UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,878
Published in 7 days
999
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,878 vulnerabilities
  1. High 7.5

    CVE-2019-15729 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.

    Published 17 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  2. Medium 6.5

    CVE-2016-10983 · Ghost

    The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.

    Published 17 Sept 2019 · Fixed in 0.5.6 · NVD
  3. Critical 9.8

    CVE-2019-5482 · curl, MySQL

    Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

    Published 16 Sept 2019 · NVD
  4. Critical 9.8

    CVE-2019-5481 · curl, MySQL

    Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

    Published 16 Sept 2019 · NVD
  5. Medium 5.3

    CVE-2019-15740 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  6. Medium 6.1

    CVE-2019-15739 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  7. Medium 5.3

    CVE-2019-15738 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  8. Medium 6.5

    CVE-2019-15737 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  9. High 7.5

    CVE-2019-15736 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  10. Medium 4.3

    CVE-2019-15734 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  11. Medium 4.3

    CVE-2019-15733 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  12. Medium 5.3

    CVE-2019-15732 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.

    Published 16 Sept 2019 · Fixed in 12.2.3 · NVD
  13. Medium 5.3

    CVE-2019-15731 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  14. High 7.5

    CVE-2019-15730 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  15. High 7.5

    CVE-2019-15728 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  16. Medium 5.3

    CVE-2019-15727 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  17. Medium 5.3

    CVE-2019-15726 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  18. High 7.5

    CVE-2019-15725 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  19. Medium 6.1

    CVE-2019-15724 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  20. Medium 5.3

    CVE-2019-15723 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations.

    Published 16 Sept 2019 · Fixed in 11.10.1 · NVD
  21. High 7.5

    CVE-2019-15722 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  22. Medium 5.4

    CVE-2019-15721 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings.

    Published 16 Sept 2019 · Fixed in 12.0.8, 12.1.8, 12.2.3 · NVD
  23. Medium 6.1

    CVE-2019-16197 · Dolibarr ERP CRM

    In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.

    Published 16 Sept 2019 · NVD
  24. High 7.1

    CVE-2019-16170 · GitLab

    An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Control.

    Published 16 Sept 2019 · Fixed in 12.0.9, 12.1.9, 12.2.5 · NVD
  25. Critical 9.8

    CVE-2019-16335 · Oracle WebLogic Server

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

    Published 15 Sept 2019 · NVD
  26. Critical 9.8

    CVE-2019-14540 · MySQL, Oracle WebLogic Server

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

    Published 15 Sept 2019 · NVD
  27. High 8.8

    CVE-2019-16318 · Pimcore

    In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.

    Published 14 Sept 2019 · Fixed in 5.7.1 · NVD
  28. High 8.8

    CVE-2019-16317 · Pimcore

    In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.

    Published 14 Sept 2019 · Fixed in 5.7.1 · NVD
  29. High 7.2

    CVE-2019-5315 · HPE ArubaOS

    A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. This vulnerability only affects ArubaOS 8.x.

    Published 13 Sept 2019 · Fixed in 8.3.0.0 · NVD
  30. Medium 6.1

    CVE-2019-5314 · HPE ArubaOS

    Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. An attacker would be able to accomplish this by sending certain URL parameters that would trigger this vulnerability.

    Published 13 Sept 2019 · Fixed in 6.5.4.11, 8.2.1.0, 8.3.0.0 · NVD
  31. Critical 9.8

    CVE-2018-7081 · HPE ArubaOS

    A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete…

    Published 13 Sept 2019 · Fixed in 8.3.0.7, 8.4.0.3, 8.5.0.0 · NVD
  32. Medium 6.5

    CVE-2019-12922 · phpMyAdmin

    A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

    Published 13 Sept 2019 · NVD
  33. High 8.8

    CVE-2019-1302 · .NET

    An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

    Published 11 Sept 2019 · NVD
  34. Medium 6.1

    CVE-2019-1266 · Microsoft Exchange Server

    A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.

    Published 11 Sept 2019 · NVD
  35. High 7.5

    CVE-2019-1233 · Microsoft Exchange Server

    A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'.

    Published 11 Sept 2019 · NVD
  36. Critical 9.8

    CVE-2019-10074 · Apache OFBiz

    An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the…

    Published 11 Sept 2019 · NVD
  37. Medium 6.1

    CVE-2019-10073 · Apache OFBiz

    The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616

    Published 11 Sept 2019 · NVD
  38. Critical 9.8

    CVE-2019-0189 · Apache OFBiz

    The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies:…

    Published 11 Sept 2019 · Fixed in 16.11.06 · NVD
  39. Critical 9.8

    CVE-2018-17200 · Apache OFBiz

    The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in…

    Published 11 Sept 2019 · NVD
  40. Medium 6.5

    CVE-2019-8451 · Jira

    The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

    Published 11 Sept 2019 · Fixed in 8.4.0 · NVD
  41. Medium 4.8

    CVE-2019-8450 · Jira

    Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field.

    Published 11 Sept 2019 · Fixed in 7.13.6, 8.4.0 · NVD
  42. Medium 5.3

    CVE-2019-8449 · Jira

    The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

    Published 11 Sept 2019 · Fixed in 8.4.0 · NVD
  43. Medium 5.4

    CVE-2019-16223 · WordPress

    WordPress before 5.2.3 allows XSS in post previews by authenticated users.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  44. Medium 6.1

    CVE-2019-16222 · WordPress

    WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  45. Medium 6.1

    CVE-2019-16221 · WordPress

    WordPress before 5.2.3 allows reflected XSS in the dashboard.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  46. Medium 6.1

    CVE-2019-16220 · WordPress

    In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  47. Medium 6.1

    CVE-2019-16219 · WordPress

    WordPress before 5.2.3 allows XSS in shortcode previews.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  48. Medium 6.1

    CVE-2019-16218 · WordPress

    WordPress before 5.2.3 allows XSS in stored comments.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  49. Medium 6.1

    CVE-2019-16217 · WordPress

    WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  50. Medium 6.5

    CVE-2019-14998 · Jira

    The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance.

    Published 11 Sept 2019 · Fixed in 8.4.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.