UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,267
Published in 7 days
273
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,267 vulnerabilities
  1. Critical 9.8

    CVE-2019-5481 · curl, MySQL

    Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

    Published 16 Sept 2019 · NVD
  2. Medium 5.3

    CVE-2019-15740 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  3. Medium 6.1

    CVE-2019-15739 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  4. Medium 5.3

    CVE-2019-15738 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  5. Medium 6.5

    CVE-2019-15737 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  6. High 7.5

    CVE-2019-15736 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  7. Medium 4.3

    CVE-2019-15734 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  8. Medium 4.3

    CVE-2019-15733 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  9. Medium 5.3

    CVE-2019-15732 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.

    Published 16 Sept 2019 · Fixed in 12.2.3 · NVD
  10. Medium 5.3

    CVE-2019-15731 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  11. High 7.5

    CVE-2019-15730 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  12. High 7.5

    CVE-2019-15728 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  13. Medium 5.3

    CVE-2019-15727 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  14. Medium 5.3

    CVE-2019-15726 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  15. High 7.5

    CVE-2019-15725 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  16. Medium 6.1

    CVE-2019-15724 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  17. Medium 5.3

    CVE-2019-15723 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations.

    Published 16 Sept 2019 · Fixed in 11.10.1 · NVD
  18. High 7.5

    CVE-2019-15722 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  19. Medium 5.4

    CVE-2019-15721 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  20. High 7.1

    CVE-2019-16170 · GitLab

    An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Control.

    Published 16 Sept 2019 · Fixed in 12.0.9, 12.1.9, 12.2.5 · NVD
  21. Critical 9.8

    CVE-2019-14540 · MySQL

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

    Published 15 Sept 2019 · NVD
  22. High 8.8

    CVE-2019-1302 · .NET

    An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

    Published 11 Sept 2019 · NVD
  23. Medium 5.4

    CVE-2019-16223 · WordPress

    WordPress before 5.2.3 allows XSS in post previews by authenticated users.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  24. Medium 6.1

    CVE-2019-16222 · WordPress

    WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  25. Medium 6.1

    CVE-2019-16221 · WordPress

    WordPress before 5.2.3 allows reflected XSS in the dashboard.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  26. Medium 6.1

    CVE-2019-16220 · WordPress

    In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  27. Medium 6.1

    CVE-2019-16219 · WordPress

    WordPress before 5.2.3 allows XSS in shortcode previews.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  28. Medium 6.1

    CVE-2019-16218 · WordPress

    WordPress before 5.2.3 allows XSS in stored comments.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  29. Medium 6.1

    CVE-2019-16217 · WordPress

    WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  30. Low 3.7

    CVE-2019-1563 · OpenSSL

    In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected…

    Published 10 Sept 2019 · NVD
  31. Medium 5.3

    CVE-2019-1549 · OpenSSL

    OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the…

    Published 10 Sept 2019 · NVD
  32. Medium 4.7

    CVE-2019-1547 · OpenSSL

    Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If…

    Published 10 Sept 2019 · NVD
  33. Low 3.7

    CVE-2019-7176 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.

    Published 9 Sept 2019 · Fixed in 11.5.9, 11.6.7, 11.7.2 · NVD
  34. Medium 6.5

    CVE-2019-6791 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  35. Medium 4.3

    CVE-2019-6997 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  36. Medium 4.3

    CVE-2019-6996 · GitLab

    An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  37. Medium 6.5

    CVE-2019-6995 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  38. Critical 9.8

    CVE-2019-6960 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  39. Medium 5.4

    CVE-2019-6795 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social engineering.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  40. Medium 4.3

    CVE-2019-6794 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 5 of 6). A project guest user can view the last commit status of the default branch.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  41. High 7.0

    CVE-2019-6793 · GitLab

    An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  42. Medium 5.3

    CVE-2019-6792 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  43. Medium 4.3

    CVE-2019-6789 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 4 of 6). In some cases, users without project permissions will receive emails after a project move. For private projects, this will disclose the new project namespace to an unauthorized user.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  44. High 7.5

    CVE-2019-6788 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 3 of 6). For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  45. Medium 6.5

    CVE-2019-6786 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  46. Medium 6.5

    CVE-2019-6785 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  47. Medium 6.1

    CVE-2019-6784 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  48. High 8.8

    CVE-2019-6783 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  49. High 7.5

    CVE-2019-6782 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 1 of 6). An authorization issue allows the contributed project information of a private profile to be viewed.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  50. High 7.5

    CVE-2019-11605 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token.

    Published 9 Sept 2019 · Fixed in 11.8.10, 11.9.11, 11.10.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.