Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-19090
hitachienergy esoms
For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it s...
|
3.5 Low | — | 0,52% | 2 Apr 2020 |
|
CVE-2019-19091
hitachienergy esoms
For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to s...
|
4.3 Medium | — | 0,76% | 2 Apr 2020 |
|
CVE-2019-19092
hitachienergy esoms
ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed.
|
3.5 Low | — | 0,83% | 2 Apr 2020 |
|
CVE-2019-19093
hitachienergy esoms
eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords.
|
6.5 Medium | — | 0,85% | 2 Apr 2020 |
|
CVE-2019-19000
hitachienergy esoms
For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow brow...
|
6.5 Medium | — | 1,1% | 2 Apr 2020 |
|
CVE-2019-19001
hitachienergy esoms
For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker ca...
|
6.5 Medium | — | 1,6% | 2 Apr 2020 |
|
CVE-2020-11444
sonatype nexus
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
|
8.8 High | — | 8,5% | 2 Apr 2020 |
|
CVE-2020-11107
apachefriends xampp
An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-con...
|
8.8 High | — | 22,5% | 2 Apr 2020 |
|
CVE-2020-8835
linux kernel, fedoraproject fedora +25 lainnya
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bound...
|
7.8 High | — | 6,0% | 2 Apr 2020 |
|
CVE-2020-7617
ini-parser project ini-parser
ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' pay...
|
9.8 Critical | — | 0,87% | 2 Apr 2020 |
|
CVE-2020-8423
tp-link tl-wr841n firmware
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a G...
|
7.2 High | — | 9,3% | 2 Apr 2020 |
|
CVE-2019-14868
ksh project ksh, debian linux +1 lainnya
In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restric...
|
7.8 High | — | 1,4% | 2 Apr 2020 |
|
CVE-2019-20635
intland codebeamer
codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.
|
6.1 Medium | — | 0,88% | 2 Apr 2020 |
|
CVE-2020-11452
microstrategy web
Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under...
|
4.3 Medium | — | 1,2% | 2 Apr 2020 |
|
CVE-2020-11453
microstrategy web
Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality re...
|
5.3 Medium | — | 2,7% | 2 Apr 2020 |
|
CVE-2020-9349
cacagoo tv-288zd-2mp firmware
The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password.
|
7.5 High | — | 1,5% | 2 Apr 2020 |
|
CVE-2020-6852
cacagoo tv-288zd-2mp firmware
CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password r...
|
9.8 Critical | — | 2,4% | 2 Apr 2020 |
|
CVE-2020-4303
ibm websphere application server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...
|
6.1 Medium | — | 0,82% | 2 Apr 2020 |
|
CVE-2020-4304
ibm websphere application server
IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...
|
6.1 Medium | — | 0,82% | 2 Apr 2020 |
|
CVE-2020-4325
ibm cloud pak for automation, ibm process federation server
The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates t...
|
6.5 Medium | — | 1,5% | 2 Apr 2020 |
|
CVE-2020-11450
microstrategy web
Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.jsp. An atta...
|
7.5 High | — | 17,8% | 2 Apr 2020 |
|
CVE-2020-11451
microstrategy web
The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary extensions and d...
|
7.2 High | — | 2,7% | 2 Apr 2020 |
|
CVE-2020-11454
microstrategy web
Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to...
|
5.4 Medium | — | 0,90% | 2 Apr 2020 |
|
CVE-2020-11100
haproxy, debian linux +4 lainnya
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on...
|
8.8 High | — | 61,6% | 2 Apr 2020 |
|
CVE-2020-11490
zevenet zen load balancer
Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi cert_issuer...
|
7.2 High | — | 1,9% | 2 Apr 2020 |
|
CVE-2020-11491
zevenet zen load balancer
Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow reque...
|
4.9 Medium | — | 7,9% | 2 Apr 2020 |
|
CVE-2020-8016
opensuse texlive-filesystem
A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux...
|
7.0 High | — | 0,29% | 2 Apr 2020 |
|
CVE-2020-8017
opensuse texlive-filesystem, opensuse leap
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SU...
|
6.3 Medium | — | 0,20% | 2 Apr 2020 |
|
CVE-2018-13371
fortinet fortios
An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS c...
|
8.8 High | — | 1,3% | 2 Apr 2020 |
|
CVE-2020-11458
misp-project misp
app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents...
|
4.9 Medium | — | 1,1% | 2 Apr 2020 |
|
CVE-2020-8015
exim
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue...
|
7.8 High | — | 0,53% | 2 Apr 2020 |
|
CVE-2020-1927
apache http server, fedoraproject fedora +12 lainnya
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect in...
|
6.1 Medium | — | 56,7% | 2 Apr 2020 |
|
CVE-2020-8144
ui unifi video
The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware down...
|
8.4 High | — | 0,75% | 1 Apr 2020 |
|
CVE-2020-8145
ui unifi video
The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks....
|
6.5 Medium | — | 1,1% | 1 Apr 2020 |
|
CVE-2020-8146
ui unifi video
In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue wa...
|
7.8 High | — | 0,50% | 1 Apr 2020 |
|
CVE-2020-6009
learndash
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
|
9.8 Critical | — | 1,8% | 1 Apr 2020 |
|
CVE-2020-6096
gnu glibc, fedoraproject fedora +1 lainnya
An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU...
|
8.1 High | — | 5,5% | 1 Apr 2020 |
|
CVE-2020-1958
apache druid
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filt...
|
6.5 Medium | — | 4,6% | 1 Apr 2020 |
|
CVE-2020-11469
zoom meetings
Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (with the user...
|
7.8 High | — | 0,42% | 1 Apr 2020 |
|
CVE-2020-11470
zoom meetings
Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprom...
|
3.3 Low | — | 0,31% | 1 Apr 2020 |
|
CVE-2019-17564
apache dubbo
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely com...
|
9.8 Critical | — | 36,5% | 1 Apr 2020 |
|
CVE-2018-11802
apache solr
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a requ...
|
4.3 Medium | — | 2,0% | 1 Apr 2020 |
|
CVE-2020-8966
tikiwiki cms/groupware
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions...
|
6.1 Medium | — | 0,87% | 1 Apr 2020 |
|
CVE-2020-11463
deskpro
An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve clea...
|
7.5 High | — | 1,8% | 1 Apr 2020 |
|
CVE-2020-11464
deskpro
An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive in...
|
4.3 Medium | — | 1,2% | 1 Apr 2020 |
|
CVE-2020-11465
deskpro
An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/install help...
|
8.8 High | — | 1,9% | 1 Apr 2020 |
|
CVE-2020-11466
deskpro
An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve arbitrary i...
|
4.3 Medium | — | 1,2% | 1 Apr 2020 |
|
CVE-2020-11467
deskpro
An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/templ...
|
7.2 High | — | 4,0% | 1 Apr 2020 |
|
CVE-2020-1954
apache cxf, oracle communications diameter signaling router +8 lainnya
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of...
|
5.3 Medium | — | 6,1% | 1 Apr 2020 |
|
CVE-2020-10598
bd pyxis medstation es firmware, bd pyxis anesthesia station es firmware
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functi...
|
6.1 Medium | — | 0,33% | 1 Apr 2020 |