UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,891
Published in 7 days
1,005
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,891 vulnerabilities
  1. High 8.8

    CVE-2019-12527 · Squid

    An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

    Published 11 Jul 2019 · NVD
  2. Critical 9.8

    CVE-2019-12525 · Squid

    An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is…

    Published 11 Jul 2019 · NVD
  3. Medium 6.5

    CVE-2019-12470 · MediaWiki

    Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  4. Medium 6.5

    CVE-2019-12469 · MediaWiki

    MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  5. High 7.5

    CVE-2018-19584 · GitLab

    GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  6. Medium 6.5

    CVE-2018-19583 · GitLab

    GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  7. Medium 4.3

    CVE-2018-19582 · GitLab

    GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.

    Published 10 Jul 2019 · Fixed in 11.4.8, 11.5.1 · NVD
  8. High 7.5

    CVE-2018-19581 · GitLab

    GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user to set the weight of an issue they create.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  9. Medium 5.3

    CVE-2018-19580 · GitLab

    All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  10. Medium 5.4

    CVE-2018-19579 · GitLab

    GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1.

    Published 10 Jul 2019 · Fixed in 11.5.1 · NVD
  11. Medium 6.5

    CVE-2018-19578 · GitLab

    GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page.

    Published 10 Jul 2019 · Fixed in 11.5.1 · NVD
  12. High 7.7

    CVE-2018-19571 · GitLab

    GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  13. High 7.5

    CVE-2019-12474 · MediaWiki

    Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  14. High 7.5

    CVE-2019-12473 · MediaWiki

    Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  15. High 7.5

    CVE-2019-12472 · MediaWiki

    An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  16. Medium 6.1

    CVE-2019-12471 · MediaWiki

    Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  17. High 8.8

    CVE-2019-12466 · MediaWiki

    Wikimedia MediaWiki through 1.32.1 allows CSRF.

    Published 10 Jul 2019 · NVD
  18. High 8.1

    CVE-2018-19576 · GitLab

    GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  19. Medium 4.3

    CVE-2018-19575 · GitLab

    GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  20. Medium 5.4

    CVE-2018-19574 · GitLab

    GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  21. Medium 5.4

    CVE-2018-19573 · GitLab

    GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  22. Medium 5.9

    CVE-2018-19572 · GitLab

    GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  23. Medium 5.4

    CVE-2018-19570 · GitLab

    GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  24. High 8.8

    CVE-2018-19569 · GitLab

    GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  25. Critical 9.8

    CVE-2019-12468 · MediaWiki

    An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.

    Published 10 Jul 2019 · NVD
  26. Medium 5.3

    CVE-2019-12467 · MediaWiki

    MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

    Published 10 Jul 2019 · Fixed in 1.30.2, 1.31.2, 1.32.2 · NVD
  27. Medium 5.3

    CVE-2018-19577 · GitLab

    Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability that displays to an unauthorized user the title and namespace of a confidential issue.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  28. Medium 6.5

    CVE-2018-19496 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  29. Medium 6.5

    CVE-2018-19495 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerability in the Prometheus integration.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  30. Medium 4.3

    CVE-2018-19494 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  31. Medium 6.1

    CVE-2018-19493 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding.

    Published 10 Jul 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  32. High 7.5

    CVE-2017-7189 · PHP

    main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname…

    Published 10 Jul 2019 · Fixed in 7.0.16 · NVD
  33. Medium 5.9

    CVE-2019-13240 · GLPI

    An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.

    Published 10 Jul 2019 · Fixed in 9.4.1 · NVD
  34. Critical 9.8

    CVE-2019-13224 · PHP

    A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as…

    Published 10 Jul 2019 · Fixed in 7.1.32, 7.2.23, 7.3.9 · NVD
  35. Medium 4.8

    CVE-2018-17147 · Nagios XI

    Nagios XI before 5.5.4 has XSS in the auto login admin management page.

    Published 10 Jul 2019 · Fixed in 5.5.4 · NVD
  36. Critical 9.8

    CVE-2019-11512 · Contao

    Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.

    Published 9 Jul 2019 · Fixed in 4.4.39, 4.7.5 · NVD
  37. High 7.5

    CVE-2019-13461 · PrestaShop

    In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.

    Published 9 Jul 2019 · NVD
  38. Medium 6.5

    CVE-2019-13454 · ImageMagick

    ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.

    Published 9 Jul 2019 · NVD
  39. Medium 6.1

    CVE-2019-12748 · TYPO3

    TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.

    Published 9 Jul 2019 · NVD
  40. High 8.8

    CVE-2019-12747 · TYPO3

    TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.

    Published 9 Jul 2019 · NVD
  41. Critical 9.8

    CVE-2019-13478 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 9 Jul 2019 · Fixed in 11.6 · NVD, WPVulnerability
  42. High 7.5

    CVE-2019-9630 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.

    Published 8 Jul 2019 · Fixed in 3.17.0 · NVD
  43. Critical 9.8

    CVE-2019-9629 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).

    Published 8 Jul 2019 · Fixed in 3.17.0 · NVD
  44. High 7.8

    CVE-2019-13404 · Python

    The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that…

    Published 8 Jul 2019 · Fixed in 3.5.0 · NVD
  45. High 8.8

    CVE-2019-13391 · ImageMagick

    In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.

    Published 7 Jul 2019 · NVD
  46. Medium 6.5

    CVE-2019-13390 · FFmpeg

    In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.

    Published 7 Jul 2019 · NVD
  47. Unrated

    WPV-fc722ffc6366 · WooCommerce

    Vulnerability in WooCommerce

    Published 7 Jul 2019 · Fixed in 3.6.5 · WPVulnerability
  48. High 7.5

    CVE-2018-14733 · Odoo

    The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under certain circumstances.

    Published 5 Jul 2019 · NVD
  49. Medium 6.1

    CVE-2019-13345 · Squid

    The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.

    Published 5 Jul 2019 · NVD
  50. High 8.8

    CVE-2019-13312 · FFmpeg

    block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.

    Published 5 Jul 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.