UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,836
Published in 7 days
977
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,836 vulnerabilities
  1. Medium 4.3

    CVE-2012-1159 · Moodle

    Moodle before 2.2.2: Overview report allows users to see hidden courses

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  2. Medium 4.3

    CVE-2012-1158 · Moodle

    Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  3. Medium 4.3

    CVE-2012-1157 · Moodle

    Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  4. High 8.2

    CVE-2012-1168 · Moodle

    Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  5. High 7.5

    CVE-2012-1156 · Moodle

    Moodle before 2.2.2 has users' private files included in course backups

    Published 14 Nov 2019 · Fixed in 2.2.2 · NVD
  6. High 7.5

    CVE-2012-1155 · Moodle

    Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to

    Published 14 Nov 2019 · Fixed in 2.0.8, 2.1.5, 2.2.2 · NVD
  7. Medium 6.1

    CVE-2011-0544 · phpBB

    phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.

    Published 14 Nov 2019 · NVD
  8. High 7.5

    CVE-2010-4657 · PHP

    PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.

    Published 13 Nov 2019 · Fixed in 5.4.4 · NVD
  9. Critical 9.8

    CVE-2019-1373 · Microsoft Exchange Server

    A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.

    Published 12 Nov 2019 · NVD
  10. Medium 6.5

    CVE-2019-18853 · ImageMagick

    ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2.

    Published 11 Nov 2019 · Fixed in 7.0.9-0 · NVD
  11. High 7.5

    CVE-2019-18836 · Envoy

    Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used."

    Published 11 Nov 2019 · NVD
  12. Medium 6.1

    CVE-2019-10219 · Java, MySQL, Oracle WebLogic Server

    A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

    Published 8 Nov 2019 · Fixed in 5.7.36, 8.0.27 · NVD
  13. Medium 4.3

    CVE-2019-15005 · Jira

    The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with…

    Published 8 Nov 2019 · Fixed in 8.3.2 · NVD
  14. Critical 9.8

    CVE-2007-6745 · ClamAV

    clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.

    Published 7 Nov 2019 · NVD
  15. Critical 9.8

    CVE-2019-18818 · Strapi

    strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

    Published 7 Nov 2019 · NVD
  16. Medium 6.5

    CVE-2010-2473 · Drupal

    Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked.

    Published 7 Nov 2019 · Fixed in 5.22, 6.16 · NVD
  17. Medium 4.8

    CVE-2010-2472 · Drupal

    Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.

    Published 7 Nov 2019 · Fixed in 5.22, 6.16 · NVD
  18. Medium 6.1

    CVE-2010-2250 · Drupal

    Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.

    Published 7 Nov 2019 · Fixed in 5.22, 6.16 · NVD
  19. Medium 5.4

    CVE-2019-16878 · Portainer

    Portainer before 1.22.1 has XSS (issue 2 of 2).

    Published 7 Nov 2019 · Fixed in 1.22.1 · NVD
  20. High 8.8

    CVE-2019-16877 · Portainer

    Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).

    Published 7 Nov 2019 · Fixed in 1.22.1 · NVD
  21. High 7.5

    CVE-2019-16876 · Portainer

    Portainer before 1.22.1 allows Directory Traversal.

    Published 7 Nov 2019 · Fixed in 1.22.1 · NVD
  22. Critical 9.9

    CVE-2019-16872 · Portainer

    Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).

    Published 7 Nov 2019 · Fixed in 1.22.1 · NVD
  23. Medium 6.5

    CVE-2019-16874 · Portainer

    Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

    Published 7 Nov 2019 · Fixed in 1.22.1 · NVD
  24. Medium 5.4

    CVE-2019-16873 · Portainer

    Portainer before 1.22.1 has XSS (issue 1 of 2).

    Published 7 Nov 2019 · Fixed in 1.22.1 · NVD
  25. Medium 6.1

    CVE-2009-5046 · Eclipse Jetty

    JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.

    Published 6 Nov 2019 · Fixed in 6.1.22 · NVD
  26. High 7.5

    CVE-2009-5045 · Eclipse Jetty

    Dump Servlet information leak in jetty before 6.1.22.

    Published 6 Nov 2019 · Fixed in 6.1.22 · NVD
  27. Medium 6.1

    CVE-2010-2471 · Drupal

    Drupal versions 5.x and 6.x has open redirection

    Published 6 Nov 2019 · Fixed in 5.22, 6.16 · NVD
  28. Medium 6.5

    CVE-2011-4904 · TYPO3

    TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.

    Published 6 Nov 2019 · Fixed in 4.4.9, 4.5.4 · NVD
  29. Medium 6.1

    CVE-2011-4903 · TYPO3

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  30. Medium 6.5

    CVE-2011-4902 · TYPO3

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  31. Medium 6.5

    CVE-2011-4901 · TYPO3

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  32. Medium 6.5

    CVE-2011-4900 · TYPO3

    TYPO3 before 4.5.4 allows Information Disclosure in the backend.

    Published 6 Nov 2019 · Fixed in 4.5.4 · NVD
  33. Medium 5.4

    CVE-2011-4632 · TYPO3

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  34. Medium 5.4

    CVE-2011-4631 · TYPO3

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  35. Medium 5.4

    CVE-2011-4630 · TYPO3

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  36. Medium 5.4

    CVE-2011-4629 · TYPO3

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  37. Critical 9.8

    CVE-2011-4628 · TYPO3

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  38. Medium 6.5

    CVE-2011-4627 · TYPO3

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  39. Medium 6.1

    CVE-2011-4626 · TYPO3

    Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function.

    Published 6 Nov 2019 · Fixed in 4.3.12, 4.4.9, 4.5.4 · NVD
  40. Medium 4.9

    CVE-2019-14847 · Samba

    A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.

    Published 6 Nov 2019 · Fixed in 4.9.15, 4.10.10 · NVD
  41. Medium 5.4

    CVE-2019-14833 · Samba

    A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters…

    Published 6 Nov 2019 · Fixed in 4.9.15, 4.10.10, 4.11.2 · NVD
  42. Medium 6.5

    CVE-2019-10218 · Samba

    A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the…

    Published 6 Nov 2019 · Fixed in 4.9.15, 4.10.10, 4.11.2 · NVD
  43. Critical 9.8

    CVE-2007-0899 · ClamAV

    There is a possible heap overflow in libclamav/fsg.c before 0.100.0.

    Published 6 Nov 2019 · Fixed in 0.100.0 · NVD
  44. Medium 5.3

    CVE-2019-18674 · Joomla!

    An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure.

    Published 6 Nov 2019 · Fixed in 3.9.13 · NVD
  45. High 8.8

    CVE-2019-18650 · Joomla!

    An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.

    Published 6 Nov 2019 · NVD
  46. Critical 9.8

    CVE-2019-8158 · Magento / Adobe Commerce

    An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.

    Published 6 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  47. Medium 5.4

    CVE-2019-8157 · Magento / Adobe Commerce

    A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization.

    Published 6 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  48. High 7.2

    CVE-2019-8156 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.

    Published 6 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  49. Medium 5.4

    CVE-2019-8145 · Magento / Adobe Commerce

    A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products.

    Published 6 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD
  50. Medium 5.4

    CVE-2019-8132 · Magento / Adobe Commerce

    A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft malicious payload in the template Name field for Email template in the "Design Configuration" dashboard.

    Published 6 Nov 2019 · Fixed in 2.2.10, 2.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.