UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,267
Published in 7 days
269
Critical in 30 days
70
Actively exploited
64

Latest vulnerabilities

11,267 vulnerabilities
  1. Medium 6.5

    CVE-2019-11549 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors.

    Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD
  2. Medium 5.4

    CVE-2019-11548 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.

    Published 9 Sept 2019 · Fixed in 11.8.9 · NVD
  3. Medium 6.1

    CVE-2019-11547 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.

    Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD
  4. Medium 5.3

    CVE-2019-11546 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.

    Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD
  5. Medium 4.3

    CVE-2019-11545 · GitLab

    An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue.

    Published 9 Sept 2019 · Fixed in 11.9.10, 11.10.2 · NVD
  6. Medium 4.3

    CVE-2019-11544 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.

    Published 9 Sept 2019 · Fixed in 11.8.9, 11.9.10, 11.10.2 · NVD
  7. High 7.2

    CVE-2019-5473 · GitLab

    An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4.

    Published 9 Sept 2019 · NVD
  8. Medium 5.4

    CVE-2019-5471 · GitLab

    An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.

    Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD
  9. Medium 5.4

    CVE-2019-5467 · GitLab

    An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.

    Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD
  10. Medium 5.3

    CVE-2019-5463 · GitLab

    An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.

    Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD
  11. Low 3.5

    CVE-2019-5461 · GitLab

    An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.

    Published 9 Sept 2019 · Fixed in 11.11.7, 12.0.4, 12.1.2 · NVD
  12. Medium 6.5

    CVE-2019-16168 · Java, MySQL

    In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

    Published 9 Sept 2019 · NVD
  13. High 7.5

    CVE-2019-16056 · Python

    An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may…

    Published 6 Sept 2019 · NVD
  14. High 7.5

    CVE-2019-15903 · Python

    In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

    Published 4 Sept 2019 · Fixed in 3.5.8, 3.6.10, 3.7.5 · NVD
  15. High 7.8

    CVE-2019-2390 · MongoDB

    An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.

    Published 30 Aug 2019 · Fixed in 3.4.22, 3.6.14, 4.0.11 · NVD
  16. Medium 4.2

    CVE-2019-2389 · MongoDB

    Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

    Published 30 Aug 2019 · Fixed in 3.4.22, 3.6.14, 4.0.11 · NVD
  17. High 8.8

    CVE-2019-3394 · Confluence

    There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under <install-directory>/confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, which could potentially leak…

    Published 29 Aug 2019 · Fixed in 6.15.8 · NVD
  18. Critical 9.8

    CVE-2019-14943 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.

    Published 29 Aug 2019 · NVD
  19. High 7.8Actively exploited

    CVE-2019-15752 · Docker Engine

    Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.

    Published 28 Aug 2019 · Fixed in 2.1.0.1 · NVD
  20. Medium 6.1

    CVE-2015-9360 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 28 Aug 2019 · Fixed in 1.9.64 · NVD, WPVulnerability
  21. Medium 6.5

    CVE-2019-15515 · Discourse

    Discourse 2.3.2 sends the CSRF token in the query string.

    Published 26 Aug 2019 · NVD
  22. High 8.4

    CVE-2019-13139 · Docker Engine

    In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build"…

    Published 22 Aug 2019 · Fixed in 18.09.4 · NVD
  23. High 7.5

    CVE-2019-10081 · Apache HTTP Server

    HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

    Published 15 Aug 2019 · NVD
  24. Medium 5.3

    CVE-2019-15028 · Joomla!

    In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.

    Published 14 Aug 2019 · Fixed in 3.9.11 · NVD
  25. High 7.5

    CVE-2019-9518 · Node.js

    Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  26. High 7.5

    CVE-2019-9517 · Apache HTTP Server, Node.js

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending…

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  27. Medium 6.5

    CVE-2019-9516 · nginx, Node.js

    Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  28. High 7.5

    CVE-2019-9515 · Node.js

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess…

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  29. High 7.5

    CVE-2019-9514 · Node.js

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  30. High 7.5

    CVE-2019-9513 · nginx, Node.js

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  31. High 7.5

    CVE-2019-9512 · Node.js

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  32. High 7.5

    CVE-2019-9511 · nginx, Node.js

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is…

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  33. High 7.1

    CVE-2019-11042 · PHP

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 9 Aug 2019 · Fixed in 7.1.31, 7.2.21, 7.3.8 · NVD
  34. High 7.1

    CVE-2019-11041 · PHP

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 9 Aug 2019 · Fixed in 7.1.31, 7.2.21, 7.3.8 · NVD
  35. Medium 6.1

    CVE-2019-14774 · Woo Variation Swatches (WordPress plugin)

    Variation Swatches for WooCommerce: Cross-site Scripting

    Published 8 Aug 2019 · Fixed in 1.0.62 · WPVulnerability
  36. High 7.1

    CVE-2019-2386 · MongoDB

    After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.…

    Published 6 Aug 2019 · Fixed in 3.4.22, 3.6.13, 4.0.9 · NVD
  37. High 8.8

    CVE-2019-14654 · Joomla!

    In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

    Published 5 Aug 2019 · NVD
  38. High 7.5

    CVE-2019-7951 · Magento / Adobe Commerce

    An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  39. High 7.5

    CVE-2019-7950 · Magento / Adobe Commerce

    An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  40. Medium 6.5

    CVE-2019-7947 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  41. Medium 5.4

    CVE-2019-7945 · Magento / Adobe Commerce

    A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  42. Medium 5.4

    CVE-2019-7944 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  43. High 7.2

    CVE-2019-7942 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  44. Medium 4.8

    CVE-2019-7940 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify store currency options to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  45. Medium 6.1

    CVE-2019-7939 · Magento / Adobe Commerce

    A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  46. Medium 4.8

    CVE-2019-7938 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  47. Medium 4.8

    CVE-2019-7937 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  48. Medium 4.8

    CVE-2019-7936 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  49. Medium 4.8

    CVE-2019-7935 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content page titles to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  50. Medium 4.8

    CVE-2019-7934 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.