UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,757
Published in 7 days
963
Critical in 30 days
354
Actively exploited
423

Latest vulnerabilities

39,757 vulnerabilities
  1. High 7.5

    CVE-2020-13935 · Apache Tomcat

    The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

    Published 14 Jul 2020 · NVD
  2. High 7.5

    CVE-2020-13934 · Apache Tomcat

    An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

    Published 14 Jul 2020 · NVD
  3. High 8.8

    CVE-2020-14300 · Docker Engine

    The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in…

    Published 13 Jul 2020 · NVD
  4. High 8.8

    CVE-2020-14298 · Docker Engine

    The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version…

    Published 13 Jul 2020 · NVD
  5. High 7.5

    CVE-2019-20907 · Python

    In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

    Published 13 Jul 2020 · Fixed in 3.6.12, 3.7.9, 3.8.5 · NVD
  6. Medium 4.3

    CVE-2020-14174 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.

    Published 13 Jul 2020 · Fixed in 7.13.16, 8.5.7, 8.9.2 · NVD
  7. Medium 6.1

    CVE-2019-20901 · Jira

    The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.

    Published 13 Jul 2020 · Fixed in 8.5.2 · NVD
  8. Medium 4.8

    CVE-2019-20900 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.

    Published 13 Jul 2020 · Fixed in 8.7.0 · NVD
  9. Medium 5.3

    CVE-2019-20899 · Jira

    The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.

    Published 13 Jul 2020 · Fixed in 8.5.4, 8.6.1, 8.7.0 · NVD
  10. High 7.5

    CVE-2019-20898 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.

    Published 13 Jul 2020 · Fixed in 8.8.0 · NVD
  11. Medium 6.5

    CVE-2019-20897 · Jira

    The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.

    Published 13 Jul 2020 · Fixed in 8.5.4, 8.6.2, 8.7.1 · NVD
  12. Critical 9.4

    CVE-2019-17638 · Eclipse Jetty

    In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to…

    Published 9 Jul 2020 · NVD
  13. High 8.1

    CVE-2020-2034 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3;…

    Published 8 Jul 2020 · Fixed in 8.1.15, 9.0.9, 9.1.3 · NVD
  14. Medium 4.9

    CVE-2020-2031 · Palo Alto Networks PAN-OS

    An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from the command line interface that causes the component to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue…

    Published 8 Jul 2020 · Fixed in 9.1.3 · NVD
  15. High 7.2

    CVE-2020-2030 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; and all versions of PAN-OS 7.1 and PAN-OS 8.0. This issue does not impact PAN-OS 9.0, PAN-OS 9.1, or Prisma Access services.

    Published 8 Jul 2020 · Fixed in 8.1.15 · NVD
  16. Medium 4.8

    CVE-2020-1982 · Palo Alto Networks PAN-OS

    Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the communication between PAN-OS and cloud-delivered…

    Published 8 Jul 2020 · Fixed in 8.1.14, 9.0.9, 9.1.3 · NVD
  17. High 7.5

    CVE-2020-15576 · SolarWinds Serv-U

    SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.

    Published 7 Jul 2020 · Fixed in 15.2.1 · NVD
  18. Medium 6.1

    CVE-2020-15575 · SolarWinds Serv-U

    SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.

    Published 7 Jul 2020 · Fixed in 15.2.1 · NVD
  19. High 7.5

    CVE-2020-15574 · SolarWinds Serv-U

    SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.

    Published 7 Jul 2020 · Fixed in 15.2.1 · NVD
  20. Medium 6.1

    CVE-2020-15573 · SolarWinds Serv-U

    SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.

    Published 7 Jul 2020 · Fixed in 15.2.1 · NVD
  21. Medium 5.3

    CVE-2020-15525 · GitLab

    GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.

    Published 7 Jul 2020 · NVD
  22. High 7.5

    CVE-2020-10745 · Samba

    A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability.

