UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Medium 4.3

    CVE-2020-13287 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  2. Medium 6.5

    CVE-2020-13284 · GitLab

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token

    Published 14 Sept 2020 · Fixed in 13.1.10, 13.2.8, 13.3.4 · NVD
  3. High 7.5

    CVE-2019-0233 · Apache Struts

    An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.

    Published 14 Sept 2020 · NVD
  4. Critical 9.8

    CVE-2019-0230 · Apache Struts

    Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

    Published 14 Sept 2020 · NVD
  5. Medium 5.3

    CVE-2020-25286 · WordPress

    In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

    Published 13 Sept 2020 · Fixed in 5.4.2 · NVD
  6. High 7.5

    CVE-2020-1045 · .NET

    <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles…

    Published 11 Sept 2020 · Fixed in 3.1.8 · NVD
  7. High 8.4

    CVE-2020-16875 · Microsoft Exchange Server

    <p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses…

    Published 11 Sept 2020 · NVD
  8. Medium 5.9

    CVE-2020-13920 · Apache ActiveMQ

    Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to…

    Published 10 Sept 2020 · Fixed in 5.15.12 · NVD
  9. Critical 9.8

    CVE-2020-11998 · Apache ActiveMQ

    A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use…

    Published 10 Sept 2020 · NVD
  10. Medium 6.1

    CVE-2020-9743 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in…

    Published 10 Sept 2020 · NVD
  11. Medium 5.4

    CVE-2020-9742 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Inbox calendar feature. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  12. Medium 5.4

    CVE-2020-9741 · Adobe Experience Manager

    The AEM forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) is affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Forms component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  13. Medium 5.4

    CVE-2020-9740 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Design Importer. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  14. Medium 4.8

    CVE-2020-9738 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when visiting the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  15. Medium 4.8

    CVE-2020-9737 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  16. Medium 4.8

    CVE-2020-9736 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when browsing to the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  17. Medium 4.8

    CVE-2020-9735 · Adobe Experience Manager

    AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when search queries return the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  18. Medium 5.4

    CVE-2020-9734 · Adobe Experience Manager

    The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.1 (and below) is affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Forms component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  19. High 7.5

    CVE-2020-9733 · Adobe Experience Manager

    An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository.

    Published 10 Sept 2020 · NVD
  20. Critical 9.0

    CVE-2020-9732 · Adobe Experience Manager

    The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

    Published 10 Sept 2020 · NVD
  21. Medium 5.4

    CVE-2020-4578 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 184433.

    Published 10 Sept 2020 · NVD
  22. Critical 9.8

    CVE-2020-15903 · Nagios XI

    An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.

    Published 9 Sept 2020 · Fixed in 5.7.3 · NVD
  23. Low 3.6

    CVE-2020-7068 · PHP

    In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.

    Published 9 Sept 2020 · Fixed in 7.2.33, 7.3.21, 7.4.9 · NVD
  24. Low 3.3

    CVE-2020-2044 · Palo Alto Networks PAN-OS

    An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and…

    Published 9 Sept 2020 · Fixed in 8.1.16, 9.0.10, 9.1.3 · NVD
  25. Low 3.3

    CVE-2020-2043 · Palo Alto Networks PAN-OS

    An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple times in one log entry. The first instance of the sensitive field is masked but subsequent instances are…

    Published 9 Sept 2020 · Fixed in 9.0.10, 9.1.4 · NVD
  26. High 7.2

    CVE-2020-2042 · Palo Alto Networks PAN-OS

    A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

    Published 9 Sept 2020 · Fixed in 10.0.1 · NVD
  27. High 7.5

    CVE-2020-2041 · Palo Alto Networks PAN-OS

    An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts all versions of…

    Published 9 Sept 2020 · Fixed in 8.1.16 · NVD
  28. Critical 9.8

    CVE-2020-2040 · Palo Alto Networks PAN-OS

    A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS…

    Published 9 Sept 2020 · Fixed in 8.1.15, 9.0.9, 9.1.3 · NVD
  29. Medium 5.3

    CVE-2020-2039 · Palo Alto Networks PAN-OS

    An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is…

    Published 9 Sept 2020 · Fixed in 9.0.10, 9.1.4, 10.0.1 · NVD
  30. High 7.2

    CVE-2020-2038 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

    Published 9 Sept 2020 · Fixed in 9.0.10, 9.1.4, 10.0.1 · NVD
  31. High 7.2

    CVE-2020-2037 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.

    Published 9 Sept 2020 · Fixed in 8.1.16, 9.0.10, 9.1.3 · NVD
  32. High 8.8

    CVE-2020-2036 · Palo Alto Networks PAN-OS

    A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative…

    Published 9 Sept 2020 · Fixed in 8.1.16, 9.0.9 · NVD
  33. Low 3.7

    CVE-2020-1968 · OpenSSL

    The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation…

    Published 9 Sept 2020 · NVD
  34. High 7.2

    CVE-2020-24986 · Concrete CMS

    Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.

    Published 4 Sept 2020 · NVD
  35. Medium 6.5

    CVE-2020-24977 · libxml2

    GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

    Published 4 Sept 2020 · NVD
  36. Medium 4.8

    CVE-2020-25124 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.

    Published 3 Sept 2020 · NVD
  37. Medium 4.8

    CVE-2020-25123 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.

    Published 3 Sept 2020 · NVD
  38. Medium 4.8

    CVE-2020-25122 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.

    Published 3 Sept 2020 · NVD
  39. Medium 4.8

    CVE-2020-25121 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.

    Published 3 Sept 2020 · NVD
  40. Medium 4.8

    CVE-2020-25120 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.

    Published 3 Sept 2020 · NVD
  41. Medium 4.8

    CVE-2020-25119 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.

    Published 3 Sept 2020 · NVD
  42. Medium 4.8

    CVE-2020-25118 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.

    Published 3 Sept 2020 · NVD
  43. Medium 4.8

    CVE-2020-25117 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.

    Published 3 Sept 2020 · NVD
  44. Medium 4.8

    CVE-2020-25116 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.

    Published 3 Sept 2020 · NVD
  45. Medium 4.8

    CVE-2020-25115 · vBulletin

    The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.

    Published 3 Sept 2020 · NVD
  46. Medium 5.5

    CVE-2020-14373 · Ghostscript

    A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF file to cause a denial of service.

    Published 3 Sept 2020 · NVD
  47. High 8.8

    CVE-2020-14209 · Dolibarr ERP CRM

    Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).

    Published 2 Sept 2020 · Fixed in 11.0.5 · NVD
  48. Medium 4.3

    CVE-2020-2251 · Jenkins

    Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.

    Published 1 Sept 2020 · Fixed in 2.236 · NVD
  49. High 7.5

    CVE-2020-24554 · Liferay Portal / DXP

    The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist.

    Published 1 Sept 2020 · Fixed in 7.3.3 · NVD
  50. High 7.5

    CVE-2020-14178 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0.

    Published 1 Sept 2020 · Fixed in 7.13.7, 8.5.8, 8.12.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.