UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,768
Published in 7 days
961
Critical in 30 days
357
Actively exploited
423

Latest vulnerabilities

39,768 vulnerabilities
  1. High 8.6

    CVE-2020-3196 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a denial of service (DoS) condition. The vulnerability is due to improper resource management…

    Published 6 May 2020 · Fixed in 9.10.1.37, 9.12.3.2, 9.13.1.7 · NVD
  2. High 7.5

    CVE-2020-3195 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to incorrect processing of certain OSPF packets. An attacker could exploit this vulnerability by sending a…

    Published 6 May 2020 · Fixed in 9.12.3.2, 9.13.1.7 · NVD
  3. High 8.6

    CVE-2020-3191 · Cisco ASA and Firepower Threat Defense

    A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper length validation of a field in an IPv6 DNS packet. An attacker could…

    Published 6 May 2020 · Fixed in 9.9.2.66, 9.10.1.37, 9.12.2.9 · NVD
  4. Critical 9.1

    CVE-2020-3187 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An…

    Published 6 May 2020 · Fixed in 9.10.1.37, 9.12.3.2, 9.13.1.7 · NVD
  5. Critical 9.8

    CVE-2020-3125 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity…

    Published 6 May 2020 · Fixed in 9.10.1.37, 9.12.3.2, 9.13.1.7 · NVD
  6. Medium 5.3

    CVE-2020-7921 · MongoDB

    Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 versions prior to 4.2.3; MongoDB Server v4.0 versions prior to 4.0.15; MongoDB Server v4.3 versions prior to 4.3.3and…

    Published 6 May 2020 · Fixed in 4.0.15, 4.2.3, 4.3.3 · NVD
  7. Medium 5.4

    CVE-2020-4421 · IBM WebSphere Application Server

    IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users identify. IBM X-Force ID: 180084.

    Published 6 May 2020 · Fixed in 20.0.0.5 · NVD
  8. High 7.5

    CVE-2020-10704 · Samba

    A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and…

    Published 6 May 2020 · Fixed in 4.10.15, 4.11.8, 4.12.2 · NVD
  9. Medium 5.3

    CVE-2020-10693 · IBM WebSphere Application Server, Oracle WebLogic Server

    A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

    Published 6 May 2020 · NVD
  10. Critical 9.9

    CVE-2020-13126 · Elementor Pro (WordPress plugin)

    Elementor Pro: Unrestricted Upload of File with Dangerous Type

    Published 6 May 2020 · Fixed in 2.9.4 · WPVulnerability
  11. Medium 5.4

    CVE-2020-11036 · GLPI

    In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content "<script>alert(1)</script>" reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the…

    Published 5 May 2020 · Fixed in 9.4.6 · NVD
  12. Critical 9.3

    CVE-2020-11035 · GLPI

    In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

    Published 5 May 2020 · Fixed in 9.4.6 · NVD
  13. Medium 6.1

    CVE-2020-11034 · GLPI

    In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in version 9.4.6.

    Published 5 May 2020 · Fixed in 9.4.6 · NVD
  14. High 7.2

    CVE-2020-11033 · GLPI

    In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting…

    Published 5 May 2020 · Fixed in 9.4.6 · NVD
  15. High 7.2

    CVE-2020-11032 · GLPI

    In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.

    Published 5 May 2020 · NVD
  16. Unrated

    WPV-96eee1589add · WooCommerce

    Vulnerability in WooCommerce

    Published 5 May 2020 · Fixed in 4.1.0 · WPVulnerability
  17. Medium 5.3

    CVE-2020-10700 · Samba

    A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.

    Published 4 May 2020 · Fixed in 4.10.15, 4.11.8, 4.12.2 · NVD
  18. Critical 9.8Actively exploited

    CVE-2020-12641 · Roundcube

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

    Published 4 May 2020 · Fixed in 1.2.10, 1.3.11, 1.4.4 · NVD
  19. Critical 9.8

    CVE-2020-12640 · Roundcube

    Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

    Published 4 May 2020 · Fixed in 1.2.10, 1.3.11, 1.4.4 · NVD
  20. Medium 5.3

    CVE-2020-10933 · Ruby

    An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.

    Published 4 May 2020 · NVD
  21. Medium 6.5

    CVE-2020-12626 · Roundcube

    An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.

