UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. High 7.5

    CVE-2020-7925 · MongoDB

    Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc12; MongoDB Server v4.2 versions prior to 4.2.9.

    Published 23 Nov 2020 · Fixed in 4.2.9 · NVD
  2. Medium 6.7

    CVE-2020-26231 · October CMS

    Bypass of fix for CVE-2020-15247, Twig sandbox escape

    Published 22 Nov 2020 · NVD, Project advisories (GitHub)
  3. Medium 5.4

    CVE-2020-15249 · October CMS

    Stored XSS by authenticated backend user with access to upload files

    Published 22 Nov 2020 · Fixed in 1.0.469 · NVD, Project advisories (GitHub)
  4. Medium 4.2

    CVE-2020-15248 · October CMS

    Privilege escalation by backend users assigned to the default "Publisher" system role

    Published 22 Nov 2020 · Fixed in 1.0.469 · NVD, Project advisories (GitHub)
  5. Medium 5.2

    CVE-2020-15247 · October CMS

    Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

    Published 22 Nov 2020 · Fixed in 1.0.469 · NVD, Project advisories (GitHub)
  6. High 7.5

    CVE-2020-15246 · October CMS

    Local File Inclusion by unauthenticated users

    Published 22 Nov 2020 · Fixed in 1.0.469 · NVD, Project advisories (GitHub)
  7. High 7.8

    CVE-2020-4005 · VMware ESXi

    VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when…

    Published 20 Nov 2020 · NVD
  8. High 8.2

    CVE-2020-4004 · VMware ESXi

    VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process…

    Published 20 Nov 2020 · NVD
  9. Medium 5.3

    CVE-2020-20739 · libvips

    im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.

    Published 20 Nov 2020 · Fixed in 8.8.2 · NVD
  10. High 7.8

    CVE-2020-19667 · ImageMagick

    Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.

    Published 20 Nov 2020 · NVD
  11. High 8.8Actively exploited

    CVE-2020-13671 · Drupal

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

    Published 20 Nov 2020 · Fixed in 8.8.11, 8.9.9, 9.0.8 · NVD
  12. High 7.8Actively exploited

    CVE-2020-28949 · Drupal

    Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

    Published 19 Nov 2020 · Fixed in 8.8.12, 8.9.10, 9.0.9 · NVD
  13. High 7.8

    CVE-2020-28948 · Drupal

    Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

    Published 19 Nov 2020 · Fixed in 8.8.12, 8.9.10, 9.0.9 · NVD
  14. Medium 5.3

    CVE-2020-25703 · Moodle

    The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.

    Published 19 Nov 2020 · NVD
  15. Medium 6.1

    CVE-2020-25702 · Moodle

    In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

    Published 19 Nov 2020 · Fixed in 3.9.3 · NVD
  16. Medium 5.3

    CVE-2020-25701 · Moodle

    If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6,…

    Published 19 Nov 2020 · NVD
  17. Medium 6.5

    CVE-2020-25700 · Moodle

    In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.

    Published 19 Nov 2020 · NVD
  18. High 7.5

    CVE-2020-25699 · Moodle

    In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

    Published 19 Nov 2020 · NVD
  19. High 7.5

    CVE-2020-25698 · Moodle

    Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.

    Published 19 Nov 2020 · NVD
  20. High 7.5

    CVE-2020-8277 · c-ares, Node.js

    A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

    Published 19 Nov 2020 · Fixed in 12.19.1, 14.15.1, 15.2.1 · NVD
  21. Medium 4.3

    CVE-2020-5947 · F5 BIG-IP

    In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. Only these platforms are affected: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115),…

    Published 19 Nov 2020 · Fixed in 15.1.2, 16.0.1 · NVD
  22. High 7.6

    CVE-2020-13359 · GitLab

    The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 19 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  23. High 8.2

    CVE-2020-13356 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 19 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  24. High 8.1

