UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,768
Published in 7 days
961
Critical in 30 days
357
Actively exploited
423

Latest vulnerabilities

39,768 vulnerabilities
  1. High 8.8

    CVE-2020-11067 · TYPO3

    In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

    Published 14 May 2020 · NVD
  2. Critical 10.0

    CVE-2020-11066 · TYPO3

    In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted content can lead to modification of dynamically-determined object attributes and result in triggering deletion of an arbitrary directory in the file system, if it is writable for the web server. It can also trigger message…

    Published 14 May 2020 · Fixed in 9.5.17, 10.4.2 · NVD
  3. Medium 5.4

    CVE-2020-11065 · TYPO3

    In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being assigned as HTML attributes have not been parsed correctly. This has been fixed in 9.5.17 and 10.4.2.

    Published 13 May 2020 · Fixed in 9.5.17, 10.4.2 · NVD
  4. Medium 5.4

    CVE-2020-11064 · TYPO3

    In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

    Published 13 May 2020 · Fixed in 9.5.17, 10.4.2 · NVD
  5. Critical 9.0

    CVE-2020-2018 · Palo Alto Networks PAN-OS

    An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue does not affect Panorama configured with custom certificates authentication for communication between…

    Published 13 May 2020 · Fixed in 7.1.26, 8.1.12, 9.0.6 · NVD
  6. Medium 6.1

    CVE-2020-2017 · Palo Alto Networks PAN-OS

    A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue affects: PAN-OS 7.1 versions earlier than…

    Published 13 May 2020 · Fixed in 7.1.26, 8.1.13, 9.0.6 · NVD
  7. High 7.0

    CVE-2020-2016 · Palo Alto Networks PAN-OS

    A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions…

    Published 13 May 2020 · Fixed in 7.1.26, 8.1.13, 9.0.6 · NVD
  8. High 8.8

    CVE-2020-2015 · Palo Alto Networks PAN-OS

    A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0.

    Published 13 May 2020 · Fixed in 8.1.13, 9.0.7, 9.1.1 · NVD
  9. High 8.8

    CVE-2020-2014 · Palo Alto Networks PAN-OS

    An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7.

    Published 13 May 2020 · NVD
  10. High 8.8

    CVE-2020-2013 · Palo Alto Networks PAN-OS

    A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the…

    Published 13 May 2020 · Fixed in 8.1.13, 9.0.6, 9.1.1 · NVD
  11. High 7.5

    CVE-2020-2012 · Palo Alto Networks PAN-OS

    Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for…

    Published 13 May 2020 · Fixed in 8.1.13, 9.0.7 · NVD
  12. High 7.5

    CVE-2020-2011 · Palo Alto Networks PAN-OS

    An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a specifically crafted registration request to the device that causes the configuration service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS Panorama services by restarting the device and…

    Published 13 May 2020 · Fixed in 8.1.14, 9.1.0 · NVD
  13. High 7.2

    CVE-2020-2010 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7.

    Published 13 May 2020 · NVD
  14. High 7.2

    CVE-2020-2009 · Palo Alto Networks PAN-OS

    An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. In some cases this results in arbitrary code execution with root permissions. This issue affects: All versions of PAN-OS 7.1; PAN-OS…

    Published 13 May 2020 · NVD
  15. High 7.2

    CVE-2020-2008 · Palo Alto Networks PAN-OS

    An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14.

    Published 13 May 2020 · NVD
  16. High 7.2

    CVE-2020-2007 · Palo Alto Networks PAN-OS

    An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges. This issue affects: All PAN-OS 7.1 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7.

    Published 13 May 2020 · NVD
  17. High 8.8

    CVE-2020-2006 · Palo Alto Networks PAN-OS

    A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14.

    Published 13 May 2020 · NVD
  18. Medium 6.1

    CVE-2020-2005 · Palo Alto Networks PAN-OS

    A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; All versions of PAN-OS 8.0.

    Published 13 May 2020 · Fixed in 7.1.26, 8.1.13, 9.0.7 · NVD
  19. Medium 6.5

    CVE-2020-2003 · Palo Alto Networks PAN-OS

    An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions before 8.1.14; PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before…

    Published 13 May 2020 · Fixed in 9.1.1 · NVD
  20. High 8.1

    CVE-2020-2002 · Palo Alto Networks PAN-OS

    An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center (KDC) before authenticating users. This affects all forms of authentication that use a Kerberos authentication profile. A man-in-the-middle type of attacker with the ability to…

    Published 13 May 2020 · Fixed in 7.1.26, 8.1.13, 9.0.6 · NVD
  21. Critical 9.8

    CVE-2020-2001 · Palo Alto Networks PAN-OS

    An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All PAN-OS 7.1 Panorama and 8.0 Panorama versions; PAN-OS 8.1 versions earlier than 8.1.12 on Panorama;…

    Published 13 May 2020 · Fixed in 8.1.12, 9.0.6 · NVD
  22. High 8.8

    CVE-2020-1998 · Palo Alto Networks PAN-OS

    An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions…

    Published 13 May 2020 · Fixed in 8.1.13, 9.0.6, 9.1.1 · NVD
  23. Medium 6.1

    CVE-2020-1997 · Palo Alto Networks PAN-OS

    An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway. If the user then successfully authenticates it will cause them to access an unexpected and potentially malicious website. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0…

    Published 13 May 2020 · Fixed in 7.1.26, 8.0.14 · NVD
  24. Medium 5.3

    CVE-2020-1996 · Palo Alto Networks PAN-OS

    A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log file This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14;…

    Published 13 May 2020 · NVD
  25. Medium 4.9

    CVE-2020-1995 · Palo Alto Networks PAN-OS

    A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue affects: PAN-OS 9.1 versions earlier than 9.1.2.

