UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,273
Published in 7 days
222
Critical in 30 days
71
Actively exploited
64

Latest vulnerabilities

11,273 vulnerabilities
  1. Medium 6.5

    CVE-2019-7155 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group.

    Published 16 Apr 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  2. High 8.1

    CVE-2019-0232 · Apache Tomcat

    When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be…

    Published 15 Apr 2019 · NVD
  3. Medium 6.1

    CVE-2019-6796 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.

    Published 11 Apr 2019 · Fixed in 11.5.8, 11.7.1 · NVD
  4. Critical 9.8

    CVE-2019-11068 · Java

    libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

    Published 10 Apr 2019 · NVD
  5. High 7.5

    CVE-2019-10946 · Joomla!

    An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated users.

    Published 10 Apr 2019 · NVD
  6. Critical 9.8

    CVE-2019-10945 · Joomla!

    An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.

    Published 10 Apr 2019 · NVD
  7. Critical 9.8

    CVE-2019-7139 · Magento / Adobe Commerce

    An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 10 Apr 2019 · Fixed in 2.1.17, 2.2.8, 2.3.1 · NVD
  8. High 7.5

    CVE-2019-0199 · Apache Tomcat

    The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to…

    Published 10 Apr 2019 · NVD
  9. High 7.5

    CVE-2019-0815 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

    Published 9 Apr 2019 · NVD
  10. High 7.8Actively exploited

    CVE-2019-0211 · Apache HTTP Server

    In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

    Published 8 Apr 2019 · NVD
  11. High 7.5

    CVE-2019-0217 · Apache HTTP Server

    In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

    Published 8 Apr 2019 · NVD
  12. High 7.5

    CVE-2019-0215 · Apache HTTP Server

    In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

    Published 8 Apr 2019 · NVD
  13. High 7.5

    CVE-2018-20229 · GitLab

    GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal.

    Published 4 Apr 2019 · Fixed in 11.3.14, 11.4.12, 11.5.5 · NVD
  14. High 7.2

    CVE-2019-9193 · PostgreSQL

    In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an…

    Published 1 Apr 2019 · NVD
  15. High 7.5

    CVE-2019-6715 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 Apr 2019 · Fixed in 0.9.4 · WPVulnerability
  16. High 7.5

    CVE-2019-5739 · Node.js

    Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

    Published 28 Mar 2019 · NVD
  17. High 7.5

    CVE-2019-5737 · Node.js

    In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer…

    Published 28 Mar 2019 · Fixed in 8.15.1, 10.15.2, 11.10.1 · NVD
  18. High 7.5

    CVE-2018-20144 · GitLab

    GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.

    Published 28 Mar 2019 · Fixed in 11.3.13, 11.4.11, 11.5.4 · NVD
  19. High 7.5

    CVE-2018-19856 · GitLab

    GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API.

    Published 26 Mar 2019 · Fixed in 11.3.12, 11.4.10, 11.5.3 · NVD
  20. High 8.1

    CVE-2019-7611 · Elasticsearch

    A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data…

    Published 25 Mar 2019 · Fixed in 5.6.15, 6.6.1 · NVD
  21. Critical 9.8Actively exploited

    CVE-2019-3396 · Confluence

    The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a…

    Published 25 Mar 2019 · Fixed in 6.12.3, 6.13.3, 6.14.2 · NVD
  22. Critical 9.8

    CVE-2019-3395 · Confluence

    The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery.

    Published 25 Mar 2019 · Fixed in 6.13.3, 6.14.2 · NVD
  23. High 7.5

    CVE-2019-6240 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.

    Published 25 Mar 2019 · Fixed in 11.4.0 · NVD
  24. Critical 9.1

    CVE-2019-9948 · Python

    urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

    Published 23 Mar 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD
  25. Medium 6.1

    CVE-2019-9947 · Python

    An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the…

    Published 23 Mar 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD
  26. High 7.5

    CVE-2018-20615 · HAProxy

    An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.

    Published 21 Mar 2019 · NVD
  27. High 8.8

    CVE-2019-9787 · WordPress

    WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is…

    Published 14 Mar 2019 · Fixed in 5.1.1 · NVD
  28. Medium 6.1

    CVE-2019-9740 · Python

    An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18,…

    Published 13 Mar 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD
  29. Medium 6.1

    CVE-2019-9714 · Joomla!

    An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS.

    Published 12 Mar 2019 · Fixed in 3.9.4 · NVD
  30. High 7.5

    CVE-2019-9713 · Joomla!

    An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access.

    Published 12 Mar 2019 · Fixed in 3.9.4 · NVD
  31. Medium 6.1

    CVE-2019-9712 · Joomla!

    An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS.

    Published 12 Mar 2019 · Fixed in 3.9.4 · NVD
  32. Medium 6.1

    CVE-2019-9711 · Joomla!

    An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS.

    Published 12 Mar 2019 · Fixed in 3.9.4 · NVD
  33. High 8.1

    CVE-2019-9675 · PHP

    An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible.

    Published 11 Mar 2019 · Fixed in 7.1.27, 7.3.3 · NVD
  34. Critical 9.8

    CVE-2019-9641 · PHP

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.

    Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD
  35. High 7.5

    CVE-2019-9640 · PHP

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.

    Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD
  36. High 7.5

    CVE-2019-9639 · PHP

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.

    Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD
  37. High 7.5

    CVE-2019-9638 · PHP

    An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.

    Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD
  38. High 7.5

    CVE-2019-9637 · PHP

    An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.

    Published 9 Mar 2019 · Fixed in 7.1.27, 7.2.16, 7.3.3 · NVD
  39. Critical 9.8

    CVE-2019-9636 · Python

    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be…

    Published 8 Mar 2019 · Fixed in 3.5.7, 3.6.9, 3.7.3 · NVD
  40. High 7.4

    CVE-2019-1543 · OpenSSL

    ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are…

    Published 6 Mar 2019 · NVD
  41. Medium 5.9

    CVE-2019-1559 · Node.js, OpenSSL, MySQL

    If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is…

    Published 27 Feb 2019 · Fixed in 1.0.2r, 6.17.0, 8.15.1 · NVD
  42. Critical 9.8

    CVE-2019-9025 · PHP

    An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.

    Published 22 Feb 2019 · Fixed in 7.3.1 · NVD
  43. High 7.5

    CVE-2019-9024 · PHP

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.

    Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD
  44. Critical 9.8

    CVE-2019-9023 · PHP

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c,…

    Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD
  45. High 7.5

    CVE-2019-9022 · PHP

    An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

    Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.2 · NVD
  46. Critical 9.8

    CVE-2019-9021 · PHP

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to…

    Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD
  47. Critical 9.8

    CVE-2019-9020 · PHP

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

    Published 22 Feb 2019 · Fixed in 7.1.26, 7.2.14, 7.3.1 · NVD
  48. High 7.5

    CVE-2018-20783 · PHP

    In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.

    Published 21 Feb 2019 · Fixed in 7.0.33, 7.1.25, 7.2.13 · NVD
  49. Medium 6.5

    CVE-2019-8943 · WordPress

    WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.

    Published 20 Feb 2019 · NVD
  50. High 8.8

    CVE-2019-8942 · WordPress

    WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.

    Published 20 Feb 2019 · Fixed in 4.9.9 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.