UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,908
Published in 7 days
1,022
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,908 vulnerabilities
  1. High 8.1

    CVE-2019-11600 · OpenProject

    A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

    Published 13 May 2019 · Fixed in 8.3.2 · NVD
  2. Medium 4.8

    CVE-2019-11429 · Control Web Panel

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.

    Published 13 May 2019 · NVD
  3. Medium 5.4

    CVE-2018-16624 · Kirby

    panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.

    Published 13 May 2019 · NVD
  4. Medium 4.8

    CVE-2018-16623 · Kirby

    Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.

    Published 13 May 2019 · NVD
  5. Medium 6.5

    CVE-2019-11000 · GitLab

    An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure.

    Published 10 May 2019 · Fixed in 11.7.11, 11.8.7, 11.9.7 · NVD
  6. High 8.1

    CVE-2019-5018 · SQLite

    An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

    Published 10 May 2019 · NVD
  7. High 7.5

    CVE-2017-12806 · ImageMagick

    In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service.

    Published 9 May 2019 · NVD
  8. High 7.5

    CVE-2017-12805 · ImageMagick

    In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service.

    Published 9 May 2019 · NVD
  9. Medium 5.9

    CVE-2019-11323 · HAProxy

    HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.

    Published 9 May 2019 · Fixed in 1.9.7 · NVD
  10. High 7.5

    CVE-2019-11832 · TYPO3

    TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.

    Published 9 May 2019 · Fixed in 8.7.25, 9.5.6 · NVD
  11. Critical 9.8

    CVE-2019-11831 · Drupal, Joomla!

    The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

    Published 9 May 2019 · Fixed in 7.67, 8.6.16, 8.7.1 · NVD
  12. High 7.5

    CVE-2019-11494 · Dovecot

    In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command.

    Published 8 May 2019 · NVD
  13. Critical 10.0Actively exploited

    CVE-2019-11510 · Ivanti Connect Secure

    In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

    Published 8 May 2019 · NVD
  14. High 7.2

    CVE-2019-11508 · Ivanti Connect Secure

    In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.

    Published 8 May 2019 · NVD
  15. Medium 6.1

    CVE-2019-11507 · Ivanti Connect Secure

    In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.

    Published 8 May 2019 · NVD
  16. High 7.5

    CVE-2019-11499 · Dovecot

    In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message.

    Published 8 May 2019 · NVD
  17. Medium 6.1

    CVE-2019-11629 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.

    Published 7 May 2019 · Fixed in 2.14.13 · NVD
  18. Unrated

    WPV-dfb1909e42f7 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  19. Unrated

    WPV-6e0c6fcf8e01 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  20. Unrated

    WPV-3babf47eb536 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  21. Medium 5.8

    CVE-2019-11767 · phpBB

    Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.

    Published 5 May 2019 · Fixed in 3.2.6 · NVD
  22. High 7.5

    CVE-2019-6619 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation (ALPN) enabled and it processes traffic where the ALPN extension size is zero.

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  23. Medium 4.9

    CVE-2019-6618 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the filesystem if provided Advanced Shell Access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator (RA) role restrictions.

    Published 3 May 2019 · NVD
  24. Medium 6.5

    CVE-2019-6617 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files (such as /etc/passwd) using SFTP to modify user permissions, without Advanced Shell access. This is contrary to our definition for the Resource Administrator (RA) role restrictions.

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  25. High 7.2

    CVE-2019-6616 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical system files on BIG-IP which can result in bypass of whitelist / blacklist restrictions enforced by appliance mode.

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  26. Medium 4.9

    CVE-2019-6615 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMSH access to bypass Appliance Mode restrictions on BIG-IP systems.

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  27. Medium 6.5

    CVE-2019-6614 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files.

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  28. Medium 6.1

    CVE-2019-3400 · Jira

    The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.

