UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,878
Published in 7 days
996
Critical in 30 days
359
Actively exploited
423

Latest vulnerabilities

39,878 vulnerabilities
  1. Medium 4.8

    CVE-2019-10383 · Jenkins

    A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

    Published 28 Aug 2019 · NVD
  2. Medium 6.1

    CVE-2015-9360 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 28 Aug 2019 · Fixed in 1.9.64 · NVD, WPVulnerability
  3. Medium 6.1

    CVE-2019-15700 · Frappe Framework

    public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.

    Published 27 Aug 2019 · NVD
  4. Medium 6.5

    CVE-2019-15055 · MikroTik RouterOS

    MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator without authentication.

    Published 26 Aug 2019 · NVD
  5. High 8.8

    CVE-2019-15642 · Webmin

    rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

    Published 26 Aug 2019 · NVD
  6. Medium 6.5

    CVE-2019-15641 · Webmin

    xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.

    Published 26 Aug 2019 · NVD
  7. Medium 6.5

    CVE-2019-15515 · Discourse

    Discourse 2.3.2 sends the CSRF token in the query string.

    Published 26 Aug 2019 · NVD
  8. High 7.5

    CVE-2019-15640 · LimeSurvey

    Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.

    Published 26 Aug 2019 · Fixed in 3.17.10 · NVD
  9. Medium 6.1

    CVE-2016-6154 · WatchGuard Fireware OS

    The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).

    Published 23 Aug 2019 · NVD
  10. Medium 5.5

    CVE-2019-12400 · Oracle WebLogic Server

    In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to…

    Published 23 Aug 2019 · NVD
  11. Medium 5.3

    CVE-2018-13367 · Fortinet FortiOS

    An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI.

    Published 23 Aug 2019 · NVD
  12. High 7.2

    CVE-2019-1582 · Palo Alto Networks PAN-OS

    Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.

    Published 23 Aug 2019 · NVD
  13. Critical 9.8

    CVE-2019-1581 · Palo Alto Networks PAN-OS

    A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4.

    Published 23 Aug 2019 · NVD
  14. Critical 9.8

    CVE-2019-1580 · Palo Alto Networks PAN-OS

    Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory.

    Published 23 Aug 2019 · NVD
  15. Medium 4.3

    CVE-2019-8447 · Jira

    The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.

    Published 23 Aug 2019 · Fixed in 8.3.2 · NVD
  16. Medium 5.3

    CVE-2019-8446 · Jira

    The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.

    Published 23 Aug 2019 · Fixed in 8.3.2 · NVD
  17. Medium 5.3

    CVE-2019-8445 · Jira

    Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.

    Published 23 Aug 2019 · Fixed in 7.13.7, 8.3.2 · NVD
  18. Medium 5.4

    CVE-2019-8444 · Jira

    The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification.

    Published 23 Aug 2019 · Fixed in 7.13.6, 8.3.2 · NVD
  19. Medium 6.1

    CVE-2019-11589 · Jira

    The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability.

    Published 23 Aug 2019 · Fixed in 7.13.6, 8.2.3, 8.3.2 · NVD
  20. Medium 4.3

    CVE-2019-11588 · Jira

    The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.

    Published 23 Aug 2019 · Fixed in 7.13.6, 8.2.3, 8.3.2 · NVD
  21. Medium 6.5

    CVE-2019-11587 · Jira

    Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).

    Published 23 Aug 2019 · Fixed in 7.13.6, 8.2.3, 8.3.2 · NVD
  22. Medium 4.3

    CVE-2019-11586 · Jira

    The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.

    Published 23 Aug 2019 · Fixed in 7.13.6, 8.2.3, 8.3.2 · NVD
  23. Medium 6.1

    CVE-2019-11585 · Jira

    The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

    Published 23 Aug 2019 · Fixed in 7.13.6, 8.2.3, 8.3.2 · NVD
  24. Medium 6.1

    CVE-2019-11584 · Jira

    The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.

