UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,774
Published in 7 days
951
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,774 vulnerabilities
  1. Medium 6.5

    CVE-2019-20401 · Jira

    Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities.

    Published 6 Feb 2020 · Fixed in 8.5.2, 8.6.0 · NVD
  2. High 7.8

    CVE-2019-20400 · Jira

    The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability.

    Published 6 Feb 2020 · Fixed in 8.5.2, 8.6.0 · NVD
  3. Medium 4.3

    CVE-2019-20106 · Jira

    Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

    Published 6 Feb 2020 · Fixed in 7.13.12, 8.5.4 · NVD
  4. Critical 9.1

    CVE-2011-1151 · Joomla!

    Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.

    Published 5 Feb 2020 · NVD
  5. High 7.5

    CVE-2020-3123 · ClamAV

    A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending…

    Published 5 Feb 2020 · NVD
  6. High 7.5

    CVE-2020-6833 · GitLab

    An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6, 12.7.4 · NVD
  7. High 7.5

    CVE-2020-7978 · GitLab

    GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.

    Published 5 Feb 2020 · Fixed in 12.6.6 · NVD
  8. Medium 5.3

    CVE-2020-7977 · GitLab

    GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  9. Medium 5.3

    CVE-2020-7976 · GitLab

    GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  10. Medium 5.3

    CVE-2020-7974 · GitLab

    GitLab EE 10.1 through 12.7.2 allows Information Disclosure.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  11. Medium 6.1

    CVE-2020-7973 · GitLab

    GitLab through 12.7.2 allows XSS.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  12. High 7.5

    CVE-2020-7972 · GitLab

    GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6, 12.7.4 · NVD
  13. Medium 6.1

    CVE-2020-7971 · GitLab

    GitLab EE 11.0 and later through 12.7.2 allows XSS.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  14. High 7.5

    CVE-2020-7969 · GitLab

    GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  15. High 7.5

    CVE-2020-7968 · GitLab

    GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6, 12.7.4 · NVD
  16. Medium 4.3

    CVE-2020-7967 · GitLab

    GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).

    Published 5 Feb 2020 · NVD
  17. High 7.5

    CVE-2020-7966 · GitLab

    GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  18. Medium 6.5

    CVE-2019-4670 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. IBM X-Force ID: 171319.

    Published 5 Feb 2020 · NVD
  19. Critical 9.8

    CVE-2020-8114 · GitLab

    GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  20. Medium 5.3

    CVE-2020-7979 · GitLab

    GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

    Published 5 Feb 2020 · Fixed in 12.5.9, 12.6.6 · NVD
  21. High 7.5

    CVE-2019-12528 · Squid

    An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.

    Published 4 Feb 2020 · Fixed in 4.10 · NVD
  22. High 7.5

    CVE-2020-8517 · Squid

    An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients…

    Published 4 Feb 2020 · Fixed in 4.10 · NVD
  23. High 7.3

    CVE-2020-8450 · Squid

    An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.

    Published 4 Feb 2020 · Fixed in 4.10 · NVD
  24. High 7.5

    CVE-2020-8449 · Squid

    An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.

    Published 4 Feb 2020 · Fixed in 4.10 · NVD
  25. Medium 4.9

    CVE-2020-8123 · Strapi

    A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.

    Published 4 Feb 2020 · Fixed in 3.0.0 · NVD
  26. Medium 4.3

    CVE-2020-8122 · Nextcloud

    A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.

    Published 4 Feb 2020 · Fixed in 13.0.8, 14.0.4, 15.0.0 · NVD
  27. High 8.1

    CVE-2020-8121 · Nextcloud

    A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.

    Published 4 Feb 2020 · Fixed in 13.0.9, 14.0.5, 15.0.0 · NVD
  28. Medium 6.1

    CVE-2020-8120 · Nextcloud

    A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.

    Published 4 Feb 2020 · NVD
  29. Medium 4.3

    CVE-2020-8119 · Nextcloud

    Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

    Published 4 Feb 2020 · Fixed in 15.0.13, 16.0.6, 17.0.1 · NVD
  30. Medium 5.0

    CVE-2020-8118 · Nextcloud

    An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.

    Published 4 Feb 2020 · Fixed in 15.0.9, 16.0.2 · NVD
  31. Medium 4.3

    CVE-2020-8117 · Nextcloud

    Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.

    Published 4 Feb 2020 · Fixed in 12.0.13, 13.0.8, 14.0.4 · NVD
  32. Medium 4.9

    CVE-2019-15624 · Nextcloud

    Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

    Published 4 Feb 2020 · Fixed in 14.0.11, 15.0.8 · NVD
  33. Medium 5.3

    CVE-2019-15623 · Nextcloud

    Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.

    Published 4 Feb 2020 · Fixed in 14.0.13, 15.0.9, 16.0.2 · NVD
  34. Medium 6.5

    CVE-2019-15621 · Nextcloud

    Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.

    Published 4 Feb 2020 · Fixed in 14.0.13, 15.0.9, 16.0.2 · NVD
  35. Medium 4.8

    CVE-2019-15619 · Nextcloud

    Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

    Published 4 Feb 2020 · Fixed in 16.0.4 · NVD
  36. Medium 4.8

    CVE-2019-15618 · Nextcloud

    Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.

    Published 4 Feb 2020 · Fixed in 14.0.9, 15.0.6 · NVD
  37. Medium 5.4

    CVE-2019-15617 · Nextcloud

    A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.

    Published 4 Feb 2020 · Fixed in 17.0.1 · NVD
  38. Medium 4.3

    CVE-2019-15616 · Nextcloud

    Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

    Published 4 Feb 2020 · Fixed in 17.0.0 · NVD
  39. High 8.0

    CVE-2019-15613 · Nextcloud

    A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.

    Published 4 Feb 2020 · Fixed in 15.0.14, 16.0.7, 17.0.2 · NVD
  40. Medium 5.9

    CVE-2019-15612 · Nextcloud

    A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.

    Published 4 Feb 2020 · Fixed in 13.0.11, 14.0.7, 15.0.3 · NVD
  41. High 7.8

    CVE-2020-7221 · MariaDB

    mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently.

    Published 4 Feb 2020 · NVD
  42. High 7.2

    CVE-2020-4163 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 174397.

    Published 4 Feb 2020 · NVD
  43. High 7.5

    CVE-2019-9674 · Python

    Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

    Published 4 Feb 2020 · NVD
  44. Medium 5.3

    CVE-2011-4912 · Joomla!

    Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.

    Published 4 Feb 2020 · NVD
  45. High 7.5

    CVE-2011-4937 · Joomla!

    Joomla! 1.7.1 has core information disclosure due to inadequate error checking.

    Published 4 Feb 2020 · Fixed in 1.7.2 · NVD
  46. High 7.5

    CVE-2011-3629 · Joomla!

    Joomla! core 1.7.1 allows information disclosure due to weak encryption

    Published 4 Feb 2020 · Fixed in 1.7.2 · NVD
  47. Medium 6.5

    CVE-2019-4732 · IBM WebSphere Application Server

    IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to…

    Published 3 Feb 2020 · NVD
  48. Medium 5.7

    CVE-2019-11251 · Kubernetes

    The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

    Published 3 Feb 2020 · Fixed in 1.13.11, 1.14.7, 1.15.4 · NVD
  49. Low 3.5

    CVE-2015-6815 · Xen

    The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.

    Published 31 Jan 2020 · NVD
  50. High 7.5

    CVE-2016-2032 · HPE ArubaOS

    A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ, which could let a malicious user obtain sensitive information. This interface listens on TCP port 15672 and 55672

    Published 31 Jan 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.