Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-3905
apple mac os x
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to execute arbi...
|
7.8 High | — | 1,4% | 1 Apr 2020 |
|
CVE-2020-3906
apple mac os x
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.4. A maliciously crafted application may be able to bypass code signin...
|
7.8 High | — | 0,98% | 1 Apr 2020 |
|
CVE-2020-3907
apple mac os x
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system ter...
|
7.1 High | — | 0,37% | 1 Apr 2020 |
|
CVE-2020-3881
apple mac os x
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to view sensitive user information.
|
5.5 Medium | — | 0,33% | 1 Apr 2020 |
|
CVE-2020-3883
apple mac os x, apple ipad os +3 lainnya
This issue was addressed with improved checks. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. An application may be able...
|
8.8 High | — | 1,0% | 1 Apr 2020 |
|
CVE-2020-3884
apple mac os x
An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to cause arbitrary javascript code...
|
6.1 Medium | — | 1,1% | 1 Apr 2020 |
|
CVE-2020-3885
apple icloud, apple itunes +4 lainnya
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Wi...
|
4.3 Medium | — | 1,7% | 1 Apr 2020 |
|
CVE-2020-3887
apple icloud, apple itunes +4 lainnya
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Wi...
|
4.3 Medium | — | 1,2% | 1 Apr 2020 |
|
CVE-2020-3888
apple ipad os, apple iphone os
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4. A maliciously crafted page may interfere with other web contexts.
|
4.3 Medium | — | 0,67% | 1 Apr 2020 |
|
CVE-2020-10867
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass inten...
|
9.8 Critical | — | 2,2% | 1 Apr 2020 |
|
CVE-2020-10868
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to launch the R...
|
7.5 High | — | 1,7% | 1 Apr 2020 |
|
CVE-2020-10865
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to make arbitra...
|
7.5 High | — | 1,7% | 1 Apr 2020 |
|
CVE-2020-10866
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to enumerate th...
|
7.5 High | — | 1,2% | 1 Apr 2020 |
|
CVE-2020-10864
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to trigger a re...
|
6.5 Medium | — | 1,6% | 1 Apr 2020 |
|
CVE-2020-10860
avast antivirus
An issue was discovered in Avast Antivirus before 20. An Arbitrary Memory Address Overwrite vulnerability in the aswAvLog Log Library results in Denial of Service of the...
|
7.5 High | — | 2,1% | 1 Apr 2020 |
|
CVE-2020-10861
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to achieve Arbi...
|
7.5 High | — | 1,7% | 1 Apr 2020 |
|
CVE-2020-10862
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to achieve Loca...
|
7.8 High | — | 0,50% | 1 Apr 2020 |
|
CVE-2020-10863
avast antivirus
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to trigger a sh...
|
7.5 High | — | 2,1% | 1 Apr 2020 |
|
CVE-2018-11106
netgear wc7500 firmware, netgear wc7520 firmware +3 lainnya
NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmw...
|
9.8 Critical | — | 2,6% | 1 Apr 2020 |
|
CVE-2019-3942
advantech webaccess
Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recove...
|
7.5 High | — | 1,4% | 1 Apr 2020 |
|
CVE-2019-3944
parrot anafi firmware
Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight.
|
7.5 High | — | 1,6% | 1 Apr 2020 |
|
CVE-2019-3945
parrot anafi firmware
Web server running on Parrot ANAFI can be crashed due to the SDK command "Common_CurrentDateTime" being sent to control service with larger than expected date length.
|
7.5 High | — | 1,1% | 1 Apr 2020 |
|
CVE-2020-11455
limesurvey
LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
|
9.8 Critical | — | 97,2% | 1 Apr 2020 |
|
CVE-2020-11456
limesurvey
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
|
5.4 Medium | — | 70,8% | 1 Apr 2020 |
|
CVE-2020-11457
netgate pfsense
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
|
5.4 Medium | — | 9,3% | 1 Apr 2020 |
|
CVE-2020-11449
technicolor tc7337 firmware
An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf.
