Katalog CVE (hal. 5074)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.399 (Critical 35.897 · High 103.353 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 253.651–253.700 dari 258.399 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-20526 igniterealtime openfire Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.	6.1 Medium	—	0,91%	19 Mar 2020
CVE-2019-16064 netsas enigma network management solution NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of...	9.6 Critical	—	1,3%	19 Mar 2020
CVE-2019-16065 netsas enigma network management solution A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and c...	8.8 High	—	2,8%	19 Mar 2020
CVE-2019-16066 netsas enigma network management solution An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. This allows an attacker to upload malicio...	8.8 High	—	2,2%	19 Mar 2020
CVE-2019-16067 netsas enigma network management solution NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication transmitted...	7.5 High	—	0,78%	19 Mar 2020
CVE-2019-16070 netsas enigma network management solution A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious co...	6.1 Medium	—	0,69%	19 Mar 2020
CVE-2019-16337 hancom office neo The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file.	7.8 High	—	1,1%	19 Mar 2020
CVE-2019-16338 hancom office neo The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file.	7.8 High	—	1,0%	19 Mar 2020
CVE-2019-16375 otrs An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An attacker who is...	5.4 Medium	—	1,0%	19 Mar 2020
CVE-2019-15653 comba ap2600-i - a02 - 0202n00pd2 firmware Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains v...	7.5 High	—	0,83%	19 Mar 2020
CVE-2019-15654 comba ac2400 firmware Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The re...	7.5 High	—	1,6%	19 Mar 2020
CVE-2019-15655 dlink dsl-2875al firmware D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't re...	7.5 High	—	1,4%	19 Mar 2020
CVE-2019-15656 dlink dsl-2875al firmware, dlink dsl-2877al firmware D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server becaus...	7.5 High	—	1,3%	19 Mar 2020
CVE-2019-16061 netsas enigma network management solution A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing any low privileged user with a...	8.8 High	—	0,99%	19 Mar 2020
CVE-2019-16062 netsas enigma network management solution NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for an attacker to expose unencrypted sensitive data.	6.5 Medium	—	0,76%	19 Mar 2020
CVE-2019-12125 onap open network automation platform In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to t...	9.8 Critical	—	1,2%	19 Mar 2020
CVE-2019-12126 onap open network automation platform In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the...	9.8 Critical	—	1,2%	19 Mar 2020
CVE-2019-12127 onap open network automation platform In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the r...	9.8 Critical	—	1,2%	19 Mar 2020
CVE-2020-5262 easybuild project easybuild In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is sh...	5.5 Medium	—	0,55%	19 Mar 2020
CVE-2019-11361 zohocorp manageengine remote access plus Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover.	8.8 High	—	3,0%	19 Mar 2020
CVE-2019-16382 ivanti workspace control An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by Powe...	9.8 Critical	—	2,9%	19 Mar 2020
CVE-2020-3264 cisco sd-wan firmware A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due...	7.1 High	—	0,73%	19 Mar 2020
CVE-2020-3265 cisco sd-wan firmware A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulne...	7.8 High	—	0,38%	19 Mar 2020
CVE-2020-3266 cisco sd-wan firmware A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile...	7.8 High	—	0,56%	19 Mar 2020
CVE-2019-14878 newlib project newlib In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check...	6.5 Medium	—	1,3%	19 Mar 2020
CVE-2019-16010 cisco sd-wan firmware A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a...	4.8 Medium	—	0,80%	19 Mar 2020
CVE-2019-16012 cisco sd-wan firmware A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected syst...	8.1 High	—	54,2%	19 Mar 2020
CVE-2020-1705 redhat template service broker operator A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/pas...	7.0 High	—	0,26%	19 Mar 2020
CVE-2019-14874 newlib project newlib In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check...	6.5 Medium	—	1,5%	19 Mar 2020
CVE-2019-14875 newlib project newlib In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no...	6.5 Medium	—	1,3%	19 Mar 2020
CVE-2019-14876 newlib project newlib In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no ch...	6.5 Medium	—	1,5%	19 Mar 2020
CVE-2019-14877 newlib project newlib In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, however no chec...	6.5 Medium	—	1,3%	19 Mar 2020
CVE-2019-14873 newlib project newlib In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, however no check...	6.5 Medium	—	1,5%	19 Mar 2020
CVE-2014-2721 fortinet fortibalancer 400 firmware, fortinet fortibalancer 1000 firmware +2 lainnya In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to a...	8.8 High	—	2,3%	19 Mar 2020
CVE-2014-2722 fortinet fortibalancer 400 firmware, fortinet fortibalancer 1000 firmware +2 lainnya In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to a...	8.8 High	—	1,7%	19 Mar 2020
CVE-2014-2723 fortinet fortibalancer 400 firmware, fortinet fortibalancer 1000 firmware +2 lainnya In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to a...	8.8 High	—	1,7%	19 Mar 2020
CVE-2020-10678 octopus deploy In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate...	8.8 High	—	1,0%	19 Mar 2020
CVE-2019-12416 apache deltaspike we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the...	6.1 Medium	—	2,7%	19 Mar 2020
CVE-2019-20524 ilch cms ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.	6.1 Medium	—	0,70%	19 Mar 2020
CVE-2019-20527 igniterealtime openfire Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.	6.1 Medium	—	0,91%	19 Mar 2020
CVE-2020-10675 jsonparser project jsonparser, fedoraproject fedora The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.	7.5 High	—	2,6%	19 Mar 2020
CVE-2020-10648 denx u-boot, opensuse leap Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system confi...	7.8 High	—	1,4%	19 Mar 2020
CVE-2020-4203 ibm datapower gateway IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls. IBM X-Fo...	4.9 Medium	—	1,3%	19 Mar 2020
CVE-2020-4205 ibm datapower gateway IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even after authen...	6.3 Medium	—	0,53%	19 Mar 2020
CVE-2019-20522 ilch cms ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter.	6.1 Medium	—	0,69%	19 Mar 2020
CVE-2019-20523 ilch cms ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.	6.1 Medium	—	0,70%	19 Mar 2020
CVE-2019-12128 onap open network automation platform In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the re...	9.8 Critical	—	1,7%	19 Mar 2020
CVE-2019-12129 onap open network automation platform In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the r...	9.8 Critical	—	1,7%	19 Mar 2020
CVE-2019-12130 onap open network automation platform In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the r...	9.8 Critical	—	1,7%	19 Mar 2020
CVE-2019-19336 ovirt-engine, redhat virtualization A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML respon...	6.1 Medium	—	0,96%	19 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.