Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-1793
huawei mate 20 firmware, huawei mate 30 pro firmware
There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, successful exploi...
|
4.6 Medium | — | 0,25% | 20 Mar 2020 |
|
CVE-2020-1794
huawei mate 20 firmware, huawei mate 30 pro firmware
There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, successful exploi...
|
4.6 Medium | — | 0,25% | 20 Mar 2020 |
|
CVE-2020-1696
redhat certificate system, dogtagpki
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Sc...
|
5.4 Medium | — | 0,76% | 20 Mar 2020 |
|
CVE-2020-10597
deltaww delta industrial automation dopsoft
Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project fi...
|
7.1 High | — | 0,80% | 20 Mar 2020 |
|
CVE-2019-19345
redhat openshift
A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in...
|
7.8 High | — | 0,27% | 20 Mar 2020 |
|
CVE-2019-10179
redhat enterprise linux, dogtagpki
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, en...
|
6.1 Medium | — | 0,94% | 20 Mar 2020 |
|
CVE-2019-10221
redhat enterprise linux, dogtagpki
A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing...
|
6.1 Medium | — | 1,3% | 20 Mar 2020 |
|
CVE-2020-10682
cmsmadesimple cms made simple
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file sh...
|
7.8 High | — | 2,0% | 20 Mar 2020 |
|
CVE-2020-10681
cmsmadesimple cms made simple
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
|
5.4 Medium | — | 0,62% | 20 Mar 2020 |
|
CVE-2019-19484
centreon
Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior.
|
6.1 Medium | — | 0,88% | 20 Mar 2020 |
|
CVE-2019-19486
centreon
Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test.
|
6.5 Medium | — | 1,7% | 20 Mar 2020 |
|
CVE-2019-19487
centreon
Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test.
|
8.8 High | — | 5,3% | 20 Mar 2020 |
|
CVE-2019-19023
linuxfoundation harbor, pivotal vmware harbor registry
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platfor...
|
8.8 High | — | 1,6% | 20 Mar 2020 |
|
CVE-2019-19025
linuxfoundation harbor, pivotal vmware harbor registry
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
|
8.8 High | — | 1,0% | 20 Mar 2020 |
|
CVE-2019-19026
linuxfoundation harbor, pivotal vmware harbor registry
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform...
|
4.9 Medium | — | 1,4% | 20 Mar 2020 |
|
CVE-2019-19029
linuxfoundation harbor, pivotal vmware harbor registry
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
|
7.2 High | — | 2,1% | 20 Mar 2020 |
|
CVE-2020-9343
signotec signopad-api/web
An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because...
|
6.5 Medium | — | 0,94% | 20 Mar 2020 |
|
CVE-2020-9344
atlassian subversion application lifecycle management
Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
|
6.1 Medium | — | 5,2% | 20 Mar 2020 |
|
CVE-2020-9345
signotec signopad-api/web
An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because...
|
6.5 Medium | — | 0,92% | 20 Mar 2020 |
|
CVE-2019-18782
salesagility suitecrm
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.
|
5.3 Medium | — | 0,87% | 20 Mar 2020 |
|
CVE-2019-18785
suitecrm
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.
|
7.5 High | — | 1,0% | 20 Mar 2020 |
|
CVE-2018-20333
asuswrt
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if a USB device is attached to the router and if ther...
|
7.5 High | — | 1,2% | 20 Mar 2020 |
|
CVE-2018-20334
asuswrt
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the f...
|
9.8 Critical | — | 3,8% | 20 Mar 2020 |
|
CVE-2018-20335
asuswrt
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI.
|
7.5 High | — | 1,4% | 20 Mar 2020 |
|
CVE-2019-16108
phpbb
phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
|
7.5 High | — | 1,1% | 20 Mar 2020 |
|
CVE-2019-16072
netsas enigma network management solution
An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of...
|
9.8 Critical | — | 25,9% | 20 Mar 2020 |
|
CVE-2019-16071
netsas enigma nms
Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any settings in the system, only view the...
|
8.8 High | — | 1,0% | 20 Mar 2020 |
|
CVE-2019-16068
netsas enigma network management solution
A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious manage_fil...
|
8.8 High | — | 0,95% | 19 Mar 2020 |
|
CVE-2019-16069
netsas enigma network management solution
A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious co...
|
6.1 Medium | — | 0,69% | 19 Mar 2020 |
|
CVE-2019-16529
mediawiki checkuser
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation of MediaWi...
|
5.3 Medium | — | 0,87% | 19 Mar 2020 |
|
CVE-2020-10669
canon oce colorwave 500 firmware
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able...
|
7.5 High | — | 3,5% | 19 Mar 2020 |
|
CVE-2019-16063
netsas enigma network management solution
NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an attacker to expose unencrypted sensitive data.
|
7.5 High | — | 0,67% | 19 Mar 2020 |
|
CVE-2020-7006
systech nds/5008rm firmware, systech nds-5000 firmware
Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerability could allow information disc...
|
8.4 High | — | 1,7% | 19 Mar 2020 |
|
CVE-2019-15124
mediawiki mobilefrontend
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.
|
6.1 Medium | — | 0,81% | 19 Mar 2020 |
|
CVE-2019-15539
mantisbt
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary...
|
6.1 Medium | — | 1,2% | 19 Mar 2020 |
|
CVE-2020-10667
canon oce colorwave 500 firmware
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulnerable param...
|
6.1 Medium | — | 1,8% | 19 Mar 2020 |
|
CVE-2020-10668
canon oce colorwave 500 firmware
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is...
|
6.1 Medium | — | 1,4% | 19 Mar 2020 |
|
CVE-2020-10670
canon oce colorwave 500 firmware
The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page....
|
6.1 Medium | — | 0,86% | 19 Mar 2020 |
|
CVE-2020-10671
canon oce colorwave 500 firmware
The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrati...
|
8.8 High | — | 0,70% | 19 Mar 2020 |
|
CVE-2020-5267
rubyonrails actionview, debian linux +2 lainnya
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `esc...
|
4.8 Medium | — | 1,5% | 19 Mar 2020 |
|
CVE-2019-20513
open edx
Open edX Ironwood.1 allows support/certificates?user= reflected XSS.
|
6.1 Medium | — | 0,49% | 19 Mar 2020 |
|
CVE-2019-20514
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20515
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20516
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20517
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20518
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20519
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20520
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20521
frappe erpnext
ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
|
6.1 Medium | — | 0,79% | 19 Mar 2020 |
|
CVE-2019-20525
igniterealtime openfire
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.
|
6.1 Medium | — | 0,91% | 19 Mar 2020 |