UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. High 7.2

    CVE-2020-7759 · Pimcore

    The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request:…

    Published 30 Oct 2020 · Fixed in 6.8.3 · NVD
  2. Medium 5.5

    CVE-2020-14323 · Samba

    A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

    Published 29 Oct 2020 · Fixed in 4.11.15, 4.12.9, 4.13.1 · NVD
  3. High 7.5

    CVE-2020-5936 · F5 BIG-IP

    On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile.

    Published 29 Oct 2020 · Fixed in 12.1.5.2, 14.1.2.8, 15.1.1 · NVD
  4. Medium 5.9

    CVE-2020-5935 · F5 BIG-IP

    On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handling MQTT traffic through a BIG-IP virtual server associated with an MQTT profile and an iRule performing manipulations on that traffic, TMM may produce a core file.

    Published 29 Oct 2020 · Fixed in 13.1.3.4, 14.1.2.4, 15.1.1 · NVD
  5. Medium 6.5

    CVE-2020-5934 · F5 BIG-IP

    On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout (SLO) URL are passing through a TCP Keep-Alive connection, traffic to TMM can be disrupted.

    Published 29 Oct 2020 · Fixed in 13.1.3.4, 14.1.2.4, 15.1.1 · NVD
  6. High 7.5

    CVE-2020-5933 · F5 BIG-IP

    On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual server configured with an HTTP compression profile processes compressed HTTP message payloads that require deflation, a Slowloris-style attack can trigger an out-of-memory condition on the BIG-IP system.

    Published 29 Oct 2020 · Fixed in 12.1.5.2, 14.1.2.4, 15.1.1 · NVD
  7. High 7.5

    CVE-2020-5931 · F5 BIG-IP

    On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart.

    Published 29 Oct 2020 · Fixed in 14.1.2.5, 15.1.1 · NVD
  8. Medium 6.5

    CVE-2020-5938 · F5 BIG-IP

    On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a different key length than the BIG-IP configuration would otherwise allow.

    Published 29 Oct 2020 · NVD
  9. High 7.5

    CVE-2020-27986 · SonarQube Server

    SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.

    Published 28 Oct 2020 · NVD
  10. Medium 6.5

    CVE-2020-4782 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

    Published 28 Oct 2020 · NVD
  11. Medium 6.1

    CVE-2020-24303 · Grafana

    Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

    Published 28 Oct 2020 · NVD
  12. Medium 6.1

    CVE-2020-8262 · Ivanti Connect Secure

    A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.

    Published 28 Oct 2020 · NVD
  13. Medium 4.3

    CVE-2020-8261 · Ivanti Connect Secure

    A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.

    Published 28 Oct 2020 · NVD
  14. High 7.2Actively exploited

    CVE-2020-8260 · Ivanti Connect Secure

    A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.

    Published 28 Oct 2020 · NVD
  15. Medium 5.4

    CVE-2020-27957 · MediaWiki

    The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.

    Published 28 Oct 2020 · NVD
  16. High 7.2

    CVE-2020-15352 · Ivanti Connect Secure

    An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

    Published 27 Oct 2020 · NVD
  17. High 7.0

    CVE-2020-27216 · Eclipse Jetty

    In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary…

    Published 23 Oct 2020 · Fixed in 9.3.29 · NVD
  18. Medium 4.3

    CVE-2020-15270 · Parse Server

    Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.

    Published 22 Oct 2020 · NVD
  19. Medium 5.3

    CVE-2020-27674 · Xen

    An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.

    Published 22 Oct 2020 · NVD
  20. Medium 5.5

    CVE-2020-27673 · Xen

    An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.

    Published 22 Oct 2020 · NVD
  21. High 7.0

    CVE-2020-27672 · Xen

    An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.

    Published 22 Oct 2020 · NVD
  22. High 7.8

    CVE-2020-27671 · Xen

    An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.

    Published 22 Oct 2020 · NVD
  23. High 7.8

    CVE-2020-27670 · Xen

    An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

    Published 22 Oct 2020 · NVD
  24. Medium 5.4

    CVE-2020-27666 · Strapi

    Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.

    Published 22 Oct 2020 · Fixed in 3.2.5 · NVD
  25. High 7.5

    CVE-2020-27665 · Strapi

    In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.

