UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,788
Published in 7 days
933
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,788 vulnerabilities
  1. High 7.5

    CVE-2019-5470 · GitLab

    An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability feedback information.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  2. High 8.8

    CVE-2019-5468 · GitLab

    An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account.

    Published 28 Jan 2020 · Fixed in 11.11.6, 12.0.4, 12.1.2 · NVD
  3. Medium 4.3

    CVE-2019-5466 · GitLab

    An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  4. Medium 4.3

    CVE-2019-5465 · GitLab

    An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly created issue ID.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  5. Critical 9.8

    CVE-2019-5464 · GitLab

    A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  6. High 8.8

    CVE-2019-5462 · GitLab

    A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.

    Published 28 Jan 2020 · Fixed in 11.11.7 · NVD
  7. High 7.5

    CVE-2019-15590 · GitLab

    An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration

    Published 28 Jan 2020 · Fixed in 12.1.14, 12.2.8, 12.3.5 · NVD
  8. Medium 6.1

    CVE-2019-15586 · GitLab

    A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.

    Published 28 Jan 2020 · Fixed in 12.1.10 · NVD
  9. Critical 9.8

    CVE-2019-15585 · GitLab

    Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  10. High 7.5

    CVE-2019-15583 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  11. Medium 5.3

    CVE-2019-15582 · GitLab

    An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  12. Medium 5.3

    CVE-2019-15581 · GitLab

    An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to see the members of any private group via merge request approval rules.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  13. Medium 5.3

    CVE-2019-15579 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a confidential issue in a private project would be disclosed to a guest via milestones.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  14. Medium 5.3

    CVE-2019-15578 · GitLab

    An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private project, that used to be public, would be disclosed in the unsubscribe email link of issues and merge requests.

    Published 28 Jan 2020 · Fixed in 12.1.12, 12.2.6, 12.3.2 · NVD
  15. Medium 6.5

    CVE-2020-1932 · Apache Superset

    An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

    Published 28 Jan 2020 · NVD
  16. Medium 5.4

    CVE-2020-8426 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 28 Jan 2020 · Fixed in 2.8.5 · NVD, WPVulnerability
  17. Medium 6.1

    CVE-2020-8091 · TYPO3

    svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.

    Published 27 Jan 2020 · Fixed in 6.2.39 · NVD
  18. Medium 4.3

    CVE-2020-5218 · Sylius

    Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even…

    Published 27 Jan 2020 · Fixed in 1.3.13, 1.4.6, 1.6.3 · NVD
  19. Critical 9.8

    CVE-2015-0244 · PostgreSQL

    PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a…

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  20. High 8.8

    CVE-2015-0243 · PostgreSQL

    Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  21. High 8.8

    CVE-2015-0242 · PostgreSQL

    Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1, when running on a Windows system, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a floating point number with a large precision, as demonstrated by…

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  22. High 8.8

    CVE-2015-0241 · PostgreSQL

    The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting…

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  23. Medium 5.9

    CVE-2014-9481 · MediaWiki

    The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.

    Published 27 Jan 2020 · Fixed in 1.22.15, 1.23.8, 1.24.1 · NVD
  24. Medium 4.3

    CVE-2014-8161 · PostgreSQL

    PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.

    Published 27 Jan 2020 · Fixed in 9.2.10, 9.3.6, 9.4.1 · NVD
  25. Medium 5.3

    CVE-2014-4156 · Proxmox VE

    Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability

    Published 27 Jan 2020 · Fixed in 3.2 · NVD
  26. Medium 6.1

    CVE-2020-7996 · Dolibarr ERP CRM

    htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.

    Published 26 Jan 2020 · NVD
  27. Critical 9.8

    CVE-2020-7995 · Dolibarr ERP CRM

    The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.

    Published 26 Jan 2020 · NVD
  28. Medium 6.1

    CVE-2020-7994 · Dolibarr ERP CRM

    Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4)…

    Published 26 Jan 2020 · NVD
  29. High 7.5

    CVE-2020-7226 · Oracle WebLogic Server

    CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

    Published 24 Jan 2020 · NVD
  30. High 7.5

    CVE-2020-7220 · HashiCorp Vault

    HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

    Published 23 Jan 2020 · Fixed in 1.3.2 · NVD
  31. Medium 5.5

    CVE-2019-5593 · Fortinet FortiOS

    Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded local certificates via setting an empty password in FortiOS 6.2.1, 6.2.0, 6.0.6 and below.

    Published 23 Jan 2020 · NVD
  32. High 8.8

    CVE-2020-7931 · JFrog Artifactory

    In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

    Published 23 Jan 2020 · Fixed in 6.13.2, 6.14.2, 6.15.1 · NVD
  33. High 7.8

    CVE-2013-6773 · Splunk Enterprise

    Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges

    Published 23 Jan 2020 · Fixed in 5.0.3 · NVD
  34. Medium 4.3

    CVE-2013-6772 · Splunk Enterprise

    Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking

    Published 23 Jan 2020 · Fixed in 5.0.4 · NVD
  35. High 8.8

    CVE-2013-6358 · PrestaShop

    PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.

    Published 23 Jan 2020 · NVD
  36. Critical 9.8

    CVE-2012-2087 · ISPConfig

    ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.

    Published 23 Jan 2020 · NVD
  37. Medium 4.3

    CVE-2020-7210 · Umbraco CMS

    Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.

    Published 23 Jan 2020 · NVD
  38. Medium 5.4

    CVE-2011-3595 · Joomla!

    Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.

    Published 22 Jan 2020 · NVD
  39. High 7.5

    CVE-2020-7595 · libxml2

    xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

    Published 21 Jan 2020 · NVD
  40. High 7.5

    CVE-2019-20388 · libxml2

    xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

    Published 21 Jan 2020 · NVD
  41. High 7.5

    CVE-2019-19886 · ModSecurity

    Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.

    Published 21 Jan 2020 · NVD
  42. Medium 6.5

    CVE-2019-19344 · Samba

    There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

    Published 21 Jan 2020 · Fixed in 4.9.18, 4.10.12, 4.11.5 · NVD
  43. Medium 6.5

    CVE-2019-14907 · Samba

    All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the…

    Published 21 Jan 2020 · Fixed in 4.9.18, 4.10.12, 4.11.5 · NVD
  44. Medium 5.4

    CVE-2019-14902 · Samba

    There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.

    Published 21 Jan 2020 · Fixed in 4.9.18, 4.10.12, 4.11.5 · NVD
  45. Medium 5.3

    CVE-2020-29156 · WooCommerce

    WooCommerce: Authorization Bypass Through User-Controlled Key

    Published 21 Jan 2020 · Fixed in 4.7.0 · NVD, WPVulnerability
  46. Critical 9.8

    CVE-2020-7109 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 19 Jan 2020 · Fixed in 2.8.4 · NVD, WPVulnerability
  47. Medium 5.3

    CVE-2020-5397 · Oracle WebLogic Server

    Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to…

    Published 17 Jan 2020 · NVD
  48. High 7.5

    CVE-2020-5398 · MySQL, Oracle WebLogic Server

    In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

    Published 17 Jan 2020 · NVD
  49. Medium 6.5

    CVE-2019-15961 · ClamAV

    A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this…

    Published 15 Jan 2020 · NVD
  50. Low 3.1

    CVE-2020-2694 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.18 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 15 Jan 2020 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.