UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,265
Published in 7 days
280
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,265 vulnerabilities
  1. Medium 6.1

    CVE-2016-1000107 · Erlang/OTP

    inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

    Published 10 Dec 2019 · NVD
  2. Medium 5.3

    CVE-2019-1551 · OpenSSL

    There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the…

    Published 6 Dec 2019 · NVD
  3. High 8.6

    CVE-2014-9356 · Docker Engine

    Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

    Published 2 Dec 2019 · Fixed in 1.3.3 · NVD
  4. Medium 5.9

    CVE-2015-1855 · Ruby

    verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

    Published 29 Nov 2019 · Fixed in 2.1.6, 2.2.2 · NVD
  5. Medium 6.1

    CVE-2016-1000110 · Python

    The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.

    Published 27 Nov 2019 · Fixed in 3.3.7, 3.4.6, 3.5.3 · NVD
  6. Critical 9.8

    CVE-2019-19330 · HAProxy

    The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

    Published 27 Nov 2019 · Fixed in 2.0.10 · NVD
  7. Critical 9.8

    CVE-2011-1939 · PHP

    SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.

    Published 26 Nov 2019 · Fixed in 5.3.6 · NVD
  8. High 8.1

    CVE-2019-16255 · Ruby

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

    Published 26 Nov 2019 · NVD
  9. Medium 5.3

    CVE-2019-16254 · Ruby

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF…

    Published 26 Nov 2019 · NVD
  10. High 7.5

    CVE-2019-16201 · Ruby

    WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

    Published 26 Nov 2019 · NVD
  11. Medium 5.3

    CVE-2019-18456 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions (issue 1 of 4).

    Published 26 Nov 2019 · NVD
  12. High 7.5

    CVE-2019-18455 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop.

    Published 26 Nov 2019 · NVD
  13. Medium 6.1

    CVE-2019-18454 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.

    Published 26 Nov 2019 · NVD
  14. Medium 4.3

    CVE-2019-18453 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.

    Published 26 Nov 2019 · NVD
  15. Medium 5.3

    CVE-2019-18452 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions.

    Published 26 Nov 2019 · NVD
  16. Medium 6.1

    CVE-2019-18451 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect.

    Published 26 Nov 2019 · NVD
  17. Medium 4.3

    CVE-2019-18450 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.

    Published 26 Nov 2019 · NVD
  18. Medium 4.3

    CVE-2019-18449 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2).

    Published 26 Nov 2019 · NVD
  19. Medium 6.5

    CVE-2019-18448 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.

    Published 26 Nov 2019 · NVD
  20. Medium 4.3

    CVE-2019-18447 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.

    Published 26 Nov 2019 · NVD
  21. Medium 4.3

    CVE-2019-18446 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).

    Published 26 Nov 2019 · NVD
  22. Medium 6.5

    CVE-2019-15845 · Ruby

    Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.

    Published 26 Nov 2019 · NVD
  23. Medium 5.3

    CVE-2019-18459 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of 4).

    Published 26 Nov 2019 · NVD
  24. Low 2.7

    CVE-2019-18458 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4).

    Published 26 Nov 2019 · NVD
  25. High 8.8

    CVE-2019-18457 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions.

    Published 26 Nov 2019 · NVD
  26. Medium 4.3

    CVE-2019-18463 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4).

    Published 26 Nov 2019 · NVD
  27. Medium 4.3

    CVE-2019-18462 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions.

    Published 26 Nov 2019 · NVD
  28. Medium 4.3

    CVE-2019-18461 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control.

    Published 26 Nov 2019 · NVD
  29. High 7.5

    CVE-2019-18460 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.

    Published 26 Nov 2019 · NVD
  30. Critical 9.8

    CVE-2011-4121 · Ruby

    The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.

    Published 26 Nov 2019 · Fixed in 1.9.3 · NVD
  31. Medium 5.3

    CVE-2011-3624 · Ruby

    Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

    Published 26 Nov 2019 · NVD
  32. High 7.5

    CVE-2019-19246 · PHP

    Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.

    Published 25 Nov 2019 · Fixed in 7.3.10 · NVD
  33. Medium 6.5

    CVE-2019-15593 · GitLab

    GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.

    Published 22 Nov 2019 · NVD
  34. High 7.5

    CVE-2012-6079 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  35. High 7.5

    CVE-2012-6078 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  36. High 7.5

    CVE-2012-6077 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  37. Unrated

    WPV-2d4499083c64 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 21 Nov 2019 · Fixed in 7.9.1 · WPVulnerability
  38. High 7.5

    CVE-2015-3167 · PostgreSQL

    contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

    Published 20 Nov 2019 · Fixed in 9.2.11, 9.3.7, 9.4.2 · NVD
  39. Critical 9.8

    CVE-2015-3166 · PostgreSQL

    The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.

    Published 20 Nov 2019 · Fixed in 9.2.11, 9.3.7, 9.4.2 · NVD
  40. High 7.5

    CVE-2013-1817 · MediaWiki

    MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.

    Published 20 Nov 2019 · Fixed in 1.19.4, 1.20.3 · NVD
  41. High 7.5

    CVE-2013-1816 · MediaWiki

    MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.

    Published 20 Nov 2019 · Fixed in 1.19.4, 1.20.3 · NVD
  42. Medium 6.1

    CVE-2013-0195 · Matomo

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.

    Published 20 Nov 2019 · Fixed in 1.10.1 · NVD
  43. Medium 6.1

    CVE-2013-0194 · Matomo

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.

    Published 20 Nov 2019 · Fixed in 1.10.1 · NVD
  44. Medium 6.1

    CVE-2013-0193 · Matomo

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.

    Published 20 Nov 2019 · Fixed in 1.10.1 · NVD
  45. Medium 4.8

    CVE-2011-4968 · nginx

    nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)

    Published 19 Nov 2019 · NVD
  46. High 7.5

    CVE-2010-4657 · PHP

    PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.

    Published 13 Nov 2019 · Fixed in 5.4.4 · NVD
  47. Medium 6.1

    CVE-2019-10219 · Java, MySQL

    A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

    Published 8 Nov 2019 · Fixed in 5.7.36, 8.0.27 · NVD
  48. Medium 5.3

    CVE-2019-18674 · Joomla!

    An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure.

    Published 6 Nov 2019 · Fixed in 3.9.13 · NVD
  49. High 8.8

    CVE-2019-18650 · Joomla!

    An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.

    Published 6 Nov 2019 · NVD
  50. Critical 9.8

    CVE-2019-8158 · Magento / Adobe Commerce

    An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.

    Published 6 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.