UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,847
Published in 7 days
982
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,847 vulnerabilities
  1. Medium 5.3

    CVE-2019-18366 · TeamCity

    In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.

    Published 31 Oct 2019 · Fixed in 2019.1.2 · NVD
  2. Medium 4.3

    CVE-2019-18365 · TeamCity

    In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

    Published 31 Oct 2019 · Fixed in 2019.1.4 · NVD
  3. Critical 9.8

    CVE-2019-18364 · TeamCity

    In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.

    Published 31 Oct 2019 · Fixed in 2019.1.4 · NVD
  4. Medium 5.3

    CVE-2019-18363 · TeamCity

    In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.

    Published 31 Oct 2019 · Fixed in 2019.1.2 · NVD
  5. Critical 9.8

    CVE-2019-18425 · Xen

    An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise…

    Published 31 Oct 2019 · NVD
  6. Medium 6.8

    CVE-2019-18424 · Xen

    An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary…

    Published 31 Oct 2019 · NVD
  7. High 8.8

    CVE-2019-18423 · Xen

    An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The…

    Published 31 Oct 2019 · NVD
  8. High 8.8

    CVE-2019-18422 · Xen

    An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry.…

    Published 31 Oct 2019 · NVD
  9. High 7.5

    CVE-2019-18421 · Xen

    An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these…

    Published 31 Oct 2019 · NVD
  10. Medium 6.5

    CVE-2019-18420 · Xen

    An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has…

    Published 31 Oct 2019 · NVD
  11. Medium 4.3

    CVE-2019-16251 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 31 Oct 2019 · Fixed in 2.2.14 · WPVulnerability
  12. Medium 4.8

    CVE-2019-12417 · Apache Airflow

    A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

    Published 30 Oct 2019 · NVD
  13. Medium 5.3

    CVE-2019-7619 · Elasticsearch

    Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.

    Published 30 Oct 2019 · NVD
  14. High 7.5

    CVE-2018-5742 · BIND 9

    While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected.

    Published 30 Oct 2019 · NVD
  15. Medium 6.5

    CVE-2019-8235 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.

    Published 30 Oct 2019 · Fixed in 2.1.17, 2.2.8, 2.3.1 · NVD
  16. High 7.5

    CVE-2019-3979 · MikroTik RouterOS

    RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's DNS cache via malicious responses with additional and untrue records.

    Published 29 Oct 2019 · NVD
  17. High 7.5

    CVE-2019-3978 · MikroTik RouterOS

    RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning

    Published 29 Oct 2019 · NVD
  18. High 7.5

    CVE-2019-3977 · MikroTik RouterOS

    RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.

    Published 29 Oct 2019 · NVD
  19. High 8.8

    CVE-2019-3976 · MikroTik RouterOS

    RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled.

    Published 29 Oct 2019 · NVD
  20. Critical 9.8

    CVE-2019-10211 · PostgreSQL

    Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.

    Published 29 Oct 2019 · Fixed in 9.6.15, 10.10, 11.5 · NVD
  21. High 7.0

    CVE-2019-10210 · PostgreSQL

    Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.

    Published 29 Oct 2019 · Fixed in 9.6.15, 10.10, 11.5 · NVD
  22. Low 2.2

    CVE-2019-10209 · PostgreSQL

    Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.

    Published 29 Oct 2019 · Fixed in 11.5 · NVD
  23. High 8.8

    CVE-2019-10208 · PostgreSQL

    A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

    Published 29 Oct 2019 · Fixed in 9.6.15, 10.10, 11.5 · NVD
  24. High 7.5

    CVE-2012-0046 · MediaWiki

    mediawiki allows deleted text to be exposed

    Published 29 Oct 2019 · Fixed in 1.17.2, 1.18.1 · NVD
  25. High 8.8

    CVE-2019-17661 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Injection

    Published 29 Oct 2019 · WPVulnerability
  26. Medium 5.9

    CVE-2019-5538 · VMware vCenter Server

    Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over SCP. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance and a…

    Published 28 Oct 2019 · NVD
  27. Medium 5.9

    CVE-2019-5537 · VMware vCenter Server

    Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance (6.7 before 6.7u3a and 6.5 before 6.5u3d) may allow a malicious actor to intercept sensitive data in transit over FTPS and HTTPS. A malicious actor with man-in-the-middle positioning between vCenter Server Appliance…

    Published 28 Oct 2019 · NVD
  28. Medium 6.5

    CVE-2019-5536 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. Exploitation of this issue require…

    Published 28 Oct 2019 · NVD
  29. Critical 9.8Actively exploited

    CVE-2019-11043 · PHP

    In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

    Published 28 Oct 2019 · Fixed in 7.1.33, 7.2.24, 7.3.11 · NVD
  30. Critical 9.9

    CVE-2020-7055 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 28 Oct 2019 · Fixed in 2.7.5 · WPVulnerability
  31. Medium 6.5

    CVE-2019-8234 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  32. Critical 9.8

    CVE-2019-8088 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 25 Oct 2019 · NVD
  33. High 7.5

    CVE-2019-8087 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  34. High 7.5

    CVE-2019-8086 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  35. Medium 6.1

    CVE-2019-8085 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  36. Medium 6.1

    CVE-2019-8084 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  37. Medium 6.1

    CVE-2019-8083 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  38. High 7.5

    CVE-2019-8082 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  39. High 7.5

    CVE-2019-8081 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 25 Oct 2019 · NVD
  40. Medium 6.1

    CVE-2019-8080 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.

    Published 24 Oct 2019 · NVD
  41. Medium 6.1

    CVE-2019-8079 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 24 Oct 2019 · NVD
  42. Medium 6.1

    CVE-2019-8078 · Adobe Experience Manager

    Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Published 24 Oct 2019 · NVD
  43. Critical 9.8

    CVE-2019-15929 · Craft CMS

    In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.

    Published 24 Oct 2019 · NVD
  44. High 7.5

    CVE-2019-15703 · Fortinet FortiOS

    An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only.

    Published 24 Oct 2019 · Fixed in 6.0.9, 6.2.3 · NVD
  45. Medium 6.1

    CVE-2019-18348 · Python

    An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947…

    Published 23 Oct 2019 · Fixed in 3.6.11, 3.7.8, 3.8.3 · NVD
  46. High 7.5

    CVE-2019-18277 · HAProxy

    A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the…

    Published 23 Oct 2019 · Fixed in 2.0.6 · NVD
  47. High 7.5

    CVE-2019-10079 · Apache Traffic Server

    Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.

    Published 22 Oct 2019 · Fixed in 7.1.7, 8.0.4 · NVD
  48. Medium 6.1

    CVE-2019-17220 · Rocket.Chat

    Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.

    Published 21 Oct 2019 · Fixed in 2.1.0 · NVD
  49. High 7.2

    CVE-2019-16530 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.

    Published 21 Oct 2019 · NVD
  50. High 7.5

    CVE-2019-18217 · ProFTPD

    ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.

    Published 21 Oct 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.