UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,915
Published in 7 days
1,021
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,915 vulnerabilities
  1. Medium 6.1

    CVE-2018-19799 · Dolibarr ERP CRM

    Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

    Published 26 Dec 2018 · NVD
  2. Medium 6.5

    CVE-2018-20467 · ImageMagick

    In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang, with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

    Published 26 Dec 2018 · Fixed in 6.9.10-16, 7.0.8-16 · NVD
  3. High 7.2

    CVE-2018-20465 · Craft CMS

    Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

    Published 25 Dec 2018 · NVD
  4. High 8.1

    CVE-2018-15465 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulnerability is due to improper validation of user privileges when using the web management interface. An attacker could exploit this…

    Published 24 Dec 2018 · Fixed in 9.8.3.18, 9.9.2.36, 9.10.1.7 · NVD
  5. Medium 4.8

    CVE-2018-20418 · Craft CMS

    index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

    Published 24 Dec 2018 · NVD
  6. High 7.5

    CVE-2018-20406 · Python

    Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8,…

    Published 23 Dec 2018 · Fixed in 3.7.1 · NVD
  7. Medium 6.1

    CVE-2018-20322 · LimeSurvey

    LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.

    Published 21 Dec 2018 · NVD
  8. High 8.1

    CVE-2018-20346 · SQLite

    SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

    Published 21 Dec 2018 · Fixed in 3.25.3 · NVD
  9. High 8.1

    CVE-2018-20329 · Chamilo LMS

    Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.

    Published 21 Dec 2018 · NVD
  10. Medium 5.4

    CVE-2018-20328 · Chamilo LMS

    Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.

    Published 21 Dec 2018 · NVD
  11. Medium 5.4

    CVE-2018-20327 · Chamilo LMS

    Chamilo LMS version 1.11.8 contains XSS in main/template/default/admin/gradebook_list.tpl in the gradebook dependencies tool, allowing authenticated users to affect other users, under specific conditions of permissions granted by administrators. This is considered "low risk" due to the nature of the feature it exploits.

    Published 21 Dec 2018 · NVD
  12. High 7.8

    CVE-2018-19134 · Ghostscript

    In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

    Published 20 Dec 2018 · NVD
  13. Medium 6.1

    CVE-2018-16627 · Kirby

    panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.

    Published 20 Dec 2018 · NVD
  14. Medium 5.9

    CVE-2018-17247 · Elasticsearch

    Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they…

    Published 20 Dec 2018 · NVD
  15. Critical 9.8

    CVE-2018-17246 · Kibana

    Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

    Published 20 Dec 2018 · Fixed in 5.6.13, 6.4.3 · NVD
  16. Critical 9.8

    CVE-2018-17245 · Kibana

    Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating PDF reports. If a report requests external resources plaintext credentials are included in the HTTP request that could be recovered by an external resource provider.

    Published 20 Dec 2018 · NVD
  17. Medium 6.5

    CVE-2018-17244 · Elasticsearch

    Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a…

    Published 20 Dec 2018 · NVD
  18. High 7.5

    CVE-2018-15330 · F5 BIG-IP

    On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the BIG-IP system will experience a fatal error and may cause the Traffic Management Microkernel (TMM) to produce a core file.

    Published 20 Dec 2018 · NVD
  19. High 7.2

    CVE-2018-15329 · F5 BIG-IP

    On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

    Published 20 Dec 2018 · NVD
  20. Medium 5.4

    CVE-2018-1000816 · Grafana

    Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..

    Published 20 Dec 2018 · NVD
  21. Medium 4.8

    CVE-2018-1000813 · Backdrop CMS

    Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later.

    Published 20 Dec 2018 · NVD
  22. High 7.5

    CVE-2018-20303 · Gogs

    In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

    Published 20 Dec 2018 · Fixed in 0.11.82.1218 · NVD
  23. Medium 4.8

    CVE-2018-19598 · Statamic

    Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.

    Published 19 Dec 2018 · NVD
  24. Medium 6.1

    CVE-2018-20172 · Nagios XI

    An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.

    Published 17 Dec 2018 · Fixed in 5.5.8 · NVD
  25. Medium 6.1

    CVE-2018-20171 · Nagios XI

    An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.

    Published 17 Dec 2018 · Fixed in 5.5.8 · NVD
  26. Medium 5.4

    CVE-2018-20153 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  27. Medium 6.5

    CVE-2018-20152 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  28. High 7.5

    CVE-2018-20151 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  29. Medium 6.1

    CVE-2018-20150 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  30. Medium 5.4

    CVE-2018-20149 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  31. Critical 9.8

    CVE-2018-20148 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  32. Medium 6.5

    CVE-2018-20147 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  33. Medium 4.3

    CVE-2018-19413 · SonarQube Server

    A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in…

    Published 14 Dec 2018 · Fixed in 7.4 · NVD
  34. Medium 6.5

    CVE-2018-19039 · Grafana

    Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

    Published 13 Dec 2018 · Fixed in 4.6.5, 5.3.3 · NVD
  35. High 7.5

    CVE-2018-8033 · Apache OFBiz

    In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references…

    Published 13 Dec 2018 · NVD
  36. High 7.5

    CVE-2018-20103 · HAProxy

    An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

    Published 12 Dec 2018 · NVD
  37. High 7.5

    CVE-2018-20102 · HAProxy

    An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on…

    Published 12 Dec 2018 · NVD
  38. High 8.8

    CVE-2018-1926 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992.

    Published 12 Dec 2018 · NVD
  39. High 8.8

    CVE-2018-1901 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530.

    Published 12 Dec 2018 · NVD
  40. High 7.5

    CVE-2018-15328 · F5 BIG-IP

    On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files.

    Published 12 Dec 2018 · NVD
  41. Medium 4.3

    CVE-2018-8604 · Microsoft Exchange Server

    A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects Microsoft Exchange Server.

    Published 12 Dec 2018 · NVD
  42. Unrated

    WPV-a87de0a51483 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 12 Dec 2018 · Fixed in 6.5 · WPVulnerability
  43. Medium 6.1

    CVE-2018-19970 · phpMyAdmin

    In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.

    Published 11 Dec 2018 · Fixed in 4.8.4 · NVD
  44. High 8.8

    CVE-2018-19969 · phpMyAdmin

    phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.

    Published 11 Dec 2018 · Fixed in 4.8.4 · NVD
  45. Medium 6.5

    CVE-2018-19968 · phpMyAdmin

    An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not…

    Published 11 Dec 2018 · Fixed in 4.8.4 · NVD
  46. Critical 9.8

    CVE-2018-1904 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533.

    Published 11 Dec 2018 · NVD
  47. Unrated

    WPV-bbaa735ff514 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 11 Dec 2018 · Fixed in 6.5 · WPVulnerability
  48. Unrated

    WPV-1c55075efed9 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Dec 2018 · Fixed in 3.4.6 · WPVulnerability
  49. Medium 5.5

    CVE-2018-1957 · IBM WebSphere Application Server

    IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629.

    Published 10 Dec 2018 · NVD
  50. Medium 6.5

    CVE-2018-1000864 · Jenkins

    A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.

    Published 10 Dec 2018 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.