Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-5551
toyota display control unit
Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrar...
|
8.8 High | — | 1,4% | 30 Mar 2020 |
|
CVE-2020-10940
phoenixcontact portico server 1 client, phoenixcontact portico server 16 client +1 lainnya
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
|
7.8 High | — | 0,30% | 27 Mar 2020 |
|
CVE-2020-10939
phoenixcontact pc worx srt
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
|
7.8 High | — | 0,30% | 27 Mar 2020 |
|
CVE-2020-6095
gstreamer project gst-rtsp-server, opensuse backports sle +1 lainnya
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cau...
|
7.5 High | — | 2,9% | 27 Mar 2020 |
|
CVE-2020-10817
custom searchable data entry system project custom searchable data entry system
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontin...
|
8.8 High | — | 1,8% | 27 Mar 2020 |
|
CVE-2020-10952
gitlab
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
|
6.5 Medium | — | 0,75% | 27 Mar 2020 |
|
CVE-2020-10953
gitlab
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
|
7.5 High | — | 1,6% | 27 Mar 2020 |
|
CVE-2020-10954
gitlab
GitLab through 12.9 is affected by a potential DoS in repository archive download.
|
7.5 High | — | 1,1% | 27 Mar 2020 |
|
CVE-2020-10955
gitlab, debian linux
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders...
|
6.5 Medium | — | 1,0% | 27 Mar 2020 |
|
CVE-2020-10956
gitlab
GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
|
9.8 Critical | — | 1,4% | 27 Mar 2020 |
|
CVE-2020-5857
f5 big-ip access policy manager, f5 big-ip advanced firewall manager +10 lainnya
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.
|
7.5 High | — | 1,0% | 27 Mar 2020 |
|
CVE-2020-5858
f5 big-iq centralized management, f5 big-ip access policy manager +11 lainnya
On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrat...
|
7.8 High | — | 0,45% | 27 Mar 2020 |
|
CVE-2020-5859
f5 big-ip access policy manager, f5 big-ip advanced firewall manager +9 lainnya
On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.
|
7.5 High | — | 1,0% | 27 Mar 2020 |
|
CVE-2020-5860
f5 big-iq centralized management, f5 big-ip access policy manager +10 lainnya
On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (...
|
8.1 High | — | 0,85% | 27 Mar 2020 |
|
CVE-2020-5861
f5 big-ip access policy manager, f5 big-ip advanced firewall manager +9 lainnya
On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors.
|
7.5 High | — | 1,0% | 27 Mar 2020 |
|
CVE-2020-5862
f5 big-ip access policy manager, f5 big-ip advanced firewall manager +9 lainnya
On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS sy...
|
7.5 High | — | 1,1% | 27 Mar 2020 |
|
CVE-2020-5863
f5 nginx controller, netapp cloud backup
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which i...
|
8.6 High | — | 1,2% | 27 Mar 2020 |
|
CVE-2020-8551
kubernetes, fedoraproject fedora
The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, inclu...
|
6.5 Medium | — | 1,2% | 27 Mar 2020 |
|
CVE-2020-8552
kubernetes, fedoraproject fedora
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via succes...
|
4.3 Medium | — | 2,4% | 27 Mar 2020 |
|
CVE-2015-5684
lenovo b50-10 firmware, lenovo flex 2 pro-15 firmware +25 lainnya
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) i...
|
9.8 Critical | — | 3,7% | 27 Mar 2020 |
|
CVE-2015-7333
lenovo system update
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed...
|
7.8 High | — | 0,35% | 27 Mar 2020 |
|
CVE-2015-7334
lenovo system update
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed...
|
7.8 High | — | 0,36% | 27 Mar 2020 |
|
CVE-2015-7335
lenovo system update
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System...
|
7.0 High | — | 0,23% | 27 Mar 2020 |
|
CVE-2015-7336
lenovo system update
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System U...