    Published 3 May 2019 · Fixed in 7.13.2, 8.0.2 · NVD
  29. Critical 9.1

    CVE-2019-11036 · PHP

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    Published 3 May 2019 · Fixed in 7.1.29, 7.2.18, 7.3.5 · NVD
  30. Medium 6.1

    CVE-2018-20824 · Jira

    The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

    Published 3 May 2019 · Fixed in 7.13.1 · NVD
  31. Medium 5.3

    CVE-2019-6613 · F5 BIG-IP

    On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.

    Published 3 May 2019 · Fixed in 11.6.4, 12.1.4.1, 13.1.1.5 · NVD
  32. High 7.5

    CVE-2019-6612 · F5 BIG-IP

    On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a response from a DNS cache may cause TMM to restart.

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  33. High 7.5

    CVE-2019-6611 · F5 BIG-IP

    When BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 are processing certain rare data sequences occurring in PPTP VPN traffic, the BIG-IP system may execute incorrect logic. The TMM may restart and produce a core file as a result of this condition. The BIG-IP system provisioned with the CGNAT module and configured with a virtual server using a PPTP…

    Published 3 May 2019 · Fixed in 12.1.4.1, 13.1.1.5, 14.1.0.2 · NVD
  34. High 8.6

    CVE-2019-1714 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On (SSO) for Clientless SSL VPN (WebVPN) and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to successfully establish a VPN session to an affected device. The…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  35. High 8.8

    CVE-2019-1713 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  36. High 8.6

    CVE-2019-1708 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to…

    Published 3 May 2019 · NVD
  37. High 8.6

    CVE-2019-1706 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the software cryptography module of the Cisco Adaptive Security Virtual Appliance (ASAv) and Firepower 2100 Series running Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error with how the…

    Published 3 May 2019 · NVD
  38. Medium 5.9

    CVE-2019-1705 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the remote access VPN session manager of Cisco Adaptive Security Appliance (ASA) Software could allow a unauthenticated, remote attacker to cause a denial of service (DoS) condition on the remote access VPN services. The vulnerability is due to an issue with the remote access VPN session manager. An attacker could exploit this vulnerability by requesting an excessive number of…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  39. Medium 4.8

    CVE-2019-1701 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the WebVPN portal of an affected device. The vulnerabilities exist because the software insufficiently validates user-supplied input on an…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  40. High 7.5

    CVE-2019-1697 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  41. Medium 6.5

    CVE-2019-1695 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to send data directly to the kernel of an affected device. The vulnerability exists because the software improperly filters Ethernet frames sent to an affected device. An attacker could exploit this…

    Published 3 May 2019 · Fixed in 9.9.2.50, 9.10.1.17 · NVD
  42. High 8.6

    CVE-2019-1694 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of TCP traffic. An attacker could exploit this vulnerability by…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  43. Medium 6.5

    CVE-2019-1693 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper management of authenticated sessions in the WebVPN portal. An attacker could exploit this vulnerability by…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  44. High 7.5

    CVE-2019-1687 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error in TCP-based packet inspection, which could cause the TCP packet to…

    Published 3 May 2019 · Fixed in 9.8.4, 9.9.2.50, 9.10.1.17 · NVD
  45. High 8.6

    CVE-2018-15388 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load for existing WebVPN login operations. An attacker could exploit this vulnerability by…

    Published 3 May 2019 · Fixed in 9.6.4.25, 9.8.4, 9.9.2.50 · NVD
  46. High 7.5

    CVE-2019-9826 · phpBB

    The fulltext search component in phpBB before 3.2.6 allows Denial of Service.

    Published 2 May 2019 · NVD
  47. Medium 6.1

    CVE-2019-11193 · DirectAdmin

    The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.

    Published 30 Apr 2019 · NVD
  48. High 7.1

    CVE-2019-10131 · ImageMagick

    An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

    Published 30 Apr 2019 · Fixed in 6.9.9-40, 7.0.7-28 · NVD
  49. High 7.5Actively exploited

    CVE-2019-9621 · Zimbra Collaboration

    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

    Published 30 Apr 2019 · Fixed in 8.6.0, 8.7.11, 8.8.9 · NVD
  50. High 7.5

    CVE-2019-3399 · Jira

    The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

    Published 30 Apr 2019 · Fixed in 7.13.2, 8.0.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.