UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,812
Published in 7 days
954
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,812 vulnerabilities
  1. Medium 6.1

    CVE-2019-20042 · WordPress

    In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  2. Critical 9.8

    CVE-2019-20041 · WordPress

    wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  3. High 7.5

    CVE-2012-4420 · Java

    An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.

    Published 26 Dec 2019 · NVD
  4. Medium 5.3

    CVE-2018-20492 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6).

    Published 26 Dec 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  5. Medium 6.1

    CVE-2019-6025 · Movable Type

    Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type Advanced 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type Advanced 6.3.9 and…

    Published 26 Dec 2019 · NVD
  6. Medium 6.1

    CVE-2018-18288 · CrushFTP

    CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.

    Published 26 Dec 2019 · NVD
  7. High 7.5

    CVE-2019-19925 · SQLite

    zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

    Published 24 Dec 2019 · NVD
  8. High 7.5

    CVE-2019-19956 · libxml2

    xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

    Published 24 Dec 2019 · Fixed in 2.9.10 · NVD
  9. Medium 5.3

    CVE-2019-19924 · SQLite

    SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.

    Published 24 Dec 2019 · NVD
  10. High 7.5

    CVE-2019-19923 · SQLite

    flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

    Published 24 Dec 2019 · NVD
  11. Critical 9.8

    CVE-2019-19952 · ImageMagick

    In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to ReadOneMNGImage.

    Published 24 Dec 2019 · Fixed in 7.0.9-7 · NVD
  12. Critical 9.1

    CVE-2019-19949 · ImageMagick

    In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.

    Published 24 Dec 2019 · Fixed in 6.9.10-43, 7.0.8-43 · NVD
  13. Critical 9.8

    CVE-2019-19948 · ImageMagick

    In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.

    Published 24 Dec 2019 · NVD
  14. Medium 5.5

    CVE-2019-19151 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for…

    Published 23 Dec 2019 · NVD
  15. Medium 4.3

    CVE-2019-6688 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5 and BIG-IQ versions 6.0.0-6.1.0 and 5.2.0-5.4.0, a user is able to obtain the secret that was being used to encrypt a BIG-IP UCS backup file while sending SNMP query to the BIG-IP or BIG-IQ system, however the user can not access to the UCS files.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.3, 15.1.0 · NVD
  16. Medium 5.3

    CVE-2019-6686 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, the Traffic Management Microkernel (TMM) might stop responding after the total number of diameter connections and pending messages on a single virtual server has reached 32K.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.1.0 · NVD
  17. High 7.8

    CVE-2019-6685 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an elevation of privilege, configuration modification, and arbitrary system command execution.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.3, 15.1.0 · NVD
  18. High 7.5

    CVE-2019-6684 · F5 BIG-IP

    On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed BIG-IP Virtual Clustered Multiprocessing (vCMP) may drop broadcast packets when they are rebroadcast to the vCMP guest secondary blades. An attacker can leverage the fragmented broadcast IP packets to perform any type of fragmentation-based attack.

    Published 23 Dec 2019 · Fixed in 13.1.3.2, 14.1.2.3, 15.1.0 · NVD
  19. High 7.5

    CVE-2019-6683 · F5 BIG-IP

    On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4 profile may be subject to excessive flow usage under undisclosed conditions.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.3, 15.1.0 · NVD
  20. High 7.5

    CVE-2019-6681 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a memory leak in Multicast Forwarding Cache (MFC) handling in tmrouted.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.1.0 · NVD
  21. High 7.5

    CVE-2019-6680 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5, while processing traffic through a standard virtual server that targets a FastL4 virtual server (VIP on VIP), hardware appliances may stop responding.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.0.1.1 · NVD
  22. Low 3.3

    CVE-2019-6679 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access controls implemented by scp.whitelist and scp.blacklist are not properly enforced for paths that are symlinks. This allows authenticated users with SCP access to overwrite certain configuration files that would otherwise be restricted.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.3, 15.0.1.1 · NVD
  23. Medium 4.9

    CVE-2019-19150 · F5 BIG-IP

    On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP APM system logs the client-session-id when a per-session policy is attached to the virtual server with debug logging enabled.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.1.0 · NVD
  24. High 7.0

    CVE-2019-12418 · Apache Tomcat

    When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to…

    Published 23 Dec 2019 · NVD
  25. Medium 5.3

    CVE-2019-6678 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, the TMM process may restart when the packet filter feature is enabled.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.3, 15.0.1.1 · NVD
  26. High 7.5

    CVE-2019-6677 · F5 BIG-IP

    On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using custom TCP congestion control settings in a TCP profile, TMM stops processing traffic when processed by an iRule.