    Published 13 May 2020 · Fixed in 9.1.2 · NVD
  26. Medium 4.4

    CVE-2020-1994 · Palo Alto Networks PAN-OS

    A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7.

    Published 13 May 2020 · Fixed in 8.1.13 · NVD
  27. Medium 5.4

    CVE-2020-1993 · Palo Alto Networks PAN-OS

    The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8.

    Published 13 May 2020 · NVD
  28. Unrated

    WPV-43353581c268 · Google Site Kit (WordPress plugin)

    Vulnerability in Site Kit by Google – Analytics, Search Console, AdSense, Speed

    Published 13 May 2020 · Fixed in 1.8.0 · WPVulnerability
  29. Medium 5.4

    CVE-2020-11062 · GLPI

    In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.

    Published 12 May 2020 · Fixed in 9.4.6 · NVD
  30. High 8.8

    CVE-2020-11060 · GLPI

    In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.

    Published 12 May 2020 · Fixed in 9.4.6 · NVD
  31. Medium 5.5

    CVE-2020-5898 · F5 BIG-IP

    In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted DeviceIoControl requests to \\.\urvpndrv device causing the Windows kernel to crash.

    Published 12 May 2020 · NVD
  32. High 8.8

    CVE-2020-5897 · F5 BIG-IP

    In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component.

    Published 12 May 2020 · NVD
  33. High 7.8

    CVE-2020-5896 · F5 BIG-IP

    On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions.

    Published 12 May 2020 · NVD
  34. Medium 5.3

    CVE-2020-5248 · GLPI

    GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database…

    Published 12 May 2020 · Fixed in 9.4.6 · NVD
  35. Medium 5.4

    CVE-2020-8155 · Nextcloud

    An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.

    Published 12 May 2020 · Fixed in 18.0.3 · NVD
  36. High 7.7

    CVE-2020-8154 · Nextcloud

    An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

    Published 12 May 2020 · Fixed in 17.0.5, 18.0.3 · NVD
  37. Low 3.7

    CVE-2020-11063 · TYPO3

    Information Disclosure in Password Reset

    Published 12 May 2020 · NVD, Project advisories (GitHub)
  38. High 8.1

    CVE-2020-12785 · cPanel & WHM

    cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).

    Published 11 May 2020 · Fixed in 11.78.0.47, 11.84.0.22, 11.86.0.14 · NVD
  39. Medium 5.3

    CVE-2020-12784 · cPanel & WHM

    cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).

    Published 11 May 2020 · Fixed in 11.78.0.47, 11.84.0.22, 11.86.0.14 · NVD
  40. High 7.5

    CVE-2020-12783 · Exim

    Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.

    Published 11 May 2020 · NVD
  41. Critical 9.8

    CVE-2020-12720 · vBulletin

    vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

    Published 8 May 2020 · Fixed in 5.5.6 · NVD
  42. Medium 5.3

    CVE-2020-12448 · GitLab

    GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.

    Published 7 May 2020 · Fixed in 12.8.10 · NVD
  43. High 8.8

    CVE-2020-12669 · Dolibarr ERP CRM

    core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.

    Published 6 May 2020 · Fixed in 11.0.4 · NVD
  44. High 7.4

    CVE-2020-3334 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appliances could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect…

    Published 6 May 2020 · Fixed in 9.10.1.37, 9.12.3, 9.13.1.2 · NVD
  45. High 7.5

    CVE-2020-3306 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the DHCP module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to incorrect processing of certain DHCP packets. An attacker could exploit this vulnerability by sending a crafted DHCP…

    Published 6 May 2020 · Fixed in 9.8.4.10, 9.10.1.30, 9.12.3 · NVD
  46. High 7.5

    CVE-2020-3305 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain BGP packets. An attacker could exploit this vulnerability by…

    Published 6 May 2020 · Fixed in 9.8.4.10, 9.10.1.30, 9.12.2.9 · NVD
  47. High 7.5

    CVE-2020-3303 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper management of system memory. An attacker could exploit this vulnerability by sending malicious…

    Published 6 May 2020 · Fixed in 9.8.4.10, 9.10.1.30, 9.12.2.9 · NVD
  48. High 7.5

    CVE-2020-3298 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Open Shortest Path First (OSPF) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper memory protection mechanisms while processing…

    Published 6 May 2020 · NVD
  49. High 7.5Actively exploited

    CVE-2020-3259 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid…

    Published 6 May 2020 · Fixed in 9.10.1.40, 9.12.3.9, 9.13.1.10 · NVD
  50. High 7.5

    CVE-2020-3254 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerabilities are due to inefficient memory management. An attacker could exploit these…

    Published 6 May 2020 · Fixed in 9.9.2.66, 9.10.1.27, 9.12.2.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.