UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,866
Published in 7 days
987
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,866 vulnerabilities
  1. High 7.5

    CVE-2019-16884 · Docker Engine, runc

    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

    Published 25 Sept 2019 · NVD
  2. Medium 6.1

    CVE-2019-10098 · Apache HTTP Server

    In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

    Published 25 Sept 2019 · NVD
  3. High 8.8

    CVE-2019-16701 · pfSense

    pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.

    Published 25 Sept 2019 · Fixed in 2.4.4 · NVD
  4. Medium 4.8

    CVE-2019-10406 · Jenkins

    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.

    Published 25 Sept 2019 · NVD
  5. Medium 5.4

    CVE-2019-10405 · Jenkins

    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

    Published 25 Sept 2019 · NVD
  6. Medium 5.4

    CVE-2019-10404 · Jenkins

    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.

    Published 25 Sept 2019 · NVD
  7. Medium 5.4

    CVE-2019-10403 · Jenkins

    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.

    Published 25 Sept 2019 · NVD
  8. Medium 5.4

    CVE-2019-10402 · Jenkins

    In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.

    Published 25 Sept 2019 · NVD
  9. Medium 5.4

    CVE-2019-10401 · Jenkins

    In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).

    Published 25 Sept 2019 · NVD
  10. Critical 9.8Actively exploited

    CVE-2019-16759 · vBulletin

    vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

    Published 24 Sept 2019 · NVD
  11. Medium 6.1

    CVE-2019-16725 · Joomla!

    In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.

    Published 24 Sept 2019 · Fixed in 3.9.12 · NVD
  12. Medium 4.9

    CVE-2019-15635 · Grafana

    An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save…

    Published 23 Sept 2019 · NVD
  13. Medium 6.5

    CVE-2019-16713 · ImageMagick

    ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c.

    Published 23 Sept 2019 · NVD
  14. Medium 6.5

    CVE-2019-16712 · ImageMagick

    ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.

    Published 23 Sept 2019 · NVD
  15. Medium 6.5

    CVE-2019-16711 · ImageMagick

    ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.

    Published 23 Sept 2019 · NVD
  16. Medium 6.5

    CVE-2019-16710 · ImageMagick

    ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.

    Published 23 Sept 2019 · NVD
  17. Medium 6.5

    CVE-2019-16709 · ImageMagick

    ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.

    Published 23 Sept 2019 · NVD
  18. Medium 6.5

    CVE-2019-16708 · ImageMagick

    ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.

    Published 23 Sept 2019 · NVD
  19. Critical 9.8

    CVE-2018-21018 · Mastodon

    Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.

    Published 22 Sept 2019 · Fixed in 2.6.3 · NVD
  20. Critical 9.1

    CVE-2019-6649 · F5 BIG-IP

    F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.

    Published 20 Sept 2019 · NVD
  21. Critical 9.6

    CVE-2019-5521 · VMware ESXi

    VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6) and Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain an out-of-bounds read vulnerability in the pixel shader functionality. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to…

    Published 20 Sept 2019 · NVD
  22. Medium 6.1

    CVE-2018-11200 · Mautic

    XSS vulnerability in company name field

    Published 20 Sept 2019 · Fixed in 2.11.0 · NVD, Project advisories (GitHub)
  23. Medium 5.3

    CVE-2019-4505 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364.

    Published 20 Sept 2019 · NVD
  24. High 7.2

    CVE-2019-15001 · Jira

    The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.

    Published 19 Sept 2019 · Fixed in 8.1.3, 8.2.5, 8.3.4 · NVD
  25. Medium 6.5

    CVE-2019-3740 · Oracle WebLogic Server

    RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

    Published 18 Sept 2019 · NVD
  26. Medium 6.5

    CVE-2019-3739 · Oracle WebLogic Server

    RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.

    Published 18 Sept 2019 · NVD
  27. Medium 5.4

    CVE-2019-5531 · VMware vCenter Server, VMware ESXi

    VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a…

    Published 18 Sept 2019 · NVD
  28. High 7.7

    CVE-2019-5534 · VMware vCenter Server

    VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the…

    Published 18 Sept 2019 · NVD
  29. High 7.7

    CVE-2019-5532 · VMware vCenter Server

    VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter OVF-properties of a virtual machine deployed from an OVF may be able to view the credentials used to…

    Published 18 Sept 2019 · NVD
  30. Medium 5.3

    CVE-2019-16394 · SPIP

    SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers.

    Published 17 Sept 2019 · Fixed in 3.1.11, 3.2.5 · NVD
  31. Medium 6.1

    CVE-2019-16393 · SPIP

    SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.

    Published 17 Sept 2019 · Fixed in 3.1.11, 3.2.5 · NVD
  32. Medium 6.1

    CVE-2019-16392 · SPIP

    SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.

    Published 17 Sept 2019 · Fixed in 3.1.11, 3.2.5 · NVD
  33. Medium 6.5

    CVE-2019-16391 · SPIP

    SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.

    Published 17 Sept 2019 · Fixed in 3.1.11, 3.2.5 · NVD
  34. Medium 6.5

    CVE-2019-4477 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handling of command line options. IBM X-Force ID: 163997.

    Published 17 Sept 2019 · NVD
  35. Medium 4.3

    CVE-2019-4442 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.

    Published 17 Sept 2019 · NVD
  36. Low 3.5

    CVE-2019-4271 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243.

    Published 17 Sept 2019 · NVD
  37. Medium 5.4

    CVE-2019-4270 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160203.

    Published 17 Sept 2019 · NVD
  38. Medium 5.3

    CVE-2019-4268 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 160201.

    Published 17 Sept 2019 · NVD
  39. High 7.5

    CVE-2019-15729 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.

    Published 17 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  40. Medium 6.5

    CVE-2016-10983 · Ghost

    The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.

    Published 17 Sept 2019 · Fixed in 0.5.6 · NVD
  41. Critical 9.8

    CVE-2019-5482 · curl, MySQL

    Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

    Published 16 Sept 2019 · NVD
  42. Critical 9.8

    CVE-2019-5481 · curl, MySQL

    Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

    Published 16 Sept 2019 · NVD
  43. Medium 5.3

    CVE-2019-15740 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  44. Medium 6.1

    CVE-2019-15739 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  45. Medium 5.3

    CVE-2019-15738 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  46. Medium 6.5

    CVE-2019-15737 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  47. High 7.5

    CVE-2019-15736 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  48. Medium 4.3

    CVE-2019-15734 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  49. Medium 4.3

    CVE-2019-15733 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  50. Medium 5.3

    CVE-2019-15732 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.

    Published 16 Sept 2019 · Fixed in 12.2.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.