Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-20633
gnu patch
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted pa...
|
5.5 Medium | — | 1,0% | 25 Mar 2020 |
|
CVE-2020-10649
asus device activation
DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions when a user...
|
7.8 High | — | 0,60% | 25 Mar 2020 |
|
CVE-2019-7240
moo0 system monitor
An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x9C402088 and does not properly filte...
|
7.2 High | — | 2,4% | 25 Mar 2020 |
|
CVE-2019-7244
aida64
An issue was discovered in kerneld.sys in AIDA64 before 5.99. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x80112084 and does not properly filter the Mode...
|
7.2 High | — | 2,4% | 25 Mar 2020 |
|
CVE-2019-7245
techpowerup gpu-z
An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. The vulnerable driver exposes a wrmsr instruction via an IOCTL and does not properly filter the M...
|
7.2 High | — | 2,5% | 25 Mar 2020 |
|
CVE-2019-7630
gigabyte app center
An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does not properly...
|
7.2 High | — | 3,1% | 25 Mar 2020 |
|
CVE-2020-1957
apache shiro, debian linux
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
|
9.8 Critical | — | 23,3% | 25 Mar 2020 |
|
CVE-2020-3792
adobe acrobat dc, adobe acrobat reader dc
Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and e...
|
9.8 Critical | — | 4,9% | 25 Mar 2020 |
|
CVE-2020-3793
adobe acrobat dc, adobe acrobat reader dc
Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and e...
|
9.8 Critical | — | 4,9% | 25 Mar 2020 |
|
CVE-2020-3795
adobe acrobat dc, adobe acrobat reader dc
Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and e...
|
9.8 Critical | — | 4,2% | 25 Mar 2020 |
|
CVE-2020-3797
adobe acrobat dc, adobe acrobat reader dc
Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and e...
|
9.8 Critical | — | 3,9% | 25 Mar 2020 |
|
CVE-2020-3799
adobe acrobat dc, adobe acrobat reader dc
Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006.30510 and e...
|
9.8 Critical | — | 6,3% | 25 Mar 2020 |
|
CVE-2020-9375
tp-link archer c50
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Refer...
|
7.5 High | — | 26,7% | 25 Mar 2020 |
|
CVE-2019-19127
tribalgroup sits
An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencrypted commun...
|
8.1 High | — | 1,3% | 25 Mar 2020 |
|
CVE-2020-10788
it-novum openitcockpit
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.
|
9.1 Critical | — | 1,6% | 25 Mar 2020 |
|
CVE-2020-10789
it-novum openitcockpit
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command l...
|
9.8 Critical | — | 2,0% | 25 Mar 2020 |
|
CVE-2020-10790
it-novum openitcockpit
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
|
5.4 Medium | — | 0,91% | 25 Mar 2020 |
|
CVE-2020-10791
it-novum openitcockpit
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (a...
|
6.5 Medium | — | 1,2% | 25 Mar 2020 |
|
CVE-2020-5558
cutephp cutenews
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.
|
8.8 High | — | 2,1% | 25 Mar 2020 |
|
CVE-2020-5559
wl-enq project wl-enq
Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
6.1 Medium | — | 0,77% | 25 Mar 2020 |
|
CVE-2020-5560
wl-enq project wl-enq
WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors.
|
9.8 Critical | — | 2,3% | 25 Mar 2020 |
|
CVE-2020-5561
keijiban tsumiki project keijiban tsumiki
Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
|
9.8 Critical | — | 2,3% | 25 Mar 2020 |
|
CVE-2020-5261
sustainsys saml2
Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Det...
|
6.8 Medium | — | 1,5% | 25 Mar 2020 |
|
CVE-2020-5552
mailform
Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
6.1 Medium | — | 0,77% | 25 Mar 2020 |
|
CVE-2020-5553
mailform
mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors.
|
9.8 Critical | — | 2,3% | 25 Mar 2020 |
|
CVE-2020-5554
shihonkanri plus goout project shihonkanri plus goout
Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified vectors.
