UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,273
Published in 7 days
222
Critical in 30 days
71
Actively exploited
64

Latest vulnerabilities

11,273 vulnerabilities
  1. Medium 4.3

    CVE-2019-12215 · Matomo

    A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security…

    Published 20 May 2019 · NVD
  2. Medium 6.1

    CVE-2019-11809 · Joomla!

    An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.

    Published 20 May 2019 · Fixed in 3.9.6 · NVD
  3. Critical 9.1

    CVE-2019-7353 · GitLab

    An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects.

    Published 17 May 2019 · Fixed in 11.7.4 · NVD
  4. High 7.5

    CVE-2019-6797 · GitLab

    An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token used in CI/CD for External Repos was being leaked to project maintainers in the UI.

    Published 17 May 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  5. Medium 4.3

    CVE-2019-6790 · GitLab

    An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests.

    Published 17 May 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  6. Medium 6.5

    CVE-2019-6787 · GitLab

    An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users.

    Published 17 May 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  7. High 7.5

    CVE-2019-6781 · GitLab

    An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.

    Published 17 May 2019 · Fixed in 11.5.10, 11.6.8, 11.7.3 · NVD
  8. Critical 9.1

    CVE-2019-5883 · GitLab

    An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.

    Published 17 May 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  9. High 7.5

    CVE-2018-20500 · GitLab

    An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.

    Published 17 May 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  10. High 7.5

    CVE-2018-19585 · GitLab

    GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.

    Published 17 May 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  11. High 7.5

    CVE-2019-0982 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

    Published 16 May 2019 · NVD
  12. High 7.5

    CVE-2019-10112 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  13. Medium 6.1

    CVE-2019-10117 · GitLab

    An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  14. Medium 4.3

    CVE-2019-10116 · GitLab

    An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  15. Medium 6.5

    CVE-2019-10115 · GitLab

    An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  16. High 7.5

    CVE-2019-10114 · GitLab

    An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  17. High 7.5

    CVE-2019-10113 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects/<id>/languages requests may allow Uncontrolled Resource Consumption.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  18. Medium 5.4

    CVE-2019-10111 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  19. Medium 6.5

    CVE-2019-10110 · GitLab

    An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credentials.

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  20. Medium 5.3

    CVE-2019-10109 · GitLab

    An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  21. Medium 5.4

    CVE-2019-10108 · GitLab

    An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  22. High 7.5

    CVE-2019-10640 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption.

    Published 15 May 2019 · Fixed in 11.7.10, 11.8.6, 11.9.4 · NVD
  23. High 8.1

    CVE-2019-12083 · Rust

    The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually…

    Published 13 May 2019 · Fixed in 1.34.2 · NVD
  24. Medium 6.5

    CVE-2019-11000 · GitLab

    An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure.

    Published 10 May 2019 · Fixed in 11.7.11, 11.8.7, 11.9.7 · NVD
  25. Medium 5.9

    CVE-2019-11323 · HAProxy

    HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.

    Published 9 May 2019 · Fixed in 1.9.7 · NVD
  26. Critical 9.8

    CVE-2019-11831 · Joomla!

    The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

    Published 9 May 2019 · NVD
  27. Unrated

    WPV-dfb1909e42f7 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  28. Unrated

    WPV-6e0c6fcf8e01 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  29. Unrated

    WPV-3babf47eb536 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  30. Critical 9.1

    CVE-2019-11036 · PHP

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    Published 3 May 2019 · Fixed in 7.1.29, 7.2.18, 7.3.5 · NVD
  31. Medium 5.4

    CVE-2018-20239 · Confluence

    Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the…

    Published 30 Apr 2019 · Fixed in 6.15.2 · NVD
  32. High 8.8

    CVE-2018-19359 · GitLab

    GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control.

    Published 25 Apr 2019 · Fixed in 11.3.10, 11.4.6 · NVD
  33. Medium 6.1

    CVE-2018-18643 · GitLab

    GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.

    Published 25 Apr 2019 · Fixed in 11.3.10, 11.4.6 · NVD
  34. Medium 6.1

    CVE-2019-9669 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 25 Apr 2019 · WPVulnerability
  35. Critical 9.0

    CVE-2019-2699 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). The supported version that is affected is Java SE: 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this…

    Published 23 Apr 2019 · NVD
  36. High 8.1

    CVE-2019-2698 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java…

    Published 23 Apr 2019 · NVD
  37. High 8.1

    CVE-2019-2697 · Java

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java…

    Published 23 Apr 2019 · NVD
  38. Medium 6.5

    CVE-2019-2695 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  39. Medium 6.5

    CVE-2019-2694 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  40. Medium 6.5

    CVE-2019-2693 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  41. Medium 4.9

    CVE-2019-2691 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Roles). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 23 Apr 2019 · NVD
  42. Medium 4.9

    CVE-2019-2689 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  43. Medium 4.9

    CVE-2019-2688 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  44. Medium 4.9

    CVE-2019-2687 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  45. Medium 4.9

    CVE-2019-2686 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  46. Medium 4.9

    CVE-2019-2685 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  47. Medium 5.9

    CVE-2019-2684 · Apache Tomcat, Java

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can…

    Published 23 Apr 2019 · NVD
  48. Medium 4.9

    CVE-2019-2683 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 5.6.43 and prior, 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 23 Apr 2019 · NVD
  49. Medium 4.9

    CVE-2019-2681 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD
  50. Medium 4.9

    CVE-2019-2644 · MySQL

    Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 23 Apr 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.