UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,774
Published in 7 days
919
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,774 vulnerabilities
  1. Critical 9.8

    CVE-2016-2031 · HPE ArubaOS

    Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which could allow a malicious user to bypass security restrictions, obtain sensitive information, perform unauthorized actions and execute arbitrary code.

    Published 31 Jan 2020 · NVD
  2. High 7.5

    CVE-2019-4720 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available memory. IBM X-Force ID: 172125.

    Published 31 Jan 2020 · Fixed in 20.0.0.2 · NVD
  3. Medium 6.5

    CVE-2020-8492 · Python

    Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

    Published 30 Jan 2020 · NVD
  4. Medium 6.1

    CVE-2020-7911 · TeamCity

    In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.

    Published 30 Jan 2020 · Fixed in 2019.2.0 · NVD
  5. Medium 5.4

    CVE-2020-7910 · TeamCity

    JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

    Published 30 Jan 2020 · Fixed in 2019.2.0 · NVD
  6. High 7.5

    CVE-2020-7909 · TeamCity

    In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.

    Published 30 Jan 2020 · Fixed in 2019.1.5 · NVD
  7. Medium 4.3

    CVE-2020-7908 · TeamCity

    In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.

    Published 30 Jan 2020 · Fixed in 2019.1.5 · NVD
  8. Medium 6.1

    CVE-2020-3758 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  9. High 7.5

    CVE-2020-3719 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  10. Critical 9.8

    CVE-2020-3718 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jan 2020 · NVD
  11. Medium 5.3

    CVE-2020-3717 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  12. Critical 9.8

    CVE-2020-3716 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 29 Jan 2020 · NVD
  13. Medium 6.1

    CVE-2020-3715 · Magento / Adobe Commerce

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 29 Jan 2020 · NVD
  14. High 7.8

    CVE-2019-18634 · sudo

    In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of…

    Published 29 Jan 2020 · Fixed in 1.8.26 · NVD
  15. Medium 5.4

    CVE-2020-2105 · Jenkins

    REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

    Published 29 Jan 2020 · NVD
  16. Medium 4.3

    CVE-2020-2104 · Jenkins

    Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.

    Published 29 Jan 2020 · NVD
  17. Medium 5.4

    CVE-2020-2103 · Jenkins

    Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.

    Published 29 Jan 2020 · NVD
  18. Medium 5.3

    CVE-2020-2102 · Jenkins

    Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

    Published 29 Jan 2020 · NVD
  19. Medium 5.3

    CVE-2020-2101 · Jenkins

    Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

    Published 29 Jan 2020 · NVD
  20. Medium 5.8

    CVE-2020-2100 · Jenkins

    Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.

    Published 29 Jan 2020 · NVD
  21. High 8.6

    CVE-2020-2099 · Jenkins

    Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

    Published 29 Jan 2020 · NVD
  22. High 8.8

    CVE-2012-4383 · Contao

    contao prior to 2.11.4 has a sql injection vulnerability

    Published 29 Jan 2020 · Fixed in 2.11.4 · NVD
  23. Unrated

    WPV-9ebdb28ccadd · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 29 Jan 2020 · Fixed in 2.7.6 · WPVulnerability
  24. Unrated

    WPV-97c7bb986b1b · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 29 Jan 2020 · Fixed in 2.7.6 · WPVulnerability
  25. Medium 6.1

    CVE-2020-8421 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.

    Published 28 Jan 2020 · Fixed in 3.9.14 · NVD
  26. High 8.8

    CVE-2020-8420 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.

    Published 28 Jan 2020 · Fixed in 3.9.15 · NVD
  27. High 8.8

    CVE-2020-8419 · Joomla!

    An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.

    Published 28 Jan 2020 · Fixed in 3.9.15 · NVD
  28. Medium 5.5

    CVE-2020-8315 · Python

    In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.

    Published 28 Jan 2020 · NVD
  29. High 8.8

    CVE-2013-4583 · GitLab

    The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to gain privileges and clone arbitrary repositories.

    Published 28 Jan 2020 · Fixed in 5.4.2, 6.2.1, 6.2.4 · NVD
  30. Medium 6.5

    CVE-2013-4582 · GitLab

    The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

    Published 28 Jan 2020 · Fixed in 5.4.2, 6.2.1, 6.2.4 · NVD
  31. Medium 5.3

    CVE-2013-6455 · MediaWiki

    The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

    Published 28 Jan 2020 · Fixed in 1.19.10, 1.21.4, 1.22.1 · NVD
  32. Medium 6.1

    CVE-2013-6451 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.

    Published 28 Jan 2020 · Fixed in 1.19.10, 1.21.4, 1.22.1 · NVD
  33. Medium 5.4

    CVE-2020-7934 · Liferay Portal / DXP

    In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a…

    Published 28 Jan 2020 · NVD
  34. High 7.0

    CVE-2019-19921 · runc

    procfs race condition with a shared volume mount

    Published 28 Jan 2020 · Fixed in 1.0.0-rc10 · NVD, Project advisories (GitHub)
  35. Medium 6.5

    CVE-2019-5474 · GitLab

    An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropriate permissions.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  36. High 7.5

    CVE-2019-5472 · GitLab

    An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  37. High 7.5

    CVE-2019-5470 · GitLab

    An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  38. High 8.8

    CVE-2019-5468 · GitLab

    An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  39. Medium 4.3

    CVE-2019-5466 · GitLab

    An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  40. Medium 4.3

    CVE-2019-5465 · GitLab

    An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  41. Critical 9.8

    CVE-2019-5464 · GitLab

    A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  42. High 8.8

    CVE-2019-5462 · GitLab

    A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  43. High 7.5

    CVE-2019-15590 · GitLab

    An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration

    Published 28 Jan 2020 · Fixed in 12.1.14, 12.2.8, 12.3.5 · NVD
  44. Medium 6.1

    CVE-2019-15586 · GitLab

    A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.

    Published 28 Jan 2020 · Fixed in 12.1.10 · NVD
  45. Critical 9.8

    CVE-2019-15585 · GitLab

    Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  46. High 7.5

    CVE-2019-15583 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  47. Medium 5.3

    CVE-2019-15582 · GitLab

    An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  48. Medium 5.3

    CVE-2019-15581 · GitLab

    An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  49. Medium 5.3

    CVE-2019-15579 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  50. Medium 5.3

    CVE-2019-15578 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.