UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,836
Published in 7 days
977
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,836 vulnerabilities
  1. Medium 4.8

    CVE-2019-11291 · RabbitMQ

    Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name…

    Published 22 Nov 2019 · Fixed in 1.16.7, 1.17.4, 3.7.20 · NVD
  2. Medium 6.5

    CVE-2019-15593 · GitLab

    GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.

    Published 22 Nov 2019 · NVD
  3. Critical 9.8

    CVE-2019-18622 · phpMyAdmin

    An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.

    Published 22 Nov 2019 · Fixed in 4.9.2 · NVD
  4. High 7.5

    CVE-2012-6079 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  5. High 7.5

    CVE-2012-6078 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  6. High 7.5

    CVE-2012-6077 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  7. Medium 6.5

    CVE-2019-18890 · Redmine

    A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.

    Published 21 Nov 2019 · Fixed in 3.3.10 · NVD
  8. Medium 6.5Actively exploited

    CVE-2019-6693 · Fortinet FortiOS

    Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

    Published 21 Nov 2019 · NVD
  9. Medium 5.9

    CVE-2018-9195 · Fortinet FortiOS

    Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for…

    Published 21 Nov 2019 · NVD
  10. Unrated

    WPV-2d4499083c64 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 21 Nov 2019 · Fixed in 7.9.1 · WPVulnerability
  11. High 7.5

    CVE-2015-3167 · PostgreSQL

    contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

    Published 20 Nov 2019 · Fixed in 9.2.11, 9.3.7, 9.4.2 · NVD
  12. Critical 9.8

    CVE-2015-3166 · PostgreSQL

    The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.

    Published 20 Nov 2019 · Fixed in 9.2.11, 9.3.7, 9.4.2 · NVD
  13. Critical 9.8

    CVE-2013-2093 · Dolibarr ERP CRM

    Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.

    Published 20 Nov 2019 · NVD
  14. Medium 6.1

    CVE-2013-2092 · Dolibarr ERP CRM

    Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.

    Published 20 Nov 2019 · NVD
  15. Critical 9.8

    CVE-2013-2091 · Dolibarr ERP CRM

    SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.

    Published 20 Nov 2019 · NVD
  16. High 7.5

    CVE-2013-1817 · MediaWiki

    MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.

    Published 20 Nov 2019 · Fixed in 1.19.4, 1.20.3 · NVD
  17. High 7.5

    CVE-2013-1816 · MediaWiki

    MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.

    Published 20 Nov 2019 · Fixed in 1.19.4, 1.20.3 · NVD
  18. Medium 6.1

    CVE-2013-0195 · Matomo

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.

    Published 20 Nov 2019 · Fixed in 1.10.1 · NVD
  19. Medium 6.1

    CVE-2013-0194 · Matomo

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.

    Published 20 Nov 2019 · Fixed in 1.10.1 · NVD
  20. Medium 6.1

    CVE-2013-0193 · Matomo

    Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.

    Published 20 Nov 2019 · Fixed in 1.10.1 · NVD
  21. Critical 9.8

    CVE-2011-1028 · Smarty

    The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.

    Published 20 Nov 2019 · Fixed in 3.0.7 · NVD
  22. Low 3.3

    CVE-2019-19126 · GNU C Library

    On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

    Published 19 Nov 2019 · Fixed in 2.31 · NVD
  23. High 7.3

    CVE-2019-18934 · Unbound

    Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration.

    Published 19 Nov 2019 · NVD
  24. Medium 4.8

    CVE-2011-4968 · nginx

    nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)

    Published 19 Nov 2019 · NVD
  25. Medium 6.1

    CVE-2012-4441 · Jenkins

    Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.

    Published 18 Nov 2019 · Fixed in 1.466.2, 1.482 · NVD
  26. Medium 6.1

    CVE-2012-4440 · Jenkins

    Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.

