UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,908
Published in 7 days
1,022
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,908 vulnerabilities
  1. Critical 9.8

    CVE-2019-10160 · Python

    A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other…

    Published 7 Jun 2019 · Fixed in 3.5.8, 3.6.9, 3.7.4 · NVD
  2. Medium 5.3

    CVE-2019-3579 · MyBB

    MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter.

    Published 6 Jun 2019 · NVD
  3. Medium 6.1

    CVE-2019-3578 · MyBB

    MyBB 1.8.19 has XSS in the resetpassword function.

    Published 6 Jun 2019 · NVD
  4. High 8.8

    CVE-2019-12303 · Rancher

    In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.

    Published 6 Jun 2019 · NVD
  5. High 8.8

    CVE-2019-12274 · Rancher

    In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

    Published 6 Jun 2019 · NVD
  6. High 8.8

    CVE-2019-11080 · Sitecore Experience Platform

    Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

    Published 6 Jun 2019 · Fixed in 9.1.1 · NVD
  7. Critical 9.8Actively exploited

    CVE-2019-10149 · Exim

    A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

    Published 5 Jun 2019 · NVD
  8. Medium 6.5

    CVE-2019-12616 · phpMyAdmin

    An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.

    Published 5 Jun 2019 · Fixed in 4.9.0 · NVD
  9. Critical 9.8

    CVE-2019-11768 · phpMyAdmin

    An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.

    Published 5 Jun 2019 · Fixed in 4.9.0.1 · NVD
  10. Medium 6.1

    CVE-2019-5588 · Fortinet FortiOS

    A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests.

    Published 4 Jun 2019 · NVD
  11. Medium 6.5

    CVE-2019-5587 · Fortinet FortiOS

    Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs into the installing image by reassembling the image through specific methods.

    Published 4 Jun 2019 · Fixed in 6.0.5 · NVD
  12. Medium 6.1

    CVE-2019-5586 · Fortinet FortiOS

    A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.

    Published 4 Jun 2019 · NVD
  13. Medium 6.1

    CVE-2018-13384 · Fortinet FortiOS

    A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HTTP cache and subsequently redirect SSL VPN web portal users to arbitrary web domains.

    Published 4 Jun 2019 · Fixed in 6.0.5 · NVD
  14. High 7.5Actively exploited

    CVE-2018-13382 · Fortinet FortiProxy, Fortinet FortiOS

    An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

    Published 4 Jun 2019 · Fixed in 5.4.11, 5.6.9, 6.0.5 · NVD
  15. High 7.5

    CVE-2018-13381 · Fortinet FortiProxy, Fortinet FortiOS

    A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message payloads.

    Published 4 Jun 2019 · NVD
  16. Medium 6.1

    CVE-2018-13380 · Fortinet FortiProxy, Fortinet FortiOS

    A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.

    Published 4 Jun 2019 · NVD
  17. Critical 9.8Actively exploited

    CVE-2018-13379 · Fortinet FortiProxy, Fortinet FortiOS

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

    Published 4 Jun 2019 · Fixed in 5.4.13, 5.6.8, 6.0.5 · NVD
  18. Critical 9.8

    CVE-2019-12730 · FFmpeg

    aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.

    Published 4 Jun 2019 · Fixed in 3.2.14 · NVD
  19. Medium 4.7

    CVE-2019-6588 · Liferay Portal / DXP

    In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

    Published 3 Jun 2019 · NVD
  20. High 8.8

    CVE-2019-11509 · Ivanti Connect Secure

    In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.

    Published 3 Jun 2019 · NVD
  21. Critical 9.8

    CVE-2019-12585 · pfSense

    Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.

    Published 3 Jun 2019 · Fixed in 2.4.4 · NVD
  22. Medium 6.1

    CVE-2019-12584 · pfSense

    Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.

    Published 3 Jun 2019 · Fixed in 2.4.4 · NVD
  23. Critical 9.8Actively exploited

    CVE-2019-9874 · Sitecore Experience Platform

    Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

    Published 31 May 2019 · NVD
  24. High 7.5

    CVE-2019-10330 · Gitea

    Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.