    Published 22 Oct 2020 · Fixed in 3.2.5 · NVD
  26. Critical 9.8

    CVE-2020-27664 · Strapi

    admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.

    Published 22 Oct 2020 · Fixed in 3.2.5 · NVD
  27. Low 3.1

    CVE-2020-7020 · Elasticsearch

    Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional…

    Published 22 Oct 2020 · Fixed in 6.8.13, 7.9.2 · NVD
  28. Low 3.3

    CVE-2020-27560 · ImageMagick

    ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.

    Published 22 Oct 2020 · NVD
  29. Medium 4.3

    CVE-2020-27621 · MediaWiki

    The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.

    Published 22 Oct 2020 · NVD
  30. Critical 9.8

    CVE-2020-27619 · Python

    In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

    Published 22 Oct 2020 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD
  31. Medium 6.1

    CVE-2020-3599 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.29 · NVD
  32. Low 3.7

    CVE-2020-3585 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TLS handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that…

    Published 21 Oct 2020 · Fixed in 6.6.1, 9.13.1.13, 9.14.1.30 · NVD
  33. Medium 6.1

    CVE-2020-3583 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.30 · NVD
  34. Medium 6.1

    CVE-2020-3582 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.30 · NVD
  35. Medium 6.1

    CVE-2020-3581 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.30 · NVD
  36. Medium 6.1Actively exploited

    CVE-2020-3580 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input…

    Published 21 Oct 2020 · Fixed in 9.13.1.21, 9.14.2.8, 9.15.1.15 · NVD
  37. Medium 6.5

    CVE-2020-3578 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The vulnerability is due to insufficient validation of URLs when portal access rules are…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.19 · NVD
  38. High 8.6

    CVE-2020-3572 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a memory leak when closing SSL/TLS connections in a specific state. An attacker could exploit this…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.19 · NVD
  39. Medium 5.3

    CVE-2020-3564 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.19 · NVD
  40. Medium 4.7

    CVE-2020-3561 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by persuading a user…

    Published 21 Oct 2020 · Fixed in 9.12.3.9, 9.13.1.10, 9.14.1.10 · NVD
  41. High 7.5

    CVE-2020-3555 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SIP inspection process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a watchdog timeout and crash during the cleanup of threads that are…

    Published 21 Oct 2020 · Fixed in 9.12.4.2, 9.13.1.13, 9.14.1.19 · NVD
  42. High 7.5

    CVE-2020-3554 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TCP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a memory exhaustion condition. An attacker could exploit this vulnerability by sending a high rate of…

    Published 21 Oct 2020 · Fixed in 9.12.4.3, 9.13.1.13, 9.14.1.30 · NVD
  43. High 7.5

    CVE-2020-3529 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to inefficient direct memory access (DMA) memory management during the…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.30 · NVD
  44. High 7.5

    CVE-2020-3528 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation when the affected software processes…

    Published 21 Oct 2020 · Fixed in 9.12.4.4, 9.13.1.13, 9.14.1.19 · NVD
  45. Medium 6.7

    CVE-2020-3458 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the secure boot process of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software for the Firepower 1000 Series and Firepower 2100 Series Appliances could allow an authenticated, local attacker to bypass the secure boot mechanism. The vulnerabilities are due to insufficient protections of the secure boot process. An attacker could…

    Published 21 Oct 2020 · Fixed in 9.12.4.3, 9.13.1.13, 9.14.1.15 · NVD
  46. Medium 6.7

    CVE-2020-3457 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful…

    Published 21 Oct 2020 · Fixed in 9.10.1.40, 9.12.4.3, 9.13.1.13 · NVD
  47. High 8.6

    CVE-2020-3436 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected device, which could lead to an unexpected device reload. The vulnerability exists because the affected software does not efficiently handle the…

    Published 21 Oct 2020 · Fixed in 9.12.4.2, 9.13.1.12, 9.14.1.15 · NVD
  48. High 8.6

    CVE-2020-3373 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from being processed through the device, resulting in a denial of service (DoS) condition. The…

    Published 21 Oct 2020 · NVD
  49. High 8.6

    CVE-2020-3304 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this…

    Published 21 Oct 2020 · Fixed in 9.12.3.12, 9.13.1.12, 9.14.1.10 · NVD
  50. Medium 4.9

    CVE-2020-14893 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Oct 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.