|
7.5 High | — | 0,59% | 27 Mar 2020 |
|
CVE-2015-8534
lenovo solution center
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and publicly disclose...
|
7.8 High | — | 0,36% | 27 Mar 2020 |
|
CVE-2015-8535
lenovo solution center
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 20...
|
7.8 High | — | 0,76% | 27 Mar 2020 |
|
CVE-2015-8536
lenovo solution center
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Soluti...
|
8.8 High | — | 0,45% | 27 Mar 2020 |
|
CVE-2020-10607
advantech webaccess
In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data ma...
|
8.8 High | — | 2,1% | 27 Mar 2020 |
|
CVE-2020-7918
totemomail
An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enum...
|
5.4 Medium | — | 0,73% | 27 Mar 2020 |
|
CVE-2020-1769
otrs, opensuse backports sle +1 lainnya
In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((...
|
4.3 Medium | — | 1,2% | 27 Mar 2020 |
|
CVE-2020-1770
otrs, opensuse backports sle +2 lainnya
Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prio...
|
4.3 Medium | — | 1,3% | 27 Mar 2020 |
|
CVE-2020-1771
otrs
Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due...
|
5.4 Medium | — | 1,0% | 27 Mar 2020 |
|
CVE-2020-1772
otrs, opensuse backports sle +2 lainnya
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already reques...
|
7.5 High | — | 1,6% | 27 Mar 2020 |
|
CVE-2020-1773
otrs
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict o...
|
8.1 High | — | 1,5% | 27 Mar 2020 |
|
CVE-2020-10509
sun ehrd
Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the sys...
|
6.1 Medium | — | 0,86% | 27 Mar 2020 |
|
CVE-2020-10510
sun ehrd
Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access...
|
6.5 Medium | — | 1,1% | 27 Mar 2020 |
|
CVE-2020-10508
sun ehrd
Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.
|
7.5 High | — | 1,5% | 27 Mar 2020 |
|
CVE-2020-3920
unisoon ultralog express firmware
UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to...
|
8.1 High | — | 0,84% | 27 Mar 2020 |
|
CVE-2020-3921
unisoon ultralog express firmware
UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.
|
7.5 High | — | 0,71% | 27 Mar 2020 |
|
CVE-2020-3936
unisoon ultralog express firmware
UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.
|
9.8 Critical | — | 1,2% | 27 Mar 2020 |
|
CVE-2020-10990
accenture mercury
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
|
9.8 Critical | — | 1,2% | 27 Mar 2020 |
|
CVE-2020-10991
mulesoft aplkit
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
|
9.8 Critical | — | 1,4% | 27 Mar 2020 |
|
CVE-2020-10992
azkaban project azkaban
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
|
9.8 Critical | — | 1,3% | 27 Mar 2020 |
|
CVE-2020-10993
osmand
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
|
9.1 Critical | — | 1,3% | 27 Mar 2020 |
|
CVE-2020-9467
piwigo
Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
|
5.4 Medium | — | 23,8% | 26 Mar 2020 |
|
CVE-2020-9468
piwigo
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id p...
|
4.3 Medium | — | 0,58% | 26 Mar 2020 |
|
CVE-2020-10823
draytek vigor300b firmware, draytek vigor3900 firmware +1 lainnya
A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers t...
|
9.8 Critical | — | 4,4% | 26 Mar 2020 |
|
CVE-2020-10824
draytek vigor300b firmware, draytek vigor3900 firmware +1 lainnya
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attacker...
|
9.8 Critical | — | 4,1% | 26 Mar 2020 |
|
CVE-2020-10825
draytek vigor300b firmware, draytek vigor3900 firmware +1 lainnya
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows r...
|
9.8 Critical | — | 4,1% | 26 Mar 2020 |
|
CVE-2020-10826
draytek vigor300b firmware, draytek vigor3900 firmware +1 lainnya
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request i...
|
9.8 Critical | — | 39,4% | 26 Mar 2020 |