Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-5347
dell emc isilon onefs
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU a...
|
7.5 High | — | 1,0% | 4 Apr 2020 |
|
CVE-2020-5348
dell latitude 7202 firmware
Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker m...
|
7.8 High | — | 0,38% | 4 Apr 2020 |
|
CVE-2020-8142
revive-adserver revive adserver
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applicati...
|
6.8 Medium | — | 0,63% | 3 Apr 2020 |
|
CVE-2020-8143
revive-adserver revive adserver
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users t...
|
6.1 Medium | — | 70,4% | 3 Apr 2020 |
|
CVE-2020-8147
utils-extend project utils-extend
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of...
|
9.8 Critical | — | 3,1% | 3 Apr 2020 |
|
CVE-2020-6994
belden hirschmann hios, belden hirschmann hisecos
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL argum...
|
9.8 Critical | — | 1,6% | 3 Apr 2020 |
|
CVE-2020-8637
testlink
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.
|
9.8 Critical | — | 2,9% | 3 Apr 2020 |
|
CVE-2020-8638
testlink
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter.
|
9.8 Critical | — | 1,7% | 3 Apr 2020 |
|
CVE-2020-8639
testlink
An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executabl...
|
8.8 High | — | 15,9% | 3 Apr 2020 |
|
CVE-2020-7000
visam vbase editor, visam vbase web-remote
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain infor...
|
7.5 High | — | 1,1% | 3 Apr 2020 |
|
CVE-2020-7004
visam vbase editor, visam vbase web-remote
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure permissions on the VBASE directory resulting in elevation of privileges or mali...
|
8.8 High | — | 0,37% | 3 Apr 2020 |
|
CVE-2020-7008
visam vbase editor, visam vbase web-remote
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an attacker to...
|
7.5 High | — | 1,9% | 3 Apr 2020 |
|
CVE-2020-10601
visam vbase editor, visam vbase web-remote
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypass the passw...
|
7.8 High | — | 0,25% | 3 Apr 2020 |
|
CVE-2020-10599
visam vbase editor, visam vbase web-remote
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buffer overflow, which may lead to...
|
9.8 Critical | — | 2,6% | 3 Apr 2020 |
|
CVE-2019-17230
mageewp onetone
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
|
5.3 Medium | — | 2,4% | 3 Apr 2020 |
|
CVE-2019-17231
mageewp onetone
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
|
6.1 Medium | — | 1,2% | 3 Apr 2020 |
|
CVE-2020-10689
eclipse che
A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypas...
|
6.8 Medium | — | 0,75% | 3 Apr 2020 |
|
CVE-2020-10960
mediawiki
In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitra...
|
5.3 Medium | — | 1,2% | 3 Apr 2020 |
|
CVE-2020-11500
zoom meetings
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key.
|
7.5 High | — | 1,3% | 3 Apr 2020 |
|
CVE-2020-11501
gnutls, canonical ubuntu linux +3 lainnya
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS...
|
7.4 High | — | 3,4% | 3 Apr 2020 |
|
CVE-2020-4273
ibm spectrum scale
IBM Spectrum Scale 4.2 and 5.0 could allow a local unprivileged attacker with intimate knowledge of the enviornment to execute commands as root using specially crafted in...
|
7.8 High | — | 0,40% | 3 Apr 2020 |
|
CVE-2019-18905
opensuse autoyast2
A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to...
|
5.9 Medium | — | 0,73% | 3 Apr 2020 |
|
CVE-2019-18904
opensuse rmt-server
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15...
|
7.5 High | — | 1,6% | 3 Apr 2020 |
|
CVE-2018-17954
suse openstack cloud, suse openstack cloud crowbar
An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Clou...
|
7.8 High | — | 0,32% | 3 Apr 2020 |
|
CVE-2020-5283
viewvc
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attac...
|
3.5 Low | — | 1,4% | 3 Apr 2020 |
|
CVE-2020-11498
slack nebula
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go...
|
8.8 High | — | 3,4% | 2 Apr 2020 |
|
CVE-2020-11499
firmware analysis and comparison tool project firmware analysis and comparison tool
Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and v...
|
6.1 Medium | — | 0,61% | 2 Apr 2020 |
|
CVE-2020-7628
install-package project install-package, umount project umount
umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.
|
9.8 Critical | — | 1,8% | 2 Apr 2020 |
|
CVE-2020-7629
install-package project install-package
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
|
9.8 Critical | — | 4,2% | 2 Apr 2020 |
|
CVE-2020-7630
git-add-remote project git-add-remote
git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.
|
9.8 Critical | — | 4,2% | 2 Apr 2020 |
|
CVE-2020-7624
effect project effect
effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.
|
9.8 Critical | — | 4,2% | 2 Apr 2020 |
|
CVE-2020-7625
op-browser project op-browser
op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.
|
9.8 Critical | — | 4,2% | 2 Apr 2020 |
|
CVE-2020-7626
karma-mojo project karma-mojo
karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.
|
9.8 Critical | — | 4,3% | 2 Apr 2020 |
|
CVE-2020-7627
node-key-sender project node-key-sender
node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.
|
9.8 Critical | — | 4,2% | 2 Apr 2020 |
|
CVE-2020-10515
starface unified communication & collaboration client
STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006.
|
9.8 Critical | — | 2,9% | 2 Apr 2020 |
|
CVE-2020-11494
linux kernel, opensuse leap +2 lainnya
An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potential...
|
4.4 Medium | — | 0,72% | 2 Apr 2020 |
|
CVE-2020-7619
get-git-data project get-git-data
get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.
|
9.8 Critical | — | 2,2% | 2 Apr 2020 |
|
CVE-2020-7620
netease pomelo-monitor
pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.
|
9.8 Critical | — | 2,2% | 2 Apr 2020 |
|
CVE-2020-7621
ibm strongloop nginx controller
strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.
|
9.8 Critical | — | 3,0% | 2 Apr 2020 |
|
CVE-2020-7623
jscover project jscover
jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.
|
9.8 Critical | — | 3,6% | 2 Apr 2020 |
|
CVE-2020-9067
huawei smartax ma5600t firmware, huawei smartax ma5800 firmware +1 lainnya
There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the affected produ...
|
8.0 High | — | 0,62% | 2 Apr 2020 |
|
CVE-2019-19094
hitachienergy esoms
Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database.
|
7.6 High | — | 0,94% | 2 Apr 2020 |
|
CVE-2019-19095
hitachienergy esoms
Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing malicious co...
|
5.4 Medium | — | 0,63% | 2 Apr 2020 |
|
CVE-2019-19096
hitachienergy esoms
The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially c...
|
6.1 Medium | — | 0,29% | 2 Apr 2020 |
|
CVE-2019-19097
hitachienergy esoms
ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to eavesdrop a...
|
7.5 High | — | 0,69% | 2 Apr 2020 |
|
CVE-2019-19346
redhat openshift
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5, 4.2.21, 4....
|
7.0 High | — | 0,26% | 2 Apr 2020 |
|
CVE-2019-19348
redhat openshift
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4.2.21, 4.1.3...
|
7.0 High | — | 0,26% | 2 Apr 2020 |
|
CVE-2019-19002
hitachienergy esoms
For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content S...
|
5.4 Medium | — | 0,79% | 2 Apr 2020 |
|
CVE-2019-19003
hitachienergy esoms
For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scriptin...
|
6.1 Medium | — | 0,78% | 2 Apr 2020 |
|
CVE-2019-19089
hitachienergy esoms
For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displa...
|
6.1 Medium | — | 1,1% | 2 Apr 2020 |