UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,756
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,756 vulnerabilities
  1. Medium 5.4

    CVE-2020-13828 · Dolibarr ERP CRM

    Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php…

    Published 31 Aug 2020 · NVD
  2. Medium 6.7

    CVE-2020-5419 · RabbitMQ

    RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could carry out a local binary hijacking (planting) attack and execute arbitrary code.

    Published 31 Aug 2020 · Fixed in 3.8.7 · NVD
  3. Medium 6.5

    CVE-2019-19499 · Grafana

    Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.

    Published 28 Aug 2020 · NVD
  4. Medium 6.5

    CVE-2020-8927 · Brotli, .NET

    A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to…

    Published 27 Aug 2020 · Fixed in 1.0.8 · NVD, releases
  5. Medium 6.1

    CVE-2020-4575 · IBM WebSphere Application Server

    IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured.

    Published 27 Aug 2020 · Fixed in 8.5.5.18, 9.0.5.5 · NVD
  6. Medium 6.1

    CVE-2020-24599 · Joomla!

    An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.

    Published 26 Aug 2020 · Fixed in 3.9.21 · NVD
  7. Medium 6.1

    CVE-2020-24598 · Joomla!

    An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.

    Published 26 Aug 2020 · Fixed in 3.9.21 · NVD
  8. High 7.5

    CVE-2020-5926 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache.

    Published 26 Aug 2020 · Fixed in 14.1.2.7, 15.0.1.4, 15.1.0.5 · NVD
  9. High 7.5

    CVE-2020-5925 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed internally generated UDP traffic may cause the Traffic Management Microkernel (TMM) to restart under some circumstances.

    Published 26 Aug 2020 · Fixed in 14.1.2.7, 15.0.1.4, 15.1.0.5 · NVD
  10. High 7.5

    CVE-2020-5921 · F5 BIG-IP

    in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood causes large number of MCPD context messages destined to secondary blades consuming memory leading to MCPD failure. This issue affects only VIPRION hosts with two or more blades installed. Single-blade VIPRION hosts are not affected.

    Published 26 Aug 2020 · Fixed in 14.1.2.7, 15.0.1.4, 15.1.0.5 · NVD
  11. Medium 5.3

    CVE-2020-5924 · F5 BIG-IP

    In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set.

    Published 26 Aug 2020 · Fixed in 12.1.5.2 · NVD
  12. Medium 5.4

    CVE-2020-5923 · F5 BIG-IP

    In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdown bypass via IPv6 link-local addresses.

    Published 26 Aug 2020 · Fixed in 13.1.3.4, 14.1.2.7, 15.1.0.5 · NVD
  13. High 8.8

    CVE-2020-5922 · F5 BIG-IP

    In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser.

    Published 26 Aug 2020 · Fixed in 13.1.3.4, 14.1.2.7, 15.1.0.5 · NVD
  14. High 7.5

    CVE-2020-5919 · F5 BIG-IP

    In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, may cause the Traffic Management Microkernel (TMM) to stop responding.

    Published 26 Aug 2020 · Fixed in 15.1.0.5 · NVD
  15. High 7.5

    CVE-2020-5918 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic when traffic volume is high. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile.

    Published 26 Aug 2020 · Fixed in 14.1.2.5, 15.0.1.4, 15.1.0.5 · NVD
  16. Medium 5.9

    CVE-2020-5917 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure.

    Published 26 Aug 2020 · Fixed in 14.1.2.4, 15.0.1.4, 15.1.0.5 · NVD
  17. Medium 6.8

    CVE-2020-5916 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.

    Published 26 Aug 2020 · Fixed in 15.0.1.4, 15.1.0.5 · NVD
  18. Medium 6.1

    CVE-2020-5915 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.

    Published 26 Aug 2020 · Fixed in 14.1.2.5, 15.0.1.4, 15.1.0.5 · NVD
  19. High 7.4

    CVE-2020-5913 · F5 BIG-IP

    In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even when a valid CRL is present. This impacts SSL/TLS connections and may result in a man-in-the-middle attack on the connections.

    Published 26 Aug 2020 · Fixed in 14.1.2-0.89.37, 14.1.2.5, 15.0.1.2 · NVD
  20. High 7.1

    CVE-2020-5912 · F5 BIG-IP

    In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files.

