Katalog CVE (hal. 5065)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.538 (Critical 35.913 · High 103.408 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 253.201–253.250 dari 258.538 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-4241 ibm spectrum protect plus, ibm spectrum scale IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending...	8.8 High	—	66,3%	31 Mar 2020
CVE-2020-4242 ibm spectrum protect plus, ibm spectrum scale IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending...	8.8 High	—	4,6%	31 Mar 2020
CVE-2020-4238 ibm tivoli netcool/impact IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions...	8.8 High	—	0,53%	31 Mar 2020
CVE-2020-4239 ibm tivoli netcool/impact IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in th...	5.3 Medium	—	1,8%	31 Mar 2020
CVE-2020-4240 ibm spectrum protect plus IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL reques...	6.5 Medium	—	2,0%	31 Mar 2020
CVE-2020-4236 ibm tivoli netcool/impact IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow an authenticated user to cause a denial of service due to improper content parsing in the project managemen...	6.5 Medium	—	1,4%	31 Mar 2020
CVE-2020-4237 ibm tivoli netcool/impact IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions...	8.8 High	—	0,53%	31 Mar 2020
CVE-2020-4235 ibm tivoli netcool/impact IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI...	5.4 Medium	—	0,67%	31 Mar 2020
CVE-2020-4208 ibm spectrum protect plus IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication...	9.8 Critical	—	1,8%	31 Mar 2020
CVE-2020-4214 ibm spectrum protect plus IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied input. IBM X-...	7.5 High	—	1,6%	31 Mar 2020
CVE-2020-4206 ibm spectrum protect plus IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper...	8.8 High	—	4,6%	31 Mar 2020
CVE-2019-2391 mongodb js-bson Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. T...	5.4 Medium	—	0,77%	31 Mar 2020
CVE-2020-10595 pam-krb5 project pam-krb5, debian linux pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a b...	9.8 Critical	—	4,8%	31 Mar 2020
CVE-2020-11414 telerik ui for silverlight An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provi...	7.5 High	—	1,2%	31 Mar 2020
CVE-2020-11111 fasterxml jackson-databind, debian linux +23 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, ac...	8.8 High	—	3,6%	31 Mar 2020
CVE-2020-11112 fasterxml jackson-databind, debian linux +29 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting....	8.8 High	—	3,6%	31 Mar 2020
CVE-2020-11113 fasterxml jackson-databind, debian linux +30 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRun...	8.8 High	—	6,3%	31 Mar 2020
CVE-2020-11104 usc cereal An issue was discovered in USC iLab cereal through 1.3.0. Serialization of an (initialized) C/C++ long double variable into a BinaryArchive or PortableBinaryArchive leaks...	5.3 Medium	—	1,6%	30 Mar 2020
CVE-2020-11105 usc cereal An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes...	9.8 Critical	—	2,0%	30 Mar 2020
CVE-2020-11106 tecrail responsive filemanager An issue was discovered in Responsive Filemanager through 9.14.0. In the dialog.php page, the session variable $_SESSION['RF']["view_type"] wasn't sanitized if it was alr...	6.1 Medium	—	0,91%	30 Mar 2020
CVE-2020-10374 paessler prtg network monitor A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what para...	9.8 Critical	—	4,7%	30 Mar 2020
CVE-2020-5284 zeit next.js Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does no...	4.3 Medium	—	44,8%	30 Mar 2020
CVE-2020-5289 elide In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one oth...	6.5 Medium	—	1,3%	30 Mar 2020
CVE-2020-7611 objectcomputing micronaut All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not valid...	9.8 Critical	—	1,8%	30 Mar 2020
CVE-2020-9055 versiant lynx customer service portal Versiant LYNX Customer Service Portal (CSP), version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert mali...	5.4 Medium	—	0,51%	30 Mar 2020
CVE-2019-9507 vertiv avocent umg-4000 firmware The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code syntax before ex...	7.2 High	—	2,2%	30 Mar 2020
CVE-2019-9508 vertiv avocent umg-4000 firmware The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to stored XSS. A remote attacker authenticated with an administrator account could store a...	3.5 Low	—	0,63%	30 Mar 2020
CVE-2019-9509 vertiv avocent umg-4000 firmware The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web application does not neutralize user-c...	5.4 Medium	—	0,92%	30 Mar 2020
CVE-2019-19605 x-plane X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution.	9.8 Critical	—	2,2%	30 Mar 2020
CVE-2019-19606 x-plane X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to a remote sy...	9.8 Critical	—	2,4%	30 Mar 2020
CVE-2019-19912 intland codebeamer In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arb...	4.8 Medium	—	0,80%	30 Mar 2020
CVE-2019-19913 intland codebeamer In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter.	4.8 Medium	—	0,70%	30 Mar 2020
CVE-2019-20634 proofpoint email protection An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-cat Machine...	3.7 Low	—	1,6%	30 Mar 2020
CVE-2020-5724 grandstream ucm6202 firmware, grandstream ucm6204 firmware +1 lainnya The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke...	7.5 High	—	12,2%	30 Mar 2020
CVE-2020-5725 grandstream ucm6202 firmware, grandstream ucm6204 firmware +1 lainnya The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke...	5.9 Medium	—	1,8%	30 Mar 2020
CVE-2020-5726 grandstream ucm6202 firmware, grandstream ucm6204 firmware +1 lainnya The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challe...	7.5 High	—	4,3%	30 Mar 2020
CVE-2020-5723 grandstream ucm6202 firmware, grandstream ucm6204 firmware +1 lainnya The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain e...	9.8 Critical	—	5,9%	30 Mar 2020
CVE-2020-5255 sensiolabs symfony In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in...	4.3 Medium	—	1,3%	30 Mar 2020
CVE-2020-5274 sensiolabs symfony In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the st...	5.4 Medium	—	1,2%	30 Mar 2020
CVE-2020-5275 sensiolabs symfony In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the a...	8.1 High	—	1,1%	30 Mar 2020
CVE-2016-11023 odata4j project odata4j odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.	9.8 Critical	—	1,4%	30 Mar 2020
CVE-2016-11024 odata4j project odata4j odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.	9.8 Critical	—	1,4%	30 Mar 2020
CVE-2020-7599 gradle plugin publishing All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin...	6.5 Medium	—	0,48%	30 Mar 2020
CVE-2020-7610 mongodb bson All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases...	9.8 Critical	—	2,3%	30 Mar 2020
CVE-2019-17560 apache netbeans, oracle graalvm The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of auto...	9.1 Critical	—	2,3%	30 Mar 2020
CVE-2019-17561 apache netbeans, oracle graalvm The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans...	7.5 High	—	1,7%	30 Mar 2020
CVE-2020-8509 zohocorp manageengine desktop central Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.	7.5 High	—	10,6%	30 Mar 2020
CVE-2019-7755 weberp In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL qu...	8.8 High	—	2,1%	30 Mar 2020
CVE-2020-10560 opensource-socialnetwork open source social network An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with t...	5.9 Medium	—	3,8%	30 Mar 2020
CVE-2020-5527 mitsubishielectric cr800-q firmware, mitsubishielectric fx3g firmware +44 lainnya When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSE...	7.5 High	—	1,4%	30 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.