UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Medium 6.5

    CVE-2020-25597 · Xen

    An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. However, operations like the resetting of all event channels may involve decreasing one of the bounds…

    Published 23 Sept 2020 · NVD
  2. Medium 5.5

    CVE-2020-25596 · Xen

    An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than…

    Published 23 Sept 2020 · NVD
  3. High 7.8

    CVE-2020-25595 · Xen

    An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have…

    Published 23 Sept 2020 · NVD
  4. High 7.5

    CVE-2020-11031 · GLPI

    In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

    Published 23 Sept 2020 · Fixed in 9.5.0 · NVD
  5. Medium 5.3

    CVE-2020-14370 · Podman

    An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this…

    Published 23 Sept 2020 · Fixed in 2.0.5 · NVD
  6. High 7.2

    CVE-2019-15992 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The vulnerability is due to insufficient restrictions on the…

    Published 23 Sept 2020 · Fixed in 9.13.1.4, 9.14.2.7, 9.15.1.4 · NVD
  7. Medium 6.5

    CVE-2020-15839 · Liferay Portal / DXP

    Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

    Published 22 Sept 2020 · Fixed in 7.3.3 · NVD
  8. High 7.5

    CVE-2020-4643 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590.

    Published 21 Sept 2020 · NVD
  9. Medium 6.5

    CVE-2020-4590 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack conducted by an authenticated client. IBM X-Force ID: 184650.

    Published 21 Sept 2020 · NVD
  10. Low

    GHSA-qvc5-cfrr-384v · Shopware

    RCE in Third Party Library

    Published 21 Sept 2020 · Fixed in 6.3.1.1 · Project advisories (GitHub)
  11. Low

    GHSA-qvhr-55hg-3qwv · Shopware

    Non-persistent XSS in the Storefront

    Published 21 Sept 2020 · Fixed in 6.3.1.1 · Project advisories (GitHub)
  12. Medium 5.3

    CVE-2020-14179 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.

    Published 21 Sept 2020 · Fixed in 8.5.8, 8.11.1 · NVD
  13. Medium 6.5

    CVE-2020-14177 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1.

    Published 21 Sept 2020 · Fixed in 8.5.7, 8.10.2, 8.11.1 · NVD
  14. Medium 6.5

    CVE-2020-5421 · Oracle WebLogic Server

    In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

    Published 19 Sept 2020 · NVD
  15. High 7.8

    CVE-2020-8252 · Node.js

    The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

    Published 18 Sept 2020 · Fixed in 10.22.1, 12.18.4, 14.9.0 · NVD
  16. High 7.5

    CVE-2020-8251 · Node.js

    Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

    Published 18 Sept 2020 · Fixed in 14.11.0 · NVD
  17. High 8.8

    CVE-2020-8247 · NetScaler ADC and Gateway

    Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2…

    Published 18 Sept 2020 · Fixed in 12.1-58.15 · NVD
  18. High 7.5

    CVE-2020-8246 · NetScaler ADC and Gateway

    Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before 11.0.3f, Citrix SD-WAN WANOP 10.2…

    Published 18 Sept 2020 · Fixed in 12.1-58.15 · NVD
  19. Medium 6.1

    CVE-2020-8245 · NetScaler ADC and Gateway

    Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-WAN WANOP 11.1 before 11.1.2a, Citrix SD-WAN WANOP 11.0 before…

    Published 18 Sept 2020 · Fixed in 12.1-58.15 · NVD
  20. High 7.4

    CVE-2020-8201 · Node.js

    Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return…

    Published 18 Sept 2020 · Fixed in 12.18.4, 14.11.0 · NVD
  21. Medium 6.1

    CVE-2020-13944 · Apache Airflow

    In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.

    Published 17 Sept 2020 · Fixed in 1.10.15, 2.0.2 · NVD
  22. High 8.8

    CVE-2020-13948 · Apache Superset

    While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the web application process in versions < 0.37.1. It was thus possible for an authenticated user to list and access files, environment variables, and process…

    Published 17 Sept 2020 · Fixed in 0.37.1 · NVD
  23. Medium 5.3

    CVE-2020-14181 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.

    Published 17 Sept 2020 · Fixed in 7.13.6, 8.5.7, 8.12.0 · NVD
  24. Unrated

    WPV-70df3ea01c0b · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 17 Sept 2020 · Fixed in 2.2.1 · WPVulnerability
  25. Unrated

    WPV-08e53f658b62 · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 17 Sept 2020 · Fixed in 2.2.1 · WPVulnerability
  26. High 7.3

    CVE-2020-10733 · PostgreSQL

    The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's…

    Published 16 Sept 2020 · Fixed in 10.13, 11.8, 12.3 · NVD
  27. Low 2.7

    CVE-2020-13308 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by being invited into a project that had 2 factor authentication inheritance.

    Published 15 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  28. Medium 4.7

    CVE-2020-13307 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowing a malicious user to maintain their access.

    Published 15 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  29. Medium 6.5

    CVE-2020-13303 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.

    Published 15 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  30. High 7.5

    CVE-2020-13315 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  31. Medium 6.5

    CVE-2020-13310 · GitLab

    A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, resulting in a denial of service.

    Published 14 Sept 2020 · Fixed in 13.1.3, 13.2.3, 13.3.1 · NVD
  32. High 8.8

    CVE-2020-13309 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  33. High 7.5

    CVE-2020-13306 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of rate limitation.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  34. Medium 4.3

    CVE-2020-13305 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  35. High 7.2

    CVE-2020-13304 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  36. High 7.2

    CVE-2020-13302 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious user to access a user account with an old password.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  37. Medium 4.8

    CVE-2020-13301 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  38. Medium 5.8

    CVE-2020-13298 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which resulted in the limited files disclosure.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  39. Medium 5.4

    CVE-2020-13297 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restriction by sending a specific query to the API endpoint.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  40. High 7.5

    CVE-2020-11881 · MikroTik RouterOS

    An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka SUP-12964.

    Published 14 Sept 2020 · NVD
  41. Medium 4.9

    CVE-2020-13317 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  42. Medium 5.3

    CVE-2020-13314 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the user within error messages.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  43. Medium 4.3

    CVE-2020-13313 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorization control.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  44. Critical 9.8

    CVE-2020-13312 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  45. Medium 4.3

    CVE-2020-13311 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functionality through the user interface.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  46. High 7.3

    CVE-2020-13318 · GitLab

    A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  47. Medium 4.3

    CVE-2020-13316 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  48. Critical 10.0

    CVE-2020-13300 · GitLab

    GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.

    Published 14 Sept 2020 · Fixed in 13.3.4 · NVD
  49. High 8.1

    CVE-2020-13299 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  50. Medium 5.4

    CVE-2020-13289 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated.

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.