|
9.1 Critical | — | 1,9% | 25 Mar 2020 |
|
CVE-2020-5555
shihonkanri plus goout project shihonkanri plus goout
Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unspecified...
|
9.1 Critical | — | 1,3% | 25 Mar 2020 |
|
CVE-2020-5556
shihonkanri plus goout project shihonkanri plus goout
Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
|
9.8 Critical | — | 2,3% | 25 Mar 2020 |
|
CVE-2020-5557
cutephp cutenews
Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
6.1 Medium | — | 0,77% | 25 Mar 2020 |
|
CVE-2020-6802
mozilla bleach, fedoraproject fedora
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
|
6.1 Medium | — | 1,7% | 24 Mar 2020 |
|
CVE-2020-6816
mozilla bleach, fedoraproject fedora
In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
|
6.1 Medium | — | 1,3% | 24 Mar 2020 |
|
CVE-2020-10942
linux kernel, opensuse leap +2 lainnya
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corrup...
|
5.3 Medium | — | 1,00% | 24 Mar 2020 |
|
CVE-2019-4001
druva insync
Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code.
|
7.8 High | — | 0,57% | 24 Mar 2020 |
|
CVE-2020-6991
moxa eds-g516e firmware, moxa eds-510e firmware
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.
|
9.8 Critical | — | 1,5% | 24 Mar 2020 |
|
CVE-2020-6997
moxa eds-g516e firmware, moxa eds-510e firmware
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext.
|
7.5 High | — | 0,97% | 24 Mar 2020 |
|
CVE-2020-7001
moxa eds-g516e firmware, moxa eds-510e firmware
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to be disclose...
|
7.5 High | — | 0,97% | 24 Mar 2020 |
|
CVE-2020-7007
moxa eds-g516e firmware, moxa eds-510e firmware
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service.
|
9.8 Critical | — | 2,9% | 24 Mar 2020 |
|
CVE-2020-8984
zendto
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
|
7.5 High | — | 0,49% | 24 Mar 2020 |
|
CVE-2020-8985
zendto
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
|
8.8 High | — | 0,51% | 24 Mar 2020 |
|
CVE-2020-8986
zendto
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative ac...
|
9.8 Critical | — | 1,5% | 24 Mar 2020 |
|
CVE-2020-6978
honeywell win-pak
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries.
|
7.2 High | — | 0,78% | 24 Mar 2020 |
|
CVE-2020-6979
moxa eds-g516e firmware, moxa eds-510e firmware
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential data can b...
|
7.5 High | — | 1,5% | 24 Mar 2020 |
|
CVE-2020-6981
moxa eds-g516e firmware, moxa eds-510e firmware
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.
|
9.8 Critical | — | 2,3% | 24 Mar 2020 |
|
CVE-2020-6982
honeywell win-pak
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
|
8.8 High | — | 1,1% | 24 Mar 2020 |
|
CVE-2020-6071
videolabs libmicrodns, debian linux
An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS...
|
7.5 High | — | 2,5% | 24 Mar 2020 |
|
CVE-2020-6072
videolabs libmicrodns, debian linux
An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the...
|
9.8 Critical | — | 3,8% | 24 Mar 2020 |
|
CVE-2020-6073
videolabs libmicrodns, debian linux
An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT reco...
|
7.5 High | — | 2,5% | 24 Mar 2020 |
|
CVE-2020-6077
videolabs libmicrodns, debian linux
An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation...
|
7.5 High | — | 2,5% | 24 Mar 2020 |
|
CVE-2020-6078
videolabs libmicrodns, debian linux
An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the re...
|
7.5 High | — | 3,1% | 24 Mar 2020 |
|
CVE-2020-6079
videolabs libmicrodns, debian linux
An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS mess...
|
7.5 High | — | 3,1% | 24 Mar 2020 |