Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-11589
cipplanner cipace
An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL an...
|
7.5 High | — | 1,1% | 6 Apr 2020 |
|
CVE-2020-11590
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal ser...
|
5.3 Medium | — | 0,96% | 6 Apr 2020 |
|
CVE-2020-11591
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the...
|
5.3 Medium | — | 0,96% | 6 Apr 2020 |
|
CVE-2020-11592
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the...
|
7.5 High | — | 1,2% | 6 Apr 2020 |
|
CVE-2020-11593
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leverag...
|
7.5 High | — | 0,99% | 6 Apr 2020 |
|
CVE-2020-11594
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the...
|
7.5 High | — | 1,2% | 6 Apr 2020 |
|
CVE-2020-11595
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the...
|
7.5 High | — | 1,2% | 6 Apr 2020 |
|
CVE-2020-11596
cipplanner cipace
A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make HTTP GET requests to a certain URL and obtain i...
|
7.5 High | — | 1,8% | 6 Apr 2020 |
|
CVE-2020-11597
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context...
|
9.8 Critical | — | 1,5% | 6 Apr 2020 |
|
CVE-2020-11598
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.
|
9.8 Critical | — | 2,5% | 6 Apr 2020 |
|
CVE-2020-11599
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user.
|
7.5 High | — | 1,1% | 6 Apr 2020 |
|
CVE-2020-11588
cipplanner cipace
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to two files that contain customer data and ap...
|
5.3 Medium | — | 0,96% | 6 Apr 2020 |
|
CVE-2020-11580
pulsesecure pulse connect secure, pulsesecure pulse policy secure
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host C...
|
9.1 Critical | — | 1,1% | 6 Apr 2020 |
|
CVE-2020-11581
pulsesecure pulse connect secure, pulsesecure pulse policy secure
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host C...
|
8.1 High | — | 9,8% | 6 Apr 2020 |
|
CVE-2020-11582
pulsesecure pulse connect secure, pulsesecure pulse policy secure
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host C...
|
8.8 High | — | 0,88% | 6 Apr 2020 |
|
CVE-2020-11585
dnnsoftware dotnetnuke
There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is...
|
4.3 Medium | — | 0,69% | 6 Apr 2020 |
|
CVE-2020-5832
symantec data center security
Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereb...
|
7.8 High | — | 0,38% | 6 Apr 2020 |
|
CVE-2020-5300
ory hydra
In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_k...
|
5.3 Medium | — | 1,0% | 6 Apr 2020 |
|
CVE-2020-11507
malwarebytes adwcleaner
An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded...
|
7.8 High | — | 0,88% | 6 Apr 2020 |
|
CVE-2020-11544
projectworlds official car rental system
An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the upload secti...
|
7.2 High | — | 1,1% | 6 Apr 2020 |
|
CVE-2020-11545
projectworlds official car rental system
Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass para...
|
9.8 Critical | — | 1,6% | 6 Apr 2020 |
|
CVE-2020-11102
qemu
hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length.
|
5.6 Medium | — | 2,0% | 6 Apr 2020 |
|
CVE-2019-19699
centreon
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via a...
|
7.2 High | — | 27,7% | 6 Apr 2020 |
|
CVE-2020-7622
jooby
This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the...
|
9.8 Critical | — | 1,6% | 6 Apr 2020 |
|
CVE-2020-9473
siedle sg 150-0 firmware
The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with access to the network can get root...
|
6.6 Medium | — | 1,0% | 6 Apr 2020 |
|
CVE-2020-1728
redhat keycloak, quarkus
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers i...
|
5.4 Medium | — | 0,78% | 6 Apr 2020 |
|
CVE-2020-8004
stm32f1 firmware
STMicroelectronics STM32F1 devices have Incorrect Access Control.
|
7.5 High | — | 3,0% | 6 Apr 2020 |
|
CVE-2020-7631
diskusage-ng project diskusage-ng
diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
|
9.8 Critical | — | 3,9% | 6 Apr 2020 |
|
CVE-2020-7632
node-mpv project node-mpv
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
|
9.8 Critical | — | 4,4% | 6 Apr 2020 |
|
CVE-2020-7633
apiconnect-cli-plugins project apiconnect-cli-plugins
apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument.
|
9.8 Critical | — | 4,4% | 6 Apr 2020 |
|
CVE-2020-7634
heroku-addonpool project heroku-addonpool
heroku-addonpool through 0.1.15 is vulnerable to Command Injection.
|
9.8 Critical | — | 2,8% | 6 Apr 2020 |
|
CVE-2020-7635
compass-compile project compass-compile
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
|
9.8 Critical | — | 4,4% | 6 Apr 2020 |
|
CVE-2020-7636
adb-driver project adb-driver
adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
|
9.8 Critical | — | 4,4% | 6 Apr 2020 |
|
CVE-2020-7637
class-transformer project class-transformer
class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of...
|
5.3 Medium | — | 1,2% | 6 Apr 2020 |
|
CVE-2020-7638
confinit project confinit
confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' usin...
|
5.3 Medium | — | 1,0% | 6 Apr 2020 |
|
CVE-2020-7639
dot project dot
eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a...
|
5.3 Medium | — | 1,1% | 6 Apr 2020 |
|
CVE-2020-10267
universal-robots ur software
Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property arti...
|
7.5 High | — | 0,95% | 6 Apr 2020 |
|
CVE-2020-10264
universal-robots ur software
CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 which allows...
|
8.8 High | — | 0,59% | 6 Apr 2020 |
|
CVE-2020-10265
universal-robots ur software
Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service called DashBoa...
|
9.4 Critical | — | 1,5% | 6 Apr 2020 |
|
CVE-2020-10266
universal-robots ur+
UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the robots (e.g....
|
8.1 High | — | 0,50% | 6 Apr 2020 |
|
CVE-2020-11565
linux kernel, canonical ubuntu linux
An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled...
|
6.0 Medium | — | 0,52% | 6 Apr 2020 |
|
CVE-2020-11558
gpac
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make g...
|
9.8 Critical | — | 1,5% | 5 Apr 2020 |
|
CVE-2020-11547
paessler prtg network monitor
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windo...
|
5.3 Medium | — | 52,1% | 5 Apr 2020 |
|
CVE-2020-11548
search meter project search meter
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution vi...
|
9.8 Critical | — | 5,2% | 5 Apr 2020 |
|
CVE-2020-11542
3xlogic infinias eidc32 firmware, 3xlogic infinias eidc32 web
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of th...
|
9.8 Critical | — | 0,98% | 4 Apr 2020 |
|
CVE-2020-11533
ivanti workspace control
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
|
5.5 Medium | — | 0,48% | 4 Apr 2020 |
|
CVE-2020-11529
getgrav grav
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
|
6.1 Medium | — | 10,9% | 4 Apr 2020 |
|
CVE-2020-11527
zohocorp manageengine opmanager
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
|
7.5 High | — | 9,5% | 4 Apr 2020 |
|
CVE-2020-11528
bit2spr project bit2spr
bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file.
|
7.5 High | — | 1,2% | 4 Apr 2020 |
|
CVE-2020-11518
zohocorp manageengine adselfservice plus
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
|
9.8 Critical | — | 19,2% | 4 Apr 2020 |