UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,064
Published in 7 days
647
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,064 vulnerabilities
  1. High 7.5

    CVE-2022-42978 · Confluence

    In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.

    Published 15 Nov 2022 · Fixed in 1.3.5 · NVD
  2. High 7.5

    CVE-2022-42977 · Confluence

    The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.

    Published 15 Nov 2022 · Fixed in 1.3.5 · NVD
  3. Medium 5.3

    CVE-2022-42128 · Liferay Portal / DXP

    The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.

    Published 15 Nov 2022 · Fixed in 7.4.3.5 · NVD
  4. Medium 5.3

    CVE-2022-42127 · Liferay Portal / DXP

    The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.

    Published 15 Nov 2022 · Fixed in 7.4.3.37 · NVD
  5. Medium 4.3

    CVE-2022-42126 · Liferay Portal / DXP

    The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

    Published 15 Nov 2022 · Fixed in 7.4.3.29 · NVD
  6. High 7.5

    CVE-2022-42125 · Liferay Portal / DXP

    Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.

    Published 15 Nov 2022 · Fixed in 7.4.3.36 · NVD
  7. High 7.5

    CVE-2022-42124 · Liferay Portal / DXP

    ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.

    Published 15 Nov 2022 · Fixed in 7.4.3.5 · NVD
  8. High 7.5

    CVE-2022-42123 · Liferay Portal / DXP

    A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.

    Published 15 Nov 2022 · Fixed in 7.4.3.19 · NVD
  9. Critical 9.8

    CVE-2022-42122 · Liferay Portal / DXP

    A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.

    Published 15 Nov 2022 · NVD
  10. High 8.8

    CVE-2022-42121 · Liferay Portal / DXP

    A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.

    Published 15 Nov 2022 · NVD
  11. Critical 9.8

    CVE-2022-42120 · Liferay Portal / DXP

    A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

    Published 15 Nov 2022 · NVD
  12. Medium 5.4

    CVE-2022-42119 · Liferay Portal / DXP

    Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

    Published 15 Nov 2022 · NVD
  13. Medium 6.1

    CVE-2022-42118 · Liferay Portal / DXP

    A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.

    Published 15 Nov 2022 · NVD
  14. Medium 5.4

    CVE-2022-42111 · Liferay Portal / DXP

    A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.

    Published 15 Nov 2022 · NVD
  15. Medium 6.1

    CVE-2022-42110 · Liferay Portal / DXP

    A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.

    Published 15 Nov 2022 · NVD
  16. Medium 4.8

    CVE-2022-43695 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  17. Medium 5.3

    CVE-2022-43691 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  18. Medium 6.3

    CVE-2022-43690 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  19. Medium 5.3

    CVE-2022-43689 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  20. Medium 4.8

    CVE-2022-43688 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  21. Medium 5.4

    CVE-2022-43687 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  22. Medium 6.1

    CVE-2022-43968 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  23. Medium 6.1

    CVE-2022-43967 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  24. Medium 6.5

    CVE-2022-43686 · Concrete CMS

    In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  25. Medium 6.5

    CVE-2022-39385 · Discourse

    Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message topics that they should not be added to. They are not notified of this, it happens transparently in the background. This issue has been resolved in commit `a414520742` and will be included in future releases. Users are advised to upgrade.…

    Published 14 Nov 2022 · Fixed in 2.8.10 · NVD
  26. Medium 6.1

    CVE-2022-43694 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  27. Medium 6.1

    CVE-2022-43692 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  28. High 8.8

    CVE-2022-43693 · Concrete CMS

    Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.

    Published 14 Nov 2022 · Fixed in 8.5.10 · NVD
  29. Medium 6.1

    CVE-2022-3988 · Frappe Framework

    A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is…

    Published 14 Nov 2022 · NVD
  30. High 8.8

    CVE-2022-40127 · Apache Airflow

    A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

    Published 14 Nov 2022 · Fixed in 2.4.0 · NVD
  31. High 7.5

    CVE-2022-27949 · Apache Airflow

    A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.

    Published 14 Nov 2022 · Fixed in 2.3.1 · NVD
  32. High 7.1

    CVE-2022-31630 · PHP

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

    Published 14 Nov 2022 · Fixed in 7.4.33, 8.0.25, 8.1.12 · NVD
  33. High 8.1

    CVE-2022-3965 · FFmpeg

    A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to…

    Published 13 Nov 2022 · Fixed in 5.0.3, 5.1.3 · NVD
  34. High 8.1

    CVE-2022-3964 · FFmpeg

    A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to…

    Published 13 Nov 2022 · Fixed in 4.4.4, 5.0.3, 5.1.3 · NVD
  35. Medium 5.4

    CVE-2022-40750 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.

    Published 11 Nov 2022 · NVD
  36. Unrated

    WPV-2d3072452f6d · Yith Woocommerce Catalog Mode (WordPress plugin)

    Vulnerability in YITH WooCommerce Catalog Mode

    Published 11 Nov 2022 · Fixed in 2.16.1 · WPVulnerability
  37. Unrated

    WPV-29469e2f4254 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 11 Nov 2022 · Fixed in 3.15.0 · WPVulnerability
  38. Medium 4.6

    CVE-2022-44630 · Yith Woocommerce Catalog Mode (WordPress plugin), Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Catalog Mode: Cross-Site Request Forgery (CSRF)

    Published 11 Nov 2022 · Fixed in 2.16.1, 3.15.0 · WPVulnerability
  39. Critical 9.8

    CVE-2022-41878 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is…

    Published 10 Nov 2022 · Fixed in 4.10.19, 5.3.2 · NVD
  40. Critical 9.8

    CVE-2022-41879 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known…

    Published 10 Nov 2022 · Fixed in 4.10.20, 5.3.3 · NVD
  41. Low

    GHSA-vp35-85q5-9f25 · Docker Engine

    Container build can leak any path on the host into the container (using Git CVE-2022-39253)

    Published 10 Nov 2022 · Fixed in 2.13.0, 20.10.14, 20.10.20 · Project advisories (GitHub)
  42. Critical 9.8

    CVE-2022-39396 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in…

    Published 10 Nov 2022 · Fixed in 4.10.18, 5.3.1 · NVD
  43. Medium 4.3

    CVE-2022-3819 · GitLab

    An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  44. Medium 5.3

    CVE-2022-3818 · GitLab

    An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  45. Medium 5.3

    CVE-2022-3793 · GitLab

    An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  46. Critical 9.0

    CVE-2022-3726 · GitLab

    Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  47. Medium 4.3

    CVE-2022-3706 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  48. Medium 4.3

    CVE-2022-3413 · GitLab

    Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  49. Medium 6.1

    CVE-2022-3486 · GitLab

    An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  50. Medium 5.4

    CVE-2022-3483 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.