    Published 31 May 2019 · NVD
  25. Medium 6.5

    CVE-2019-10324 · JFrog Artifactory

    A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.

    Published 31 May 2019 · NVD
  26. Medium 4.3

    CVE-2019-10323 · JFrog Artifactory

    A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

    Published 31 May 2019 · NVD
  27. Medium 4.3

    CVE-2019-10322 · JFrog Artifactory

    A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

    Published 31 May 2019 · NVD
  28. Medium 4.3

    CVE-2019-10321 · JFrog Artifactory

    A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

    Published 31 May 2019 · NVD
  29. Medium 6.1

    CVE-2015-7609 · Zimbra Collaboration

    Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.

    Published 30 May 2019 · NVD
  30. Medium 6.1

    CVE-2018-14425 · Zimbra Collaboration

    There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.

    Published 30 May 2019 · Fixed in 8.8.8 · NVD
  31. Medium 4.8

    CVE-2018-10948 · Zimbra Collaboration

    Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.

    Published 30 May 2019 · NVD
  32. Critical 9.8

    CVE-2019-8457 · SQLite

    SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

    Published 30 May 2019 · NVD
  33. Medium 5.3

    CVE-2018-15131 · Zimbra Collaboration

    An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests.

    Published 30 May 2019 · Fixed in 8.7.11, 8.8.8 · NVD
  34. Critical 9.8Actively exploited

    CVE-2019-9670 · Zimbra Collaboration

    mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

    Published 29 May 2019 · Fixed in 8.7.11 · NVD
  35. Medium 6.5

    CVE-2019-6981 · Zimbra Collaboration

    Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.

    Published 29 May 2019 · Fixed in 8.7.11, 8.8.9 · NVD
  36. Critical 9.8

    CVE-2019-6980 · Zimbra Collaboration

    Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.

    Published 29 May 2019 · Fixed in 8.7.11, 8.8.9 · NVD
  37. Critical 9.8

    CVE-2018-20160 · Zimbra Collaboration

    ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.

    Published 29 May 2019 · Fixed in 8.7.11, 8.8.9 · NVD
  38. Medium 6.1

    CVE-2018-18631 · Zimbra Collaboration

    mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.

    Published 29 May 2019 · Fixed in 8.7.11, 8.8.9 · NVD
  39. Medium 6.1

    CVE-2018-14013 · Zimbra Collaboration

    Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.

    Published 29 May 2019 · Fixed in 8.7.11, 8.8.9 · NVD
  40. Medium 5.3

    CVE-2018-13365 · Fortinet FortiOS

    An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via Application Control Block page.

    Published 29 May 2019 · NVD
  41. High 7.5

    CVE-2019-12452 · Traefik

    types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS…

    Published 29 May 2019 · NVD
  42. Medium 6.1

    CVE-2019-12347 · pfSense

    In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.

    Published 29 May 2019 · NVD
  43. Medium 6.5Actively exploited

    CVE-2018-13383 · Fortinet FortiProxy, Fortinet FortiOS

    A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

    Published 29 May 2019 · Fixed in 5.4.13, 5.6.11, 6.0.5 · NVD
  44. Medium 6.5

    CVE-2019-9866 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure.

    Published 29 May 2019 · Fixed in 11.7.7, 11.8.3 · NVD
  45. Critical 9.8

    CVE-2019-9732 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.

    Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  46. Critical 9.8

    CVE-2019-9485 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.

    Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  47. Medium 5.5

    CVE-2019-9221 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 3 of 5).

    Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  48. Critical 9.8

    CVE-2019-9218 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5).

    Published 29 May 2019 · Fixed in 11.6.10, 11.7.6, 11.8.1 · NVD
  49. Medium 4.3

    CVE-2019-7549 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information.

    Published 29 May 2019 · Fixed in 11.5.10, 11.6.8, 11.7.3 · NVD
  50. Medium 6.1

    CVE-2019-0221 · Apache Tomcat

    The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

    Published 28 May 2019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.