Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,866
- Published in 7 days
- 987
- Critical in 30 days
- 359
- Actively exploited
- 423
Latest vulnerabilities
39,866 vulnerabilities- High 7.5
CVE-2019-12698 · Cisco ASA and Firepower Threat Defense
A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load for a specific WebVPN HTTP page request. An attacker could exploit this vulnerability by sending…
Published 2 Oct 2019 · Fixed in 9.10.1.30, 9.12.2.9, 9.13.1 · NVD - Medium 6.1
CVE-2019-12695 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input…
Published 2 Oct 2019 · Fixed in 9.10.1.30, 9.12.2.9, 9.13.1 · NVD - Medium 4.9
CVE-2019-12693 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to the use of an incorrect data type for a length variable. An attacker could exploit this vulnerability by initiating the transfer of a large file to an affected device via SCP.…
Published 2 Oct 2019 · Fixed in 9.9.2.50, 9.10.1.22, 9.12.2.1 · NVD - High 7.5
CVE-2019-12678 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Session Initiation Protocol (SIP) inspection module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper parsing of SIP messages. An attacker could exploit this…
Published 2 Oct 2019 · Fixed in 9.9.2.56, 9.10.1.27, 9.12.2.1 · NVD - Medium 6.5
CVE-2019-12677 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition that prevents the creation of new SSL/Transport Layer Security (TLS) connections to an affected device. The vulnerability is due to incorrect handling of Base64-encoded strings. An attacker…
Published 2 Oct 2019 · Fixed in 9.4.2.11, 9.5.2.5, 9.6.2 · NVD - High 7.4
CVE-2019-12676 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Open Shortest Path First (OSPF) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software improperly parses certain…
Published 2 Oct 2019 · Fixed in 9.9.2.59, 9.10.1.27, 9.12.2.1 · NVD - High 7.5
CVE-2019-12673 · Cisco ASA and Firepower Threat Defense
A vulnerability in the FTP inspection engine of Cisco Adaptive Security (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of FTP data. An attacker could exploit this vulnerability by sending malicious FTP traffic…
Published 2 Oct 2019 · Fixed in 9.9.2.56, 9.10.1.30, 9.12.2.5 · NVD - Critical 9.8
CVE-2019-12157 · TeamCity
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
Published 2 Oct 2019 · Fixed in 2018.2.5 · NVD - Medium 4.9
CVE-2019-15035 · TeamCity
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
Published 1 Oct 2019 · NVD - Medium 6.5
CVE-2019-7618 · Kibana
A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user.
Published 1 Oct 2019 · NVD - Critical 9.8
CVE-2019-16943 · Oracle WebLogic Server
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This…
Published 1 Oct 2019 · NVD - Critical 9.8
CVE-2019-16942 · Oracle WebLogic Server
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload.…
Published 1 Oct 2019 · NVD - High 7.5
CVE-2019-15042 · TeamCity
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
Published 1 Oct 2019 · NVD - High 7.5
CVE-2019-15038 · TeamCity
An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.
Published 1 Oct 2019 · NVD - Critical 9.8
CVE-2019-15039 · TeamCity
An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.
Published 1 Oct 2019 · NVD - Medium 5.3
CVE-2019-4305 · IBM WebSphere Application Server
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.
Published 30 Sept 2019 · Fixed in 19.0.0.10 · NVD - Medium 6.3
CVE-2019-4304 · IBM WebSphere Application Server
IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950.
Published 30 Sept 2019 · Fixed in 19.0.0.10 · NVD - High 7.5
CVE-2019-16760 · Rust
Cargo prior to Rust 1.26.0 may download the wrong dependency
Published 30 Sept 2019 · Fixed in 1.26.0 · NVD, Project advisories (GitHub) - High 8.8
CVE-2019-16993 · phpBB
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Published 30 Sept 2019 · NVD - Medium 6.1
CVE-2019-16935 · Python
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.
Published 28 Sept 2019 · Fixed in 3.5.8, 3.6.10, 3.7.5 · NVD - Critical 9.8Actively exploited
CVE-2019-16928 · Exim
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
Published 27 Sept 2019 · NVD - Medium 5.4
CVE-2019-16688 · Dolibarr ERP CRM
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
Published 27 Sept 2019 · NVD - Medium 5.4
CVE-2019-16687 · Dolibarr ERP CRM
Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
Published 27 Sept 2019 · NVD - Medium 5.4
CVE-2019-16686 · Dolibarr ERP CRM
Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.
