UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,137
Published in 7 days
669
Critical in 30 days
357
Actively exploited
421

Latest vulnerabilities

39,137 vulnerabilities
  1. Medium 5.3

    CVE-2021-23123 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.

    Published 12 Jan 2021 · NVD
  2. High 7.5

    CVE-2021-1723 · .NET

    ASP.NET Core and Visual Studio Denial of Service Vulnerability

    Published 12 Jan 2021 · NVD
  3. High 7.8

    CVE-2021-23240 · sudo

    selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.

    Published 12 Jan 2021 · Fixed in 1.8.32, 1.9.5 · NVD
  4. Low 2.5

    CVE-2021-23239 · sudo

    The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.

    Published 12 Jan 2021 · Fixed in 1.8.32, 1.9.5 · NVD
  5. High 7.5

    CVE-2020-17509 · Apache Traffic Server

    ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

    Published 11 Jan 2021 · NVD
  6. High 7.5

    CVE-2020-17508 · Apache Traffic Server

    The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

    Published 11 Jan 2021 · NVD
  7. Medium 5.3

    CVE-2020-28208 · Rocket.Chat

    An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

    Published 8 Jan 2021 · NVD
  8. Medium 4.8

    CVE-2021-3111 · Concrete CMS

    The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.

    Published 8 Jan 2021 · Fixed in 8.5.5 · NVD
  9. Medium 6.1

    CVE-2020-25476 · Liferay Portal / DXP

    Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate…

    Published 7 Jan 2021 · NVD
  10. Medium 6.5

    CVE-2020-8287 · Node.js

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

    Published 6 Jan 2021 · Fixed in 12.20.1, 14.15.4, 15.5.1 · NVD
  11. High 8.1

    CVE-2020-8265 · Node.js

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult…

    Published 6 Jan 2021 · Fixed in 12.20.1, 14.15.4, 15.5.1 · NVD
  12. Critical 9.8

    CVE-2021-3021 · ISPConfig

    ISPConfig before 3.2.2 allows SQL injection.

    Published 5 Jan 2021 · Fixed in 3.2.2 · NVD
  13. Medium 6.1

    CVE-2021-3014 · MikroTik RouterOS

    In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.

    Published 4 Jan 2021 · NVD
  14. Medium 5.9

    CVE-2019-25013 · GNU C Library

    The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

    Published 4 Jan 2021 · NVD
  15. High 7.5

    CVE-2020-25275 · Dovecot

    Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.

    Published 4 Jan 2021 · Fixed in 2.3.13 · NVD
  16. Medium 6.8

    CVE-2020-24386 · Dovecot

    An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

    Published 4 Jan 2021 · Fixed in 2.3.13 · NVD
  17. High 7.5

    CVE-2020-35965 · FFmpeg

    decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations.

    Published 4 Jan 2021 · Fixed in 4.4 · NVD
  18. Medium 6.5

    CVE-2020-35964 · FFmpeg

    track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.

    Published 3 Jan 2021 · NVD
  19. Medium 5.4

    CVE-2020-25799 · LimeSurvey

    LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.

    Published 31 Dec 2020 · NVD
  20. Medium 5.4

    CVE-2020-25797 · LimeSurvey

    LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.

    Published 31 Dec 2020 · NVD
  21. Medium 5.3

    CVE-2020-27534 · Docker Engine

    util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.

    Published 30 Dec 2020 · Fixed in 19.03.9 · NVD
  22. Medium 6.5

    CVE-2020-26288 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

    Published 30 Dec 2020 · Fixed in 4.5.0 · NVD
  23. Medium 6.5

    CVE-2020-5811 · Umbraco CMS

    An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.

    Published 30 Dec 2020 · NVD
  24. Medium 5.4

    CVE-2020-5810 · Umbraco CMS

    A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload.

    Published 30 Dec 2020 · NVD
  25. Medium 5.4

    CVE-2020-5809 · Umbraco CMS

    A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.

