UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,771
Published in 7 days
957
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,771 vulnerabilities
  1. High 7.2

    CVE-2020-10115 · cPanel & WHM

    cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  2. Medium 6.1

    CVE-2020-10114 · cPanel & WHM

    cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  3. Medium 6.1

    CVE-2020-10113 · cPanel & WHM

    cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).

    Published 17 Mar 2020 · Fixed in 78.0.45, 84.0.20 · NVD
  4. Critical 9.8

    CVE-2019-20498 · cPanel & WHM

    cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  5. Medium 5.4

    CVE-2019-20497 · cPanel & WHM

    cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  6. Medium 5.5

    CVE-2019-20496 · cPanel & WHM

    cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  7. Medium 6.5

    CVE-2019-20495 · cPanel & WHM

    cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

    Published 17 Mar 2020 · Fixed in 82.0.18, 84.0.10 · NVD
  8. Low 3.3

    CVE-2019-20494 · cPanel & WHM

    In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  9. Medium 6.1

    CVE-2019-20493 · cPanel & WHM

    cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  10. High 8.8

    CVE-2019-20492 · cPanel & WHM

    cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  11. High 8.8

    CVE-2019-20490 · cPanel & WHM

    cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

    Published 17 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  12. Medium 5.4

    CVE-2020-6646 · Fortinet FortiWeb

    An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.

    Published 17 Mar 2020 · NVD
  13. Medium 4.3

    CVE-2019-20407 · Jira

    The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.

    Published 17 Mar 2020 · Fixed in 8.5.3, 8.6.1, 8.7.0 · NVD
  14. Medium 5.4

    CVE-2019-20491 · cPanel & WHM

    cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).

    Published 16 Mar 2020 · Fixed in 78.0.43, 82.0.18, 84.0.10 · NVD
  15. Medium 6.5

    CVE-2020-9472 · Umbraco CMS

    Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

    Published 16 Mar 2020 · NVD
  16. High 8.8

    CVE-2020-9471 · Umbraco CMS

    Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.

    Published 16 Mar 2020 · NVD
  17. High 7.2

    CVE-2019-19937 · JFrog Artifactory

    In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."

    Published 16 Mar 2020 · Fixed in 6.18 · NVD
  18. Critical 9.8

    CVE-2019-19212 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

    Published 16 Mar 2020 · NVD
  19. High 7.5

    CVE-2020-9321 · Traefik

    configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.

    Published 16 Mar 2020 · NVD
  20. Critical 9.8

    CVE-2020-10243 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  21. Medium 6.1

    CVE-2020-10242 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  22. High 8.8

    CVE-2020-10241 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  23. Medium 5.3

    CVE-2020-10240 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  24. High 8.8

    CVE-2020-10239 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  25. High 7.5

    CVE-2020-10238 · Joomla!

    An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.

    Published 16 Mar 2020 · Fixed in 3.9.16 · NVD
  26. Medium 6.1

    CVE-2019-19211 · Dolibarr ERP CRM

    Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.

    Published 16 Mar 2020 · Fixed in 10.0.4 · NVD
  27. Medium 5.4

    CVE-2019-19210 · Dolibarr ERP CRM

    Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.

    Published 16 Mar 2020 · Fixed in 10.0.3 · NVD
  28. High 7.5

    CVE-2019-19209 · Dolibarr ERP CRM

    Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.

    Published 16 Mar 2020 · Fixed in 10.0.3 · NVD
  29. Medium 6.1

    CVE-2019-14512 · LimeSurvey

    LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.

    Published 16 Mar 2020 · NVD
  30. Medium 6.1

    CVE-2018-10125 · Contao

    Contao before 4.5.7 has XSS in the system log.

    Published 16 Mar 2020 · NVD
  31. Medium 6.1

    CVE-2019-6696 · Fortinet FortiOS

    An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage.

    Published 15 Mar 2020 · NVD
  32. Critical 9.8

    CVE-2020-10077 · GitLab

    GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.

    Published 13 Mar 2020 · NVD
  33. Medium 6.1

    CVE-2020-10076 · GitLab

    GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.

    Published 13 Mar 2020 · NVD
  34. Medium 6.1

    CVE-2020-10075 · GitLab

    GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input.

    Published 13 Mar 2020 · NVD
  35. Critical 9.8

    CVE-2020-10074 · GitLab

    GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link.

    Published 13 Mar 2020 · NVD
  36. High 7.5

    CVE-2020-10073 · GitLab

    GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page.

    Published 13 Mar 2020 · NVD
  37. Medium 6.1

    CVE-2020-10092 · GitLab

    GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.

    Published 13 Mar 2020 · NVD
  38. Medium 6.1

    CVE-2020-10091 · GitLab

    GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.

    Published 13 Mar 2020 · NVD
  39. Medium 5.3

    CVE-2020-10090 · GitLab

    GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed.

    Published 13 Mar 2020 · NVD
  40. High 7.5

    CVE-2020-10089 · GitLab

    GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,

    Published 13 Mar 2020 · NVD
  41. High 8.1

    CVE-2020-10088 · GitLab

    GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level.

    Published 13 Mar 2020 · NVD
  42. High 7.5

    CVE-2020-10087 · GitLab

    GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.

    Published 13 Mar 2020 · NVD
  43. Medium 5.3

    CVE-2020-10086 · GitLab

    GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read.

    Published 13 Mar 2020 · NVD
  44. Medium 5.3

    CVE-2020-10085 · GitLab

    GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles.

    Published 13 Mar 2020 · NVD
  45. Medium 5.3

    CVE-2020-10084 · GitLab

    GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a private project namespace

    Published 13 Mar 2020 · NVD
  46. Critical 9.1

    CVE-2020-10083 · GitLab

    GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.

    Published 13 Mar 2020 · NVD
  47. Medium 5.3

    CVE-2020-10082 · GitLab

    GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered.

    Published 13 Mar 2020 · NVD
  48. Medium 6.5

    CVE-2020-10081 · GitLab

    GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user.

    Published 13 Mar 2020 · NVD
  49. Medium 5.3

    CVE-2020-10080 · GitLab

    GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group.

    Published 13 Mar 2020 · NVD
  50. Medium 5.3

    CVE-2020-10079 · GitLab

    GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required.

    Published 13 Mar 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.