 Jan 2020 · Fixed in 1.5.0 · NVD
  5. Medium 5.3

    CVE-2018-20507 · GitLab

    An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  6. Medium 6.3

    CVE-2018-20501 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  7. High 7.2

    CVE-2018-20499 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  8. Medium 4.3

    CVE-2018-20498 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  9. Medium 5.0

    CVE-2018-20497 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  10. Medium 5.4

    CVE-2018-20496 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  11. Medium 5.3

    CVE-2018-20495 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  12. High 7.5

    CVE-2018-20494 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  13. Medium 4.3

    CVE-2018-20493 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  14. Medium 5.4

    CVE-2018-20491 · GitLab

    An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  15. Medium 5.4

    CVE-2018-20490 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  16. Medium 5.3

    CVE-2018-20489 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  17. Medium 4.3

    CVE-2018-20488 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.

    Published 30 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  18. Medium 4.3

    CVE-2019-20043 · WordPress

    In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous…

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  19. Medium 6.1

    CVE-2019-20042 · WordPress

    In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  20. Critical 9.8

    CVE-2019-20041 · WordPress

    wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  21. High 7.5

    CVE-2012-4420 · Java

    An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

    Published 26 Dec 2019 · NVD
  22. Medium 5.3

    CVE-2018-20492 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6).

    Published 26 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  23. High 7.0

    CVE-2019-12418 · Apache Tomcat

    When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to…

    Published 23 Dec 2019 · NVD
  24. High 7.5

    CVE-2019-17563 · Apache Tomcat

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

    Published 23 Dec 2019 · NVD
  25. Medium 6.5

    CVE-2019-11050 · PHP

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 23 Dec 2019 · NVD
  26. Critical 9.8

    CVE-2019-11049 · PHP

    In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.

    Published 23 Dec 2019 · NVD
  27. Medium 6.5

    CVE-2019-11047 · PHP

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 23 Dec 2019 · Fixed in 7.2.26, 7.3.13 · NVD
  28. Medium 5.3

    CVE-2019-11046 · PHP

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

    Published 23 Dec 2019 · NVD
  29. Medium 5.9

    CVE-2019-11045 · PHP

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

    Published 23 Dec 2019 · NVD
  30. High 7.5

    CVE-2019-11044 · PHP

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

    Published 23 Dec 2019 · NVD
  31. Medium 5.4

    CVE-2019-16781 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress block editor (within dashboard)

    Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress
  32. Medium 5.4

    CVE-2019-16780 · WordPress

    Stored cross-site scripting (XSS) in WordPress block editor

    Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress
  33. Medium 6.5

    CVE-2019-15584 · GitLab

    A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.

    Published 20 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD
  34. Medium 6.1

    CVE-2019-19910 · MediaWiki

    The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address). This can occur within a talk page topical header that is viewed within a mobile (MobileFrontend) context.

    Published 19 Dec 2019 · NVD
  35. Medium 6.5

    CVE-2019-15006 · Confluence

    There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the…

    Published 19 Dec 2019 · Fixed in 6.15.10, 7.0.5, 7.1.2 · NVD
  36. Medium 5.3

    CVE-2019-5487 · GitLab

    An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits.

    Published 18 Dec 2019 · Fixed in 12.1.13, 12.2.7, 12.3.3 · NVD
  37. High 8.8

    CVE-2019-5486 · GitLab

    A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements.

    Published 18 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD
  38. Medium 6.5

    CVE-2019-5469 · GitLab

    An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets.

    Published 18 Dec 2019 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  39. Medium 6.5

    CVE-2019-15591 · GitLab

    An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.

    Published 18 Dec 2019 · Fixed in 12.3.3 · NVD
  40. High 8.8

    CVE-2019-15589 · GitLab

    An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.

    Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  41. Medium 6.5

    CVE-2019-15580 · GitLab

    An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.

    Published 18 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD
  42. Medium 4.3

    CVE-2019-15577 · GitLab

    An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.

    Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  43. High 7.5

    CVE-2019-15576 · GitLab

    An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.

    Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  44. High 7.5

    CVE-2019-15575 · GitLab

    A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.

    Published 18 Dec 2019 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  45. Critical 9.8

    CVE-2019-19846 · Joomla!

    In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

    Published 18 Dec 2019 · NVD
  46. Medium 5.3

    CVE-2019-19845 · Joomla!

    In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.

    Published 18 Dec 2019 · Fixed in 3.9.14 · NVD
  47. High 7.5

    CVE-2014-8179 · Docker Engine

    Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

    Published 17 Dec 2019 · Fixed in 1.8.3 · NVD
  48. Medium 5.5

    CVE-2014-8178 · Docker Engine

    Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

    Published 17 Dec 2019 · Fixed in 1.8.3 · NVD
  49. Medium 6.1

    CVE-2013-4303 · MediaWiki

    includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.

    Published 11 Dec 2019 · Fixed in 1.19.8, 1.20.7, 1.21.2 · NVD
  50. Medium 6.1

    CVE-2019-19709 · MediaWiki

    MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.

    Published 11 Dec 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.