    Published 30 Dec 2020 · NVD
  26. Critical 9.8

    CVE-2020-29594 · Rocket.Chat

    Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.

    Published 30 Dec 2020 · Fixed in 3.7.3, 3.8.3, 3.9.1 · NVD
  27. Medium 4.8

    CVE-2020-29471 · OpenCart

    OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.

    Published 29 Dec 2020 · NVD
  28. Medium 4.8

    CVE-2020-29470 · OpenCart

    OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.

    Published 29 Dec 2020 · NVD
  29. Critical 9.8

    CVE-2020-35769 · Webmin

    miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.

    Published 29 Dec 2020 · NVD
  30. Medium 6.1Actively exploited

    CVE-2020-35730 · Roundcube

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

    Published 28 Dec 2020 · Fixed in 1.2.13, 1.3.16, 1.4.10 · NVD
  31. High 7.5

    CVE-2020-35616 · Joomla!

    An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations.

    Published 28 Dec 2020 · NVD
  32. Medium 6.3

    CVE-2020-35615 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.

    Published 28 Dec 2020 · NVD
  33. Medium 5.3

    CVE-2020-35614 · Joomla!

    An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page.

    Published 28 Dec 2020 · NVD
  34. Critical 9.8

    CVE-2020-35613 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list.

    Published 28 Dec 2020 · NVD
  35. High 7.5

    CVE-2020-35612 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability.

    Published 28 Dec 2020 · NVD
  36. High 7.5

    CVE-2020-35611 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.

    Published 28 Dec 2020 · NVD
  37. High 7.5

    CVE-2020-35610 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms.

    Published 28 Dec 2020 · NVD
  38. High 7.5

    CVE-2020-35359 · Pure-FTPd

    Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.

    Published 26 Dec 2020 · NVD
  39. Unrated

    WPV-462a6eeaf9ea · LiteSpeed Cache

    Vulnerability in LiteSpeed Cache

    Published 26 Dec 2020 · Fixed in 3.6.1 · WPVulnerability
  40. Medium 6.1

    CVE-2020-29172 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 26 Dec 2020 · Fixed in 3.6.1 · NVD, WPVulnerability
  41. High 7.0

    CVE-2020-28912 · MariaDB

    With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected…

    Published 24 Dec 2020 · Fixed in 10.3.26, 10.4.16, 10.5.7 · NVD
  42. Medium 6.1

    CVE-2020-27729 · F5 BIG-IP

    In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  43. Medium 4.9

    CVE-2020-27727 · F5 BIG-IP

    On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1.1 · NVD
  44. Medium 6.1

    CVE-2020-27726 · F5 BIG-IP

    In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  45. High 7.5

    CVE-2020-27723 · F5 BIG-IP

    In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the Traffic Management Microkernel (TMM) process.

    Published 24 Dec 2020 · Fixed in 13.1.3.5, 14.1.3.1, 15.1.0 · NVD
  46. Medium 6.5

    CVE-2020-27722 · F5 BIG-IP

    In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption.

    Published 24 Dec 2020 · Fixed in 13.1.3.5, 14.1.3.1, 15.0.1.4 · NVD
  47. High 7.5

    CVE-2020-27720 · F5 BIG-IP

    On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Block Allocation (PBA) mode and SP-DAG enabled, and dag-ipv6-prefix-len configured with a value less than the default of 128, an undisclosed traffic pattern may cause the Traffic Management Microkernel (TMM) to restart.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  48. Medium 6.1

    CVE-2020-27719 · F5 BIG-IP

    On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1, 16.0.1 · NVD
  49. High 7.5

    CVE-2020-27716 · F5 BIG-IP

    On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1 · NVD
  50. High 7.5

    CVE-2020-27715 · F5 BIG-IP

    On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon.

    Published 24 Dec 2020 · Fixed in 14.1.3.1, 15.1.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.