    Published 4 May 2020 · Fixed in 1.4.4 · NVD
  22. Medium 6.1

    CVE-2020-12625 · Roundcube

    An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

    Published 4 May 2020 · Fixed in 1.4.4 · NVD
  23. Medium 4.7

    CVE-2020-11037 · Wagtail

    Potential timing attack on password-protected private pages

    Published 30 Apr 2020 · Fixed in 2.7.2, 2.7.3, 2.8.2 · NVD, Project advisories (GitHub)
  24. Medium 6.7

    CVE-2020-5892 · F5 BIG-IP

    In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory.

    Published 30 Apr 2020 · NVD
  25. Medium 5.5

    CVE-2020-5890 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace.

    Published 30 Apr 2020 · Fixed in 14.1.2.4, 15.1.0.2 · NVD
  26. High 8.1

    CVE-2020-5888 · F5 BIG-IP

    On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (layer 2) attackers to access local daemons and bypass port lockdown settings.

    Published 30 Apr 2020 · Fixed in 14.1.2.4, 15.0.1.3, 15.1.0.2 · NVD
  27. Low 3.7

    CVE-2020-5893 · F5 BIG-IP

    In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection.

    Published 30 Apr 2020 · NVD
  28. High 7.5

    CVE-2020-5891 · F5 BIG-IP

    On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a virtual server configured with the Fallback Host setting and a server-side HTTP/2 profile.

    Published 30 Apr 2020 · NVD
  29. Medium 5.4

    CVE-2020-5889 · F5 BIG-IP

    On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.

    Published 30 Apr 2020 · NVD
  30. Critical 9.1

    CVE-2020-5887 · F5 BIG-IP

    On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port lockdown settings.

    Published 30 Apr 2020 · NVD
  31. Critical 9.1

    CVE-2020-5886 · F5 BIG-IP

    On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.

    Published 30 Apr 2020 · NVD
  32. Critical 9.1

    CVE-2020-5885 · F5 BIG-IP

    On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.

    Published 30 Apr 2020 · NVD
  33. Critical 9.1

    CVE-2020-5884 · F5 BIG-IP

    On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring.

    Published 30 Apr 2020 · NVD
  34. High 7.5

    CVE-2020-5883 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.

    Published 30 Apr 2020 · NVD
  35. High 7.5

    CVE-2020-5882 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAssist Technology (QAT) cryptography driver may produce a Traffic Management Microkernel (TMM) core file.

    Published 30 Apr 2020 · NVD
  36. High 7.5

    CVE-2020-5881 · F5 BIG-IP

    On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up and in turn disrupting the communication between the mcpd and tmm processes.

    Published 30 Apr 2020 · NVD
  37. High 7.1

    CVE-2020-5880 · F5 BIG-IP

    Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server.

    Published 30 Apr 2020 · NVD
  38. High 7.5

    CVE-2020-5878 · F5 BIG-IP

    On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Edition (VE) while processing unusual IP traffic.

    Published 30 Apr 2020 · NVD
  39. High 7.5

    CVE-2020-5877 · F5 BIG-IP

    On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRules command within a FLOW_INIT event may lead to a denial of service.

    Published 30 Apr 2020 · NVD
  40. High 8.1

    CVE-2020-5876 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer, adding a new peer, or when the Traffic Management Microkernel (TMM) first starts up.

    Published 30 Apr 2020 · NVD
  41. High 7.5

    CVE-2020-5875 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy.

    Published 30 Apr 2020 · NVD
  42. High 7.5

    CVE-2020-5874 · F5 BIG-IP

    On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management Microkernel(TMM).

    Published 30 Apr 2020 · NVD
  43. High 7.2

    CVE-2020-5873 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request.

    Published 30 Apr 2020 · NVD
  44. High 7.5

    CVE-2020-5872 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event.

    Published 30 Apr 2020 · NVD
  45. High 7.5

    CVE-2020-5871 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure.

    Published 30 Apr 2020 · NVD
  46. High 7.5

    CVE-2019-12425 · Apache OFBiz

    Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host

    Published 30 Apr 2020 · NVD
  47. High 8.8

    CVE-2019-0235 · Apache OFBiz

    Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

    Published 30 Apr 2020 · NVD
  48. High 7.0

    CVE-2020-1752 · GNU C Library

    A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code…

    Published 30 Apr 2020 · Fixed in 2.32.0 · NVD
  49. Medium 5.4

    CVE-2020-11025 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress Customizer

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  50. Medium 5.4

    CVE-2020-11026 · WordPress

    Specially crafted filenames in WordPress leading to XSS

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.