    CVE-2020-13355 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 19 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  25. High 7.1

    CVE-2020-26405 · GitLab

    Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  26. Medium 4.3

    CVE-2020-13349 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  27. Medium 5.7

    CVE-2020-13348 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  28. Medium 6.5

    CVE-2020-13351 · GitLab

    Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  29. Medium 4.3

    CVE-2020-13350 · GitLab

    CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  30. Medium 5.4

    CVE-2020-25798 · LimeSurvey

    A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will…

    Published 17 Nov 2020 · NVD
  31. Medium 5.4

    CVE-2020-28647 · MOVEit Transfer

    In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).

    Published 17 Nov 2020 · Fixed in 2020.1 · NVD
  32. Medium 6.1

    CVE-2020-26227 · TYPO3

    Cross-Site Scripting in Fluid view helpers

    Published 17 Nov 2020 · Fixed in 8.7.38, 9.5.23, 10.4.10 · NVD, Project advisories (GitHub)
  33. High 7.5

    CVE-2020-26228 · TYPO3

    Cleartext storage of session identifier

    Published 17 Nov 2020 · Fixed in 9.5.23, 10.4.10 · NVD, Project advisories (GitHub)
  34. Low 3.7

    CVE-2020-26229 · TYPO3

    XML External Entity in Dashboard Widget

    Published 17 Nov 2020 · Fixed in 10.4.10 · NVD, Project advisories (GitHub)
  35. Medium 5.3

    CVE-2020-26406 · GitLab

    Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  36. Medium 5.5

    CVE-2020-13358 · GitLab

    A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  37. Medium 4.3

    CVE-2020-13354 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.

    Published 17 Nov 2020 · Fixed in 13.3.9 · NVD
  38. Medium 5.3

    CVE-2020-13352 · GitLab

    Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

    Published 17 Nov 2020 · Fixed in 13.3.9, 13.4.5, 13.5.2 · NVD
  39. High 8.8

    CVE-2020-26217 · Apache ActiveMQ

    XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue…

    Published 16 Nov 2020 · Fixed in 5.15.14 · NVD
  40. High 7.5

    CVE-2020-23490 · AVideo

    There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.

    Published 16 Nov 2020 · Fixed in 8.9 · NVD
  41. High 8.8

    CVE-2020-23489 · AVideo

    The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.

    Published 16 Nov 2020 · Fixed in 8.9 · NVD
  42. Medium 5.4

    CVE-2020-27991 · Nagios XI

    Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).

    Published 16 Nov 2020 · Fixed in 5.7.5 · NVD
  43. Medium 5.4

    CVE-2020-27990 · Nagios XI

    Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).

    Published 16 Nov 2020 · Fixed in 5.7.5 · NVD
  44. Medium 5.4

    CVE-2020-27989 · Nagios XI

    Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).

    Published 16 Nov 2020 · Fixed in 5.7.5 · NVD
  45. Medium 5.4

    CVE-2020-27988 · Nagios XI

    Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).

    Published 16 Nov 2020 · Fixed in 5.7.5 · NVD
  46. Medium 6.1

    CVE-2020-27627 · TeamCity

    JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.

    Published 16 Nov 2020 · Fixed in 2020.1.2 · NVD
  47. Medium 5.3

    CVE-2020-27629 · TeamCity

    In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.

    Published 16 Nov 2020 · Fixed in 2020.1.5 · NVD
  48. Medium 4.3

    CVE-2020-27628 · TeamCity

    In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.

    Published 16 Nov 2020 · Fixed in 2020.1.5 · NVD
  49. High 7.5

    CVE-2020-26224 · PrestaShop

    Improper Access Control with submitReorder function

    Published 16 Nov 2020 · Fixed in 1.7.6.9 · NVD, Project advisories (GitHub)
  50. High 8.8

    CVE-2020-28648 · Nagios XI

    Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.

    Published 16 Nov 2020 · Fixed in 5.7.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.