Published 27 Sept 2019 · NVD - Medium 5.4
CVE-2019-16685 · Dolibarr ERP CRM
Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.
Published 27 Sept 2019 · NVD - Critical 9.8
CVE-2019-8074 · Adobe ColdFusion
ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Path Traversal vulnerability. Successful exploitation could lead to Access Control Bypass in the context of the current user.
Published 27 Sept 2019 · NVD - Critical 9.8
CVE-2019-8073 · Adobe ColdFusion
ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user.
Published 27 Sept 2019 · NVD - High 7.5
CVE-2019-8072 · Adobe ColdFusion
ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Security bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Published 27 Sept 2019 · NVD - Medium 6.5
CVE-2019-13376 · phpBB
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
Published 27 Sept 2019 · NVD - Medium 6.1
CVE-2019-12562 · DNN Platform
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with…
Published 26 Sept 2019 · Fixed in 9.4.0 · NVD - High 8.8
CVE-2019-16667 · pfSense
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csrf_callback() produces a "CSRF token expired" error and a Try Again button when a CSRF token is missing.
Published 26 Sept 2019 · NVD - Critical 9.8
CVE-2019-16915 · pfSense
An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents.
Published 26 Sept 2019 · Fixed in 2.4.4 · NVD - Medium 6.1
CVE-2019-16914 · pfSense
An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization.
Published 26 Sept 2019 · Fixed in 2.4.4 · NVD - Medium 5.3
CVE-2019-16409 · Silverstripe CMS
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because…
Published 26 Sept 2019 · NVD - High 7.2
CVE-2019-10097 · Apache HTTP Server
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.
Published 26 Sept 2019 · NVD - Medium 6.1
CVE-2019-10092 · Apache HTTP Server
In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
Published 26 Sept 2019 · NVD - Critical 9.1
CVE-2019-10082 · Apache HTTP Server
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
Published 26 Sept 2019 · NVD - Medium 5.3
CVE-2019-14273 · Silverstripe CMS
In SilverStripe assets 4.0, there is broken access control on files.
Published 26 Sept 2019 · NVD - Medium 5.4
CVE-2019-14272 · Silverstripe CMS
In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.
Published 26 Sept 2019 · NVD - Low 2.7
CVE-2019-12617 · Silverstripe CMS
In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
Published 26 Sept 2019 · NVD - Medium 5.3
CVE-2019-16738 · MediaWiki
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.
Published 26 Sept 2019 · Fixed in 1.31.4, 1.32.4, 1.33.1 · NVD - High 7.5
CVE-2019-6656 · F5 BIG-IP
BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5. In BIG-IP APM 13.1.0 and later, the APM Clients components can be updated independently from BIG-IP software. Client…
Published 25 Sept 2019 · Fixed in 13.1.3, 14.0.0.5, 14.1.2 · NVD - High 8.8
CVE-2019-14666 · GLPI
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be…
Published 25 Sept 2019 · NVD - Medium 5.3
CVE-2019-6655 · F5 BIG-IP
On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.
Published 25 Sept 2019 · NVD - Medium 4.3
CVE-2019-6654 · F5 BIG-IP
On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering (As defined in RFC 1812 section 5.3.7) on the control plane (management interface). This may allow attackers on an adjacent system to force BIG-IP into processing packets with spoofed source addresses.
Published 25 Sept 2019 · NVD - Medium 5.3
CVE-2019-12245 · Silverstripe CMS
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Published 25 Sept 2019 · NVD - Medium 6.1
CVE-2019-12205 · Silverstripe CMS
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
Published 25 Sept 2019 · NVD - Critical 9.8
CVE-2019-12204 · Silverstripe CMS
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Published 25 Sept 2019 · NVD - Medium 6.3
CVE-2019-12203 · Silverstripe CMS
SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Published 25 Sept 2019 · NVD - Medium 5.3
CVE-2019-6651 · F5 BIG-IP
In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the Configuration utility login page may not follow best security practices when handling a malicious request.
Published 25 Sept 2019 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.