UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,774
Published in 7 days
953
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,774 vulnerabilities
  1. Medium 5.4

    CVE-2020-9016 · Dolibarr ERP CRM

    Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.

    Published 16 Feb 2020 · NVD
  2. Medium 4.3

    CVE-2019-15594 · GitLab

    GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.

    Published 14 Feb 2020 · NVD
  3. Medium 4.3

    CVE-2019-15592 · GitLab

    GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.

    Published 14 Feb 2020 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  4. Critical 9.0

    CVE-2020-8612 · MOVEit Transfer

    In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.

    Published 14 Feb 2020 · Fixed in 2019.2.1 · NVD
  5. High 8.8

    CVE-2020-8611 · MOVEit Transfer

    In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer…

    Published 14 Feb 2020 · Fixed in 2019.2.1 · NVD
  6. Medium 5.5

    CVE-2013-4792 · PrestaShop

    PrestaShop before 1.4.11 allows logout CSRF.

    Published 14 Feb 2020 · Fixed in 1.4.11 · NVD
  7. Medium 5.4

    CVE-2013-4791 · PrestaShop

    PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.

    Published 14 Feb 2020 · Fixed in 1.4.11 · NVD
  8. Medium 5.4

    CVE-2012-1500 · Jira

    Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.

    Published 13 Feb 2020 · NVD
  9. High 7.5

    CVE-2020-3741 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability. Successful exploitation could lead to denial-of-service.

    Published 13 Feb 2020 · NVD
  10. High 8.8

    CVE-2020-1975 · Palo Alto Networks PAN-OS

    Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.

    Published 12 Feb 2020 · Fixed in 8.1.12, 9.0.6 · NVD
  11. High 7.5

    CVE-2011-3336 · PHP

    regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.

    Published 12 Feb 2020 · NVD
  12. Medium 5.3

    CVE-2020-7957 · Dovecot

    The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.

    Published 12 Feb 2020 · Fixed in 2.3.9.3 · NVD
  13. High 7.5

    CVE-2020-7046 · Dovecot

    lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.

    Published 12 Feb 2020 · Fixed in 2.3.9.3 · NVD
  14. High 7.5

    CVE-2013-4090 · Varnish Cache

    Varnish HTTP cache before 3.0.4: ACL bug

    Published 12 Feb 2020 · Fixed in 3.0.4 · NVD
  15. Medium 4.7

    CVE-2019-20100 · Jira

    The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version 7.1.0 before version 7.1.3. The vulnerable plugin is used by Atlassian Jira Server and Data Center…

    Published 12 Feb 2020 · Fixed in 8.4.5, 8.5.4, 8.6.2 · NVD
  16. Medium 4.3

    CVE-2019-20099 · Jira

    The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.

    Published 12 Feb 2020 · Fixed in 8.5.4, 8.6.2 · NVD
  17. Medium 4.3

    CVE-2019-20098 · Jira

    The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present.

    Published 12 Feb 2020 · Fixed in 8.5.4, 8.6.2 · NVD
  18. High 8.1

    CVE-2020-0692 · Microsoft Exchange Server

    An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.

    Published 11 Feb 2020 · NVD
  19. High 8.8Actively exploited

    CVE-2020-0688 · Microsoft Exchange Server

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

    Published 11 Feb 2020 · NVD
  20. Medium 6.1

    CVE-2012-2517 · PrestaShop

    Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php.

    Published 11 Feb 2020 · Fixed in 1.4.9.0 · NVD
  21. Medium 5.4

    CVE-2014-3827 · MyBB

    Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser action or the name parameter in an (4) edit action in the user-user module or the (5) editprofile action to modcp.php.

    Published 11 Feb 2020 · Fixed in 1.8.4 · NVD
  22. Medium 5.4

    CVE-2014-3826 · MyBB

    Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module.

    Published 11 Feb 2020 · Fixed in 1.6.13 · NVD
  23. High 8.1

    CVE-2014-9748 · Node.js

    The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.

    Published 11 Feb 2020 · Fixed in 0.10.46, 0.12.15 · NVD
  24. Medium 5.4

    CVE-2019-18210 · Moodle

    Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be…

    Published 11 Feb 2020 · NVD
  25. Unrated

    WPV-37c0f3846c9e · Worker (WordPress plugin)

    Vulnerability in ManageWP Worker

    Published 11 Feb 2020 · Fixed in 4.9.3 · WPVulnerability
  26. Medium 5.4

    CVE-2012-6449 · cPanel & WHM

    The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.