    Published 7 Jul 2020 · Fixed in 4.10.17, 4.11.11, 4.12.4 · NVD
  23. Medium 6.5

    CVE-2020-10730 · Samba

    A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL…

    Published 7 Jul 2020 · Fixed in 4.10.17, 4.11.11, 4.12.4 · NVD
  24. High 7.8

    CVE-2020-15567 · Xen

    An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially…

    Published 7 Jul 2020 · NVD
  25. Medium 6.5

    CVE-2020-15566 · Xen

    An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO)…

    Published 7 Jul 2020 · NVD
  26. High 8.8

    CVE-2020-15565 · Xen

    An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also…

    Published 7 Jul 2020 · NVD
  27. Medium 6.5

    CVE-2020-15564 · Xen

    An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the region is accessed with…

    Published 7 Jul 2020 · NVD
  28. Medium 6.5

    CVE-2020-15563 · Xen

    An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire…

    Published 7 Jul 2020 · NVD
  29. Medium 5.4

    CVE-2020-15020 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 7 Jul 2020 · Fixed in 2.9.14 · NVD, WPVulnerability
  30. Medium 6.5

    CVE-2020-10760 · Samba

    A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba.

    Published 6 Jul 2020 · Fixed in 4.10.17, 4.11.11, 4.12.4 · NVD
  31. High 7.5

    CVE-2020-14303 · Samba

    A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

    Published 6 Jul 2020 · Fixed in 4.10.17, 4.11.11, 4.12.4 · NVD
  32. Medium 6.1

    CVE-2020-15562 · Roundcube

    An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.

    Published 6 Jul 2020 · Fixed in 1.2.11, 1.3.14, 1.4.7 · NVD
  33. High 7.8

    CVE-2020-15523 · Python

    In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard…

    Published 4 Jul 2020 · Fixed in 3.6.12, 3.7.9, 3.8.4 · NVD
  34. High 8.8

    CVE-2020-15518 · Veeam Backup & Replication

    VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.

    Published 3 Jul 2020 · Fixed in 10.0 · NVD
  35. Medium 5.4

    CVE-2020-14173 · Jira

    The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.

    Published 3 Jul 2020 · Fixed in 8.5.4, 8.6.2, 8.7.1 · NVD
  36. Critical 9.8

    CVE-2020-14172 · Jira

    This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote code execution via insecure deserialization, if they were able to exploit a server side template…

    Published 3 Jul 2020 · Fixed in 7.13.0, 8.5.0, 8.8.1 · NVD
  37. High 7.8

    CVE-2019-20419 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5, and from version 8.6.0 before 8.7.2.

    Published 3 Jul 2020 · Fixed in 8.5.5, 8.7.2 · NVD
  38. Medium 6.5

    CVE-2019-20418 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0.

    Published 3 Jul 2020 · Fixed in 8.8.0 · NVD
  39. Medium 6.1

    CVE-2020-13653 · Zimbra Collaboration

    An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.

    Published 2 Jul 2020 · Fixed in 8.8.15 · NVD
  40. High 7.5

    CVE-2019-20894 · Traefik

    Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred.

    Published 2 Jul 2020 · Fixed in 2.0.1 · NVD
  41. Medium 5.3

    CVE-2020-15081 · PrestaShop

    Information exposure in the upload directory

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  42. Medium 5.3

    CVE-2020-15080 · PrestaShop

    Information disclosure in release archive

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  43. Medium 5.4

    CVE-2020-11074 · PrestaShop

    Stored XSS in AdminQuickAccesses

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  44. Medium 6.1

    CVE-2020-15083 · PrestaShop

    Reflected XSS when uploading an image in the Product page

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  45. Critical 9.8

    CVE-2020-4074 · PrestaShop

    Improper Authentication

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  46. Medium 5.4

    CVE-2020-15079 · PrestaShop

    Improper access control

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  47. High 8.8

    CVE-2020-15082 · PrestaShop

    External control of configuration setting in the dashboard

    Published 2 Jul 2020 · Fixed in 1.7.6.6 · NVD, Project advisories (GitHub)
  48. Medium 5.4

    CVE-2020-4061 · October CMS

    Potential self-XSS when pasting content from malicious websites

    Published 2 Jul 2020 · Fixed in 1.0.467 · NVD, Project advisories (GitHub)
  49. Low

    GHSA-g54h-m393-cpwq · runc

    devices resource list treated as a blacklist by default

    Published 2 Jul 2020 · Fixed in 1.0.0-rc91 · Project advisories (GitHub)
  50. High 7.5

    CVE-2020-8663 · Envoy

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.

    Published 1 Jul 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.