UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. Critical 9.8

    CVE-2020-26935 · phpMyAdmin

    An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.

    Published 10 Oct 2020 · Fixed in 4.9.6, 5.0.3 · NVD
  2. Medium 6.1

    CVE-2020-26934 · phpMyAdmin

    phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.

    Published 10 Oct 2020 · Fixed in 4.9.6, 5.0.3 · NVD
  3. Medium 6.1

    CVE-2020-15241 · TYPO3

    TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using…

    Published 8 Oct 2020 · NVD
  4. Medium 4.7

    CVE-2020-15242 · Next.js

    Open Redirect in Next.js versions

    Published 8 Oct 2020 · Fixed in 9.5.4 · OSV.dev and GitHub
  5. Medium 4.4

    CVE-2020-13344 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

    Published 8 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  6. High 8.7

    CVE-2020-13340 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

    Published 8 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  7. Medium 6.5

    CVE-2020-13339 · GitLab

    An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.

    Published 8 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  8. Medium 4.3

    CVE-2020-15226 · GLPI

    In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is…

    Published 7 Oct 2020 · Fixed in 9.5.2 · NVD
  9. Medium 5.3

    CVE-2020-15217 · GLPI

    In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.

    Published 7 Oct 2020 · Fixed in 9.5.2 · NVD
  10. Medium 6.1

    CVE-2020-15177 · GLPI

    In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious…

    Published 7 Oct 2020 · Fixed in 9.5.2 · NVD
  11. High 8.6

    CVE-2020-15176 · GLPI

    In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2

    Published 7 Oct 2020 · Fixed in 9.5.2 · NVD
  12. Critical 9.1

    CVE-2020-15175 · GLPI

    In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An…

    Published 7 Oct 2020 · Fixed in 9.5.2 · NVD
  13. Low 2.7

    CVE-2020-13342 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  14. Critical 9.8

    CVE-2020-11800 · Zabbix

    Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.

    Published 7 Oct 2020 · Fixed in 3.0.31 · NVD
  15. High 7.5

    CVE-2019-16160 · MikroTik RouterOS

    An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.

    Published 7 Oct 2020 · Fixed in 6.45.5 · NVD
  16. Critical 9.1

    CVE-2020-13347 · GitLab

    A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

    Published 7 Oct 2020 · Fixed in 13.2.4, 13.3.2, 13.4.1 · NVD
  17. Medium 6.5

    CVE-2020-13346 · GitLab

    Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  18. Medium 4.3

    CVE-2020-13335 · GitLab

    Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  19. High 7.5

    CVE-2020-13334 · GitLab

    In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query

    Published 7 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  20. Medium 4.3

    CVE-2020-14183 · Jira

    Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1.

    Published 6 Oct 2020 · Fixed in 7.13.18, 8.5.9, 8.12.1 · NVD
  21. Medium 5.4

    CVE-2020-13345 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes

    Published 6 Oct 2020 · Fixed in 13.2.10, 13.3.7, 13.4.2 · NVD
  22. High 8.8

    CVE-2020-13343 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template

    Published 6 Oct 2020 · NVD
  23. Medium 4.3

    CVE-2020-13333 · GitLab

    A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

    Published 6 Oct 2020 · NVD
  24. High 7.5

    CVE-2020-15598 · ModSecurity

    Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no…

    Published 6 Oct 2020 · NVD
  25. High 7.5

    CVE-2020-25613 · Ruby

    An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

    Published 6 Oct 2020 · NVD
  26. Critical 9.8

    CVE-1999-0199 · GNU C Library

    manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

    Published 6 Oct 2020 · Fixed in 2.2 · NVD
  27. High 8.8

    CVE-2020-26596 · Elementor Pro (WordPress plugin)

    Elementor Pro: Improper Privilege Management

    Published 6 Oct 2020 · Fixed in 3.0.6 · WPVulnerability
  28. Medium 6.5

    CVE-2020-8223 · Nextcloud

    A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.

    Published 5 Oct 2020 · NVD
  29. Medium 5.4

    CVE-2020-13338 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references.

    Published 2 Oct 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  30. Medium 4.8

    CVE-2020-13337 · GitLab

    An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name.

    Published 2 Oct 2020 · Fixed in 12.10.12 · NVD
  31. Medium 5.3

    CVE-2020-7070 · PHP

    In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

    Published 2 Oct 2020 · Fixed in 7.2.34, 7.3.23, 7.4.11 · NVD
  32. Medium 6.5

    CVE-2020-7069 · PHP

    In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

    Published 2 Oct 2020 · Fixed in 7.2.34, 7.3.23, 7.4.11 · NVD
  33. High 7.5

    CVE-2020-25623 · Erlang/OTP

    Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used.

    Published 2 Oct 2020 · Fixed in 22.3.4.6, 23.1 · NVD
  34. High 7.5

    CVE-2020-25018 · Envoy

    Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.

    Published 1 Oct 2020 · Fixed in 3b5acb2 · NVD
  35. High 8.3

    CVE-2020-25017 · Envoy

    Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

    Published 1 Oct 2020 · Fixed in 1.13.4, 1.14.4, 1.15.1 · NVD
  36. High 7.5

    CVE-2020-4576 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 184428.

    Published 1 Oct 2020 · Fixed in 8.0.0.15, 8.5.5.19, 9.0.5.6 · NVD
  37. High 8.1

    CVE-2020-13952 · Apache Superset

    In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password…

    Published 30 Sept 2020 · Fixed in 0.37.2 · NVD
  38. Medium 4.8

    CVE-2020-13336 · GitLab

    An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  39. Medium 6.8

    CVE-2020-25816 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

    Published 30 Sept 2020 · Fixed in 1.4.7, 1.5.4 · NVD
  40. Medium 4.9

    CVE-2020-8256 · Ivanti Connect Secure

    A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.

    Published 30 Sept 2020 · NVD
  41. High 7.2Actively exploited

    CVE-2020-8243 · Ivanti Connect Secure

    A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.

    Published 30 Sept 2020 · NVD
  42. Medium 6.1

    CVE-2020-8238 · Ivanti Connect Secure

    A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).

    Published 30 Sept 2020 · NVD
  43. Medium 5.4

    CVE-2020-13331 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  44. Medium 5.4

    CVE-2020-13330 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature.

    Published 30 Sept 2020 · Fixed in 12.10.13 · NVD
  45. Medium 6.5

    CVE-2020-13329 · GitLab

    An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the blob view feature.

    Published 30 Sept 2020 · Fixed in 12.6.2, 12.10.13 · NVD
  46. Medium 4.8

    CVE-2020-13328 · GitLab

    An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to a stored XSS by using the PyPi files API.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  47. Medium 4.3

    CVE-2020-13326 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  48. High 7.1

    CVE-2020-13325 · GitLab

    A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting the characters properly, potentially resulting in a denial of service.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  49. Medium 6.5

    CVE-2020-13324 · GitLab

    A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API.

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD
  50. High 7.7

    CVE-2020-13323 · GitLab

    A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos

    Published 30 Sept 2020 · Fixed in 12.10.13, 13.0.8, 13.1.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.