    Published 10 Feb 2020 · NVD
  27. Critical 9.1

    CVE-2020-7060 · PHP

    When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 10 Feb 2020 · Fixed in 7.2.27, 7.3.14, 7.4.2 · NVD
  28. Critical 9.1

    CVE-2020-7059 · PHP

    When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 10 Feb 2020 · Fixed in 7.2.27, 7.3.14, 7.4.2 · NVD
  29. High 8.1

    CVE-2012-4381 · MediaWiki

    MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system…

    Published 8 Feb 2020 · Fixed in 1.18.5, 1.19.2 · NVD
  30. Medium 5.3

    CVE-2014-5278 · Docker Engine

    A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.

    Published 7 Feb 2020 · Fixed in 1.2.0 · NVD
  31. Critical 9.8

    CVE-2019-15606 · Node.js

    Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

    Published 7 Feb 2020 · Fixed in 10.19.0, 12.15.0, 13.8.0 · NVD
  32. Critical 9.8

    CVE-2019-15605 · Node.js

    HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

    Published 7 Feb 2020 · Fixed in 10.19.0, 12.15.0, 13.8.0 · NVD
  33. High 7.5

    CVE-2019-15604 · Node.js

    Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

    Published 7 Feb 2020 · Fixed in 10.19.0, 12.15.0, 13.8.0 · NVD
  34. High 8.8

    CVE-2013-3629 · ISPConfig

    ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution

    Published 7 Feb 2020 · NVD
  35. High 8.8

    CVE-2013-3628 · Zabbix

    Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

    Published 7 Feb 2020 · NVD
  36. Medium 5.3

    CVE-2019-12426 · Apache OFBiz

    an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06

    Published 6 Feb 2020 · NVD
  37. High 7.5

    CVE-2020-5856 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted in Amazon Web Services (AWS) may experience a TMM restart.

    Published 6 Feb 2020 · Fixed in 14.1.2.3, 15.1.0 · NVD
  38. Medium 4.3

    CVE-2020-5855 · F5 BIG-IP

    When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an authorized user's machine can get shell access under unprivileged user.

    Published 6 Feb 2020 · NVD
  39. Medium 5.9

    CVE-2020-5854 · F5 BIG-IP

    On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances when using the connector profile if a specific sequence of connections are made.

    Published 6 Feb 2020 · Fixed in 14.0.1.1, 14.1.2.1, 15.1.0 · NVD
  40. High 8.8

    CVE-2014-2030 · ImageMagick

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.

    Published 6 Feb 2020 · NVD
  41. High 8.8

    CVE-2014-1958 · ImageMagick

    Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.

    Published 6 Feb 2020 · Fixed in 6.8.8-5 · NVD
  42. High 7.5

    CVE-2013-4572 · MediaWiki

    The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

    Published 6 Feb 2020 · Fixed in 1.19.9, 1.20.8, 1.21.3 · NVD
  43. Medium 6.5

    CVE-2016-7524 · ImageMagick

    coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

    Published 6 Feb 2020 · Fixed in 6.9.4-0 · NVD
  44. Medium 6.5

    CVE-2016-7523 · ImageMagick

    coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.

    Published 6 Feb 2020 · Fixed in 6.9.4-0 · NVD
  45. Medium 6.1

    CVE-2020-5528 · Movable Type

    Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier (Movable Type Advanced 6.5), Movable Type Premium 1.26 and earlier (Movable Type Premium), and Movable Type Premium Advanced…

    Published 6 Feb 2020 · NVD
  46. High 7.8

    CVE-2019-20406 · Confluence

    The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local system attackers who have permission to write a DLL file in a directory in the global path environmental variable variable to inject code & escalate their privileges via a DLL hijacking vulnerability.

    Published 6 Feb 2020 · NVD
  47. Medium 4.3

    CVE-2019-20405 · Jira

    The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.

    Published 6 Feb 2020 · Fixed in 8.6.0 · NVD
  48. Medium 4.3

    CVE-2019-20404 · Jira

    The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.

    Published 6 Feb 2020 · Fixed in 8.6.0, 8.7.0 · NVD
  49. Medium 5.3

    CVE-2019-20403 · Jira

    The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.

    Published 6 Feb 2020 · Fixed in 8.5.5 · NVD
  50. Medium 4.9

    CVE-2019-20402 · Jira

    Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability.

    Published 6 Feb 2020 · Fixed in 8.6.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.