    Published 23 Aug 2019 · Fixed in 8.3.2 · NVD
  25. High 8.4

    CVE-2019-13139 · Docker Engine

    In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build"…

    Published 22 Aug 2019 · Fixed in 18.09.4 · NVD
  26. Medium 5.4

    CVE-2019-14469 · Sonatype Nexus Repository

    In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.

    Published 22 Aug 2019 · NVD
  27. Medium 5.4

    CVE-2019-13476 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.

    Published 21 Aug 2019 · NVD
  28. Medium 5.3

    CVE-2019-13599 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.

    Published 21 Aug 2019 · NVD
  29. High 8.8

    CVE-2019-13477 · Control Web Panel

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.

    Published 21 Aug 2019 · NVD
  30. High 7.3

    CVE-2019-10086 · Oracle WebLogic Server

    In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

    Published 20 Aug 2019 · NVD
  31. High 7.4

    CVE-2019-15237 · Roundcube

    Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.

    Published 20 Aug 2019 · NVD
  32. High 7.5

    CVE-2019-15225 · Envoy

    In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.

    Published 19 Aug 2019 · NVD
  33. Medium 6.5

    CVE-2019-15141 · ImageMagick

    WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for…

    Published 18 Aug 2019 · NVD
  34. High 8.8

    CVE-2019-15140 · ImageMagick

    coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.

    Published 18 Aug 2019 · NVD
  35. Medium 6.5

    CVE-2019-15139 · ImageMagick

    The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.

    Published 18 Aug 2019 · NVD
  36. Medium 5.3

    CVE-2019-15132 · Zabbix

    Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.

    Published 17 Aug 2019 · NVD
  37. Critical 9.8

    CVE-2019-7964 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability. Successful exploitation could lead to remote code execution.

    Published 16 Aug 2019 · NVD
  38. Critical 9.8Actively exploited

    CVE-2019-15107 · Webmin

    An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

    Published 16 Aug 2019 · NVD
  39. High 7.5

    CVE-2019-10081 · Apache HTTP Server

    HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

    Published 15 Aug 2019 · NVD
  40. Medium 5.3

    CVE-2018-14672 · ClickHouse

    In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.

    Published 15 Aug 2019 · Fixed in 18.12.13 · NVD
  41. Critical 9.8

    CVE-2018-14671 · ClickHouse

    In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.

    Published 15 Aug 2019 · Fixed in 18.10.3 · NVD
  42. Critical 9.8

    CVE-2018-14670 · ClickHouse

    Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.

    Published 15 Aug 2019 · Fixed in 1.1.54131 · NVD
  43. High 7.5

    CVE-2018-14669 · ClickHouse

    ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.

    Published 15 Aug 2019 · Fixed in 1.1.54390 · NVD
  44. High 8.8

    CVE-2018-14668 · ClickHouse

    In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.

    Published 15 Aug 2019 · Fixed in 1.1.54388 · NVD
  45. High 7.5

    CVE-2019-12854 · Squid

    Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

    Published 15 Aug 2019 · NVD
  46. Medium 4.8

    CVE-2019-15081 · OpenCart

    OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.

    Published 15 Aug 2019 · NVD
  47. High 8.0

    CVE-2019-15062 · Dolibarr ERP CRM

    An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this…

    Published 14 Aug 2019 · NVD
  48. Medium 5.3

    CVE-2019-15028 · Joomla!

    In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.

    Published 14 Aug 2019 · Fixed in 3.9.11 · NVD
  49. High 7.5

    CVE-2019-9518 · Apache Traffic Server, Node.js

    Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD
  50. High 7.5

    CVE-2019-9517 · Apache HTTP Server, Apache Traffic Server, Node.js

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending…

    Published 13 Aug 2019 · Fixed in 8.16.1, 10.16.3, 12.8.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.