|
7.5 High | — | 1,2% | 1 Apr 2020 |
|
CVE-2020-10231
tp-link nc450 firmware, tp-link nc260 firmware +5 lainnya
TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_171205, NC250 through 1.3.0_Build_...
|
7.5 High | — | 3,8% | 1 Apr 2020 |
|
CVE-2020-5391
wp-auth0
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
|
8.8 High | — | 0,85% | 1 Apr 2020 |
|
CVE-2020-5392
wp-auth0
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.
|
6.1 Medium | — | 1,3% | 1 Apr 2020 |
|
CVE-2020-7947
login by auth0
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One i...
|
9.8 Critical | — | 2,8% | 1 Apr 2020 |
|
CVE-2020-7948
login by auth0
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.
|
8.8 High | — | 2,2% | 1 Apr 2020 |
|
CVE-2020-6753
login by auth0
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
|
6.1 Medium | — | 1,3% | 1 Apr 2020 |
|
CVE-2020-5548
yamaha rtx830 firmware, yamaha nvr510 firmware +8 lainnya
Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Router(RTX810...
|
7.5 High | — | 1,4% | 1 Apr 2020 |
|
CVE-2020-7263
mcafee endpoint security
Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alter ENS confi...
|
6.7 Medium | — | 0,17% | 1 Apr 2020 |
|
CVE-2020-7066
php, tenable.sc +2 lainnya
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, t...
|
4.3 Medium | — | 2,8% | 1 Apr 2020 |
|
CVE-2020-7064
php, debian linux +3 lainnya
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to...
|
5.4 Medium | — | 4,3% | 1 Apr 2020 |
|
CVE-2020-7065
php, debian linux +2 lainnya
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrit...
|
8.8 High | — | 4,9% | 1 Apr 2020 |
|
CVE-2020-11445
tp-link nc450 firmware, tp-link nc260 firmware +13 lainnya
TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS e...
|
5.3 Medium | — | 1,8% | 1 Apr 2020 |
|
CVE-2020-10696
buildah project buildah, redhat openshift container platform +1 lainnya
A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an...
|
8.8 High | — | 2,7% | 31 Mar 2020 |
|
CVE-2020-5344
dell idrac7 firmware, dell idrac8 firmware +1 lainnya
Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote att...
|
9.8 Critical | — | 3,8% | 31 Mar 2020 |
|
CVE-2020-5292
leantime
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negativel...
|
8.8 High | — | 1,4% | 31 Mar 2020 |
|
CVE-2020-7009
elasticsearch
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is ab...
|
8.8 High | — | 1,9% | 31 Mar 2020 |
|
CVE-2020-5291
projectatomic bubblewrap, debian linux +2 lainnya
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used t...
|
7.8 High | — | 0,90% | 31 Mar 2020 |
|
CVE-2019-13495
zyxel xgs2210-52hp firmware
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an...
|
5.4 Medium | — | 0,62% | 31 Mar 2020 |
|
CVE-2019-14905
redhat ansible engine, redhat ansible tower +6 lainnya
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can...
|
5.6 Medium | — | 0,71% | 31 Mar 2020 |
|
CVE-2020-11441
phpmyadmin
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: t...
|
6.1 Medium | — | 2,4% | 31 Mar 2020 |
|
CVE-2020-1712
systemd project systemd, redhat ceph storage +5 lainnya
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local un...
|
7.8 High | — | 0,46% | 31 Mar 2020 |
|
CVE-2019-10180
dogtagpki, redhat certificate system
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, pos...
|
4.8 Medium | — | 0,73% | 31 Mar 2020 |
|
CVE-2019-14880
moodle
A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address ch...
|
9.1 Critical | — | 1,1% | 31 Mar 2020 |
|
CVE-2020-6008
lifterlms
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution
|
9.8 Critical | — | 3,8% | 31 Mar 2020 |