UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,908
Published in 7 days
1,022
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,908 vulnerabilities
  1. High 7.8

    CVE-2019-5436 · curl, MySQL

    A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

    Published 28 May 2019 · NVD
  2. Low 3.7

    CVE-2019-5435 · curl

    An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

    Published 28 May 2019 · NVD
  3. Medium 6.1

    CVE-2019-7092 · Adobe ColdFusion

    ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure .

    Published 24 May 2019 · NVD
  4. Critical 9.8

    CVE-2019-7091 · Adobe ColdFusion

    ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 24 May 2019 · NVD
  5. Critical 9.8

    CVE-2019-7816 · Adobe ColdFusion

    ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    Published 24 May 2019 · NVD
  6. Medium 6.1

    CVE-2019-11876 · Drupal, PrestaShop

    In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.

    Published 24 May 2019 · NVD
  7. Medium 5.5

    CVE-2017-15652 · Ghostscript

    Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well.

    Published 23 May 2019 · NVD
  8. Medium 5.9

    CVE-2019-0201 · Apache ActiveMQ

    An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence,…

    Published 23 May 2019 · NVD
  9. High 7.5

    CVE-2018-15664 · Docker Engine

    In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

    Published 23 May 2019 · NVD
  10. High 7.5

    CVE-2019-12295 · F5 BIG-IP

    In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.

    Published 23 May 2019 · Fixed in 12.1.5.3, 13.1.3.5, 14.1.2.8 · NVD
  11. Medium 5.4

    CVE-2017-5871 · Odoo

    Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).

    Published 22 May 2019 · NVD
  12. High 8.1

    CVE-2019-8443 · Jira

    The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.

    Published 22 May 2019 · Fixed in 7.13.4, 8.0.4, 8.1.1 · NVD
  13. High 7.5

    CVE-2019-8442 · Jira

    The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.

    Published 22 May 2019 · Fixed in 7.13.4, 8.0.4, 8.1.1 · NVD
  14. Medium 5.3

    CVE-2019-3403 · Jira

    The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

    Published 22 May 2019 · Fixed in 7.13.3, 8.0.4, 8.1.1 · NVD
  15. Medium 6.1

    CVE-2019-3402 · Jira

    The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

    Published 22 May 2019 · Fixed in 7.13.3, 8.1.1 · NVD
  16. Medium 5.3

    CVE-2019-3401 · Jira

    The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

    Published 22 May 2019 · Fixed in 7.13.3, 8.1.1 · NVD
  17. Medium 5.3

    CVE-2017-6514 · WordPress

    WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.

    Published 22 May 2019 · NVD
  18. Critical 9.8

    CVE-2019-12279 · Nagios XI

    Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in…

    Published 22 May 2019 · NVD
  19. Unrated

    WPV-2cc0f858820e · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 22 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  20. Medium 5.4

    CVE-2019-12190 · Control Web Panel

    XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.

    Published 21 May 2019 · NVD
  21. High 7.2

    CVE-2019-11816 · pfSense, OPNsense

    Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.

    Published 20 May 2019 · Fixed in 19.1.8 · NVD
  22. Medium 4.3

    CVE-2019-12215 · Matomo

    A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security…

    Published 20 May 2019 · NVD
  23. Medium 6.1

    CVE-2019-11809 · Joomla!

    An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.

    Published 20 May 2019 · Fixed in 3.9.6 · NVD
  24. Critical 9.1

    CVE-2019-7353 · GitLab

    An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects.

    Published 17 May 2019 · Fixed in 11.7.4 · NVD
  25. High 7.5

    CVE-2019-6797 · GitLab

    An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token used in CI/CD for External Repos was being leaked to project maintainers in the UI.

    Published 17 May 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  26. Medium 4.3

    CVE-2019-6790 · GitLab

    An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group's merge requests.

    Published 17 May 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  27. Medium 6.5

    CVE-2019-6787 · GitLab

    An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users.

    Published 17 May 2019 · Fixed in 11.5.8, 11.6.6, 11.7.1 · NVD
  28. High 7.5

    CVE-2019-6781 · GitLab

    An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails.

    Published 17 May 2019 · Fixed in 11.5.10, 11.6.8, 11.7.3 · NVD
  29. Critical 9.1

    CVE-2019-5883 · GitLab

    An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.

    Published 17 May 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  30. Critical 9.8

    CVE-2019-4279 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.

    Published 17 May 2019 · NVD
  31. High 7.5

    CVE-2018-20500 · GitLab

    An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.

    Published 17 May 2019 · Fixed in 11.4.13, 11.5.6, 11.6.1 · NVD
  32. High 7.5

    CVE-2018-19585 · GitLab

    GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.

    Published 17 May 2019 · Fixed in 11.3.11, 11.4.8, 11.5.1 · NVD
  33. High 7.5

    CVE-2019-10911 · Drupal

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.

    Published 16 May 2019 · Fixed in 8.5.15, 8.6.15 · NVD
  34. Critical 9.8

    CVE-2019-10910 · Drupal

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

    Published 16 May 2019 · Fixed in 8.5.15, 8.6.15 · NVD
  35. Medium 5.4

    CVE-2019-10909 · Drupal

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

    Published 16 May 2019 · Fixed in 8.5.15, 8.6.15 · NVD
  36. High 7.8

    CVE-2019-3839 · Ghostscript

    It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.

    Published 16 May 2019 · Fixed in 9.27 · NVD
  37. High 7.5

    CVE-2019-0982 · .NET

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

    Published 16 May 2019 · NVD
  38. High 7.5

    CVE-2019-10112 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  39. Medium 6.1

    CVE-2019-10117 · GitLab

    An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  40. Medium 4.3

    CVE-2019-10116 · GitLab

    An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  41. Medium 6.5

    CVE-2019-10115 · GitLab

    An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  42. High 7.5

    CVE-2019-10114 · GitLab

    An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  43. High 7.5

    CVE-2019-10113 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects/<id>/languages requests may allow Uncontrolled Resource Consumption.

    Published 16 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  44. Medium 5.4

    CVE-2019-10111 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  45. Medium 6.5

    CVE-2019-10110 · GitLab

    An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credentials.

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  46. Medium 5.3

    CVE-2019-10109 · GitLab

    An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  47. Medium 5.4

    CVE-2019-10108 · GitLab

    An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.

    Published 15 May 2019 · Fixed in 11.7.8, 11.8.4, 11.9.2 · NVD
  48. High 7.5

    CVE-2019-10640 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption.

    Published 15 May 2019 · Fixed in 11.7.10, 11.8.6, 11.9.4 · NVD
  49. Critical 9.8

    CVE-2013-7285 · Apache ActiveMQ

    Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

    Published 15 May 2019 · NVD
  50. High 8.1

    CVE-2019-12083 · Rust

    The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually…

    Published 13 May 2019 · Fixed in 1.34.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.