    Published 26 Aug 2020 · Fixed in 14.1.2.5, 15.0.1.4, 15.1.0.5 · NVD
  21. High 8.2

    CVE-2020-16251 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

    Published 26 Aug 2020 · Fixed in 1.3.8, 1.4.4, 1.5.1 · NVD
  22. High 8.2

    CVE-2020-16250 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

    Published 26 Aug 2020 · Fixed in 1.3.8, 1.4.4, 1.5.1 · NVD
  23. High 7.3

    CVE-2020-14350 · PostgreSQL

    It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

    Published 24 Aug 2020 · Fixed in 10.14, 11.9, 12.4 · NVD
  24. High 7.1

    CVE-2020-14349 · PostgreSQL

    It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

    Published 24 Aug 2020 · Fixed in 10.14, 11.9, 12.4 · NVD
  25. Medium 6.5

    CVE-2020-15810 · Squid

    SQUID-2020:10 HTTP(S) Request Smuggling

    Published 23 Aug 2020 · Fixed in 4.13, 5.0.4 · NVD, Project advisories (GitHub)
  26. High 7.5

    CVE-2020-24606 · Squid

    SQUID-2020:9 Denial of Service processing Cache Digest Response

    Published 23 Aug 2020 · Fixed in 4.13, 5.0.4 · NVD, Project advisories (GitHub)
  27. Medium 6.5

    CVE-2020-15811 · Squid

    SQUID-2020:8 HTTP(S) Request Splitting

    Published 23 Aug 2020 · Fixed in 4.13, 5.0.4 · NVD, Project advisories (GitHub)
  28. Medium 4.3

    CVE-2020-8624 · BIND 9

    In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.

    Published 21 Aug 2020 · NVD
  29. High 7.5

    CVE-2020-8623 · BIND 9

    In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be…

    Published 21 Aug 2020 · NVD
  30. Medium 6.5

    CVE-2020-8622 · BIND 9

    In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path…

    Published 21 Aug 2020 · NVD
  31. High 7.5

    CVE-2020-8621 · BIND 9

    In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.

    Published 21 Aug 2020 · NVD
  32. High 7.5

    CVE-2020-8620 · BIND 9

    In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.

    Published 21 Aug 2020 · NVD
  33. Medium 6.5

    CVE-2020-14201 · Dolibarr ERP CRM

    Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.

    Published 21 Aug 2020 · Fixed in 11.0.5 · NVD
  34. Medium 6.5

    CVE-2020-7923 · MongoDB

    A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoDB Server v4.2 versions prior to 4.2.8 and MongoDB Server v4.0 versions prior to 4.0.19.

    Published 21 Aug 2020 · Fixed in 4.0.19, 4.2.8, 4.4.0 · NVD
  35. Medium 5.3

    CVE-2020-3976 · VMware vCenter Server, VMware ESXi

    VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.

    Published 21 Aug 2020 · NVD
  36. High 8.0

    CVE-2020-15151 · Magento / Adobe Commerce

    OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

    Published 20 Aug 2020 · NVD
  37. Unrated

    WPV-7519b65d2cbf · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 20 Aug 2020 · Fixed in 2.1.0 · WPVulnerability
  38. Medium 6.3

    CVE-2020-36834 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Missing Authorization

    Published 20 Aug 2020 · Fixed in 2.1.0 · WPVulnerability
  39. Medium 6.1

    CVE-2020-15926 · Rocket.Chat

    Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.

    Published 18 Aug 2020 · NVD
  40. Medium 6.5

    CVE-2020-7019 · Elasticsearch

    In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

    Published 18 Aug 2020 · Fixed in 6.8.12, 7.9.0 · NVD
  41. High 7.5

    CVE-2020-1597 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests…

    Published 17 Aug 2020 · NVD
  42. Medium 5.5Actively exploited

    CVE-2020-1472 · Samba

    An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required…

    Published 17 Aug 2020 · Fixed in 4.10.18, 4.11.13, 4.12.7 · NVD
  43. Medium 5.8

    CVE-2020-8226 · phpBB

    A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.

    Published 17 Aug 2020 · Fixed in 3.2.10, 3.3.1 · NVD
  44. High 8.8

    CVE-2020-13941 · Apache Solr

    Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the…

    Published 17 Aug 2020 · Fixed in 8.6.0 · NVD
  45. Medium 6.5Actively exploited

    CVE-2019-5591 · Fortinet FortiOS

    A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.

    Published 14 Aug 2020 · NVD
  46. Medium 4.3

    CVE-2020-13286 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  47. Medium 6.5

    CVE-2020-13281 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  48. Medium 5.4

    CVE-2020-13285 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  49. Medium 5.4

    CVE-2020-13283 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD
  50. Low 3.5

    CVE-2020-13282 · GitLab

    For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to improper access.

    Published 13 Aug 2020 · Fixed in 13.0.12, 13.1.6, 13.2.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.