    Published 18 Nov 2019 · Fixed in 1.466.2, 1.482 · NVD
  27. Critical 9.8

    CVE-2019-12409 · Apache Solr

    The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound…

    Published 18 Nov 2019 · NVD
  28. Medium 6.1

    CVE-2012-4439 · Jenkins

    Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

    Published 18 Nov 2019 · Fixed in 1.466.2, 1.482 · NVD
  29. High 8.8

    CVE-2012-4438 · Jenkins

    Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.

    Published 18 Nov 2019 · Fixed in 1.466.2, 1.482 · NVD
  30. Medium 6.5

    CVE-2019-10763 · Pimcore

    pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.

    Published 18 Nov 2019 · Fixed in 6.3.0 · NVD
  31. High 7.5

    CVE-2019-6664 · F5 BIG-IP

    On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices.

    Published 15 Nov 2019 · Fixed in 14.1.2 · NVD
  32. Medium 5.5

    CVE-2019-6663 · F5 BIG-IP

    The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack.

    Published 15 Nov 2019 · NVD
  33. Medium 6.5

    CVE-2019-6662 · F5 BIG-IP

    On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data.

    Published 15 Nov 2019 · Fixed in 13.1.1.5 · NVD
  34. High 7.5

    CVE-2019-6661 · F5 BIG-IP

    When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.

    Published 15 Nov 2019 · Fixed in 13.1.3.2, 14.0.1.1, 14.1.2.1 · NVD
  35. High 7.5

    CVE-2019-6660 · F5 BIG-IP

    On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.

    Published 15 Nov 2019 · Fixed in 13.1.3, 14.0.1.1, 14.1.2.1 · NVD
  36. High 7.5

    CVE-2019-6659 · F5 BIG-IP

    On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.

    Published 15 Nov 2019 · Fixed in 14.1.0.2 · NVD
  37. High 7.5

    CVE-2011-2726 · Drupal

    An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess…

    Published 15 Nov 2019 · Fixed in 7.5 · NVD
  38. High 7.5

    CVE-2013-7089 · ClamAV

    ClamAV before 0.97.7: dbg_printhex possible information leak

    Published 15 Nov 2019 · Fixed in 0.97.7 · NVD
  39. Critical 9.8

    CVE-2013-7088 · ClamAV

    ClamAV before 0.97.7 has buffer overflow in the libclamav component

    Published 15 Nov 2019 · Fixed in 0.97.7 · NVD
  40. Critical 9.8

    CVE-2013-7087 · ClamAV

    ClamAV before 0.97.7 has WWPack corrupt heap memory

    Published 15 Nov 2019 · Fixed in 0.97.7 · NVD
  41. High 8.8

    CVE-2019-14869 · Ghostscript

    A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute…

    Published 15 Nov 2019 · Fixed in 9.50 · NVD
  42. High 7.5

    CVE-2019-18986 · Pimcore

    Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.

    Published 15 Nov 2019 · Fixed in 6.2.2 · NVD
  43. Critical 9.8

    CVE-2019-18985 · Pimcore

    Pimcore before 6.2.2 lacks brute force protection for the 2FA token.

    Published 15 Nov 2019 · Fixed in 6.2.2 · NVD
  44. Medium 6.1

    CVE-2019-18982 · Pimcore

    bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.

    Published 15 Nov 2019 · Fixed in 6.3.0 · NVD
  45. Critical 9.8

    CVE-2019-18981 · Pimcore

    Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.

    Published 15 Nov 2019 · Fixed in 6.2.2 · NVD
  46. Medium 6.5

    CVE-2018-12207 · F5 BIG-IP

    Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.

    Published 14 Nov 2019 · NVD
  47. High 7.5

    CVE-2012-1170 · Moodle

    Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  48. Medium 5.3

    CVE-2012-1169 · Moodle

    Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs.

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  49. Medium 4.3

    CVE-2012-1161 · Moodle

    Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  50. Low 2.7

    CVE-2012-1160 · Moodle

    Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.