    Published 23 Dec 2019 · Fixed in 14.0.1.1, 14.1.2.1, 15.0.1.1 · NVD
  27. High 7.5

    CVE-2019-6676 · F5 BIG-IP

    On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual Edition (VE) when using virtio direct descriptors and packets 2 KB or larger.

    Published 23 Dec 2019 · Fixed in 13.1.3.2, 14.1.2.3, 15.0.1.1 · NVD
  28. High 7.5

    CVE-2019-17563 · Apache Tomcat

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

    Published 23 Dec 2019 · NVD
  29. Medium 6.5

    CVE-2019-11050 · PHP

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 23 Dec 2019 · NVD
  30. Critical 9.8

    CVE-2019-11049 · PHP

    In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.

    Published 23 Dec 2019 · NVD
  31. Medium 6.5

    CVE-2019-11047 · PHP

    When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

    Published 23 Dec 2019 · Fixed in 7.2.26, 7.3.13 · NVD
  32. Medium 5.3

    CVE-2019-11046 · PHP

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.

    Published 23 Dec 2019 · NVD
  33. Medium 5.9

    CVE-2019-11045 · PHP

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

    Published 23 Dec 2019 · NVD
  34. High 7.5

    CVE-2019-11044 · PHP

    In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

    Published 23 Dec 2019 · NVD
  35. High 7.5

    CVE-2019-19926 · SQLite

    multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

    Published 23 Dec 2019 · NVD
  36. Medium 5.4

    CVE-2019-16781 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress block editor (within dashboard)

    Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress
  37. Medium 5.4

    CVE-2019-16780 · WordPress

    Stored cross-site scripting (XSS) in WordPress block editor

    Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress
  38. Medium 6.5

    CVE-2019-15584 · GitLab

    A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.

    Published 20 Dec 2019 · Fixed in 12.1.10, 12.2.6, 12.3.2 · NVD
  39. Critical 9.8

    CVE-2019-17571 · Apache Log4j, Oracle WebLogic Server

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

    Published 20 Dec 2019 · NVD
  40. Critical 9.8

    CVE-2019-17440 · Palo Alto Networks PAN-OS

    Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series…

    Published 20 Dec 2019 · NVD
  41. Critical 9.8

    CVE-2019-8256 · Adobe ColdFusion

    ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful exploitation could lead to privilege escalation.

    Published 19 Dec 2019 · NVD
  42. Medium 6.1

    CVE-2019-19910 · MediaWiki

    The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address). This can occur within a talk page topical header that is viewed within a mobile (MobileFrontend) context.

    Published 19 Dec 2019 · NVD
  43. High 8.1

    CVE-2019-11780 · Odoo

    Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation.

    Published 19 Dec 2019 · NVD
  44. Medium 4.8

    CVE-2019-19903 · Backdrop CMS

    An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when viewing the list of file types, aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role…

    Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD
  45. High 7.2

    CVE-2019-19902 · Backdrop CMS

    An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to potentially be uploaded to the server. This issue is mitigated by the fact that the attacker would be…

    Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD
  46. Medium 4.8

    CVE-2019-19901 · Backdrop CMS

    An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description, then have an administrator execute scripting when configuring a layout, aka XSS. This issue is mitigated by the fact that the attacker would…

    Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD
  47. Medium 4.8

    CVE-2019-19900 · Backdrop CMS

    An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name, then have an editor execute scripting when creating content, aka XSS. This vulnerability is mitigated by the fact that an attacker…

    Published 19 Dec 2019 · Fixed in 1.13.5, 1.14.2 · NVD
  48. High 7.8

    CVE-2019-7487 · SonicWall SonicOS

    Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution.

    Published 19 Dec 2019 · NVD
  49. Medium 6.5

    CVE-2019-15006 · Confluence

    There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the…

    Published 19 Dec 2019 · Fixed in 6.15.10, 7.0.5, 7.1.2 · NVD
  50. Medium 4.4

    CVE-2019-11109 · F5 BIG-IP

    Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileged user to potentially enable denial of service via local access.

    Published 18 Dec 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.