UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,878
Published in 7 days
998
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,878 vulnerabilities
  1. Medium 4.3

    CVE-2019-14997 · Jira

    The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN.

    Published 11 Sept 2019 · Fixed in 8.4.0 · NVD
  2. Medium 6.1

    CVE-2019-14996 · Jira

    The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

    Published 11 Sept 2019 · Fixed in 7.13.7, 8.3.3 · NVD
  3. Medium 5.3

    CVE-2019-14995 · Jira

    The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

    Published 11 Sept 2019 · Fixed in 8.4.0 · NVD
  4. Medium 4.3

    CVE-2019-14725 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.

    Published 11 Sept 2019 · NVD
  5. High 7.5

    CVE-2019-14724 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account.

    Published 11 Sept 2019 · NVD
  6. Low 3.7

    CVE-2019-1563 · OpenSSL

    In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected…

    Published 10 Sept 2019 · NVD
  7. Medium 5.3

    CVE-2019-1549 · OpenSSL

    OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the…

    Published 10 Sept 2019 · NVD
  8. Medium 4.7

    CVE-2019-1547 · OpenSSL

    Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If…

    Published 10 Sept 2019 · NVD
  9. Medium 4.3

    CVE-2019-14730 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account.

    Published 10 Sept 2019 · NVD
  10. Medium 4.3

    CVE-2019-14729 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account.

    Published 10 Sept 2019 · NVD
  11. Medium 4.3

    CVE-2019-14728 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account.

    Published 10 Sept 2019 · NVD
  12. Medium 4.3

    CVE-2019-14727 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account.

    Published 10 Sept 2019 · NVD
  13. Medium 5.4

    CVE-2019-14726 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account.

    Published 10 Sept 2019 · NVD
  14. Medium 4.3

    CVE-2019-14723 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account.

    Published 10 Sept 2019 · NVD
  15. Medium 4.3

    CVE-2019-14722 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account.

    Published 10 Sept 2019 · NVD
  16. Medium 6.5

    CVE-2019-14721 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account.

    Published 10 Sept 2019 · NVD
  17. High 7.5

    CVE-2019-12401 · Apache Solr

    Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.

    Published 10 Sept 2019 · NVD
  18. Low 3.7

    CVE-2019-7176 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.

    Published 9 Sept 2019 · Fixed in 11.5.9, 11.6.7, 11.7.2 · NVD
  19. Medium 6.5

    CVE-2019-6791 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  20. High 7.5

    CVE-2019-16187 · LimeSurvey

    Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  21. High 7.2

    CVE-2019-16186 · LimeSurvey

    In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  22. High 7.2

    CVE-2019-16185 · LimeSurvey

    In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  23. Critical 9.8

    CVE-2019-16184 · LimeSurvey

    A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  24. Low 2.7

    CVE-2019-16183 · LimeSurvey

    In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  25. Medium 6.1

    CVE-2019-16182 · LimeSurvey

    A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  26. Low 2.7

    CVE-2019-16181 · LimeSurvey

    In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  27. Medium 5.3

    CVE-2019-16180 · LimeSurvey

    Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  28. Medium 5.3

    CVE-2019-16179 · LimeSurvey

    Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  29. Medium 5.4

    CVE-2019-16178 · LimeSurvey

    A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  30. High 7.5

    CVE-2019-16177 · LimeSurvey

    In Limesurvey before 3.17.14, the entire database is exposed through browser caching.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  31. Medium 5.3

    CVE-2019-16176 · LimeSurvey

    A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  32. Medium 4.3

    CVE-2019-16175 · LimeSurvey

    A clickjacking vulnerability was found in Limesurvey before 3.17.14.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  33. High 8.8

    CVE-2019-16174 · LimeSurvey

    An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity.

    Published 9 Sept 2019 · Fixed in 3.17.14 · NVD
  34. Medium 6.1

    CVE-2019-16147 · Liferay Portal / DXP

    Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.

    Published 9 Sept 2019 · Fixed in 7.2.0 · NVD
  35. Medium 4.3

    CVE-2019-6997 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  36. Medium 4.3

    CVE-2019-6996 · GitLab

    An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  37. Medium 6.5

    CVE-2019-6995 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  38. Critical 9.8

    CVE-2019-6960 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  39. Medium 5.4

    CVE-2019-6795 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social engineering.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  40. Medium 4.3

    CVE-2019-6794 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 5 of 6). A project guest user can view the last commit status of the default branch.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  41. High 7.0

    CVE-2019-6793 · GitLab

    An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  42. Medium 5.3

    CVE-2019-6792 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  43. Medium 4.3

    CVE-2019-6789 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 4 of 6). In some cases, users without project permissions will receive emails after a project move. For private projects, this will disclose the new project namespace to an unauthorized user.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  44. High 7.5

    CVE-2019-6788 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 3 of 6). For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  45. Medium 6.5

    CVE-2019-6786 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  46. Medium 6.5

    CVE-2019-6785 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  47. Medium 6.1

    CVE-2019-6784 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  48. High 8.8

    CVE-2019-6783 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  49. High 7.5

    CVE-2019-6782 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 1 of 6). An authorization issue allows the contributed project information of a private profile to be viewed.

    Published 9 Sept 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  50. Medium 5.4

    CVE-2019-16173 · LimeSurvey

    LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,

    Published 9 Sept 2019 · Fixed in 3.17.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.