Katalog CVE (hal. 5075)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.399 (Critical 35.897 · High 103.353 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 253.701–253.750 dari 258.399 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-14872 newlib project newlib The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could result in NU...	6.5 Medium	—	1,5%	19 Mar 2020
CVE-2019-20485 redhat libvirt, debian linux +1 lainnya qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (A...	5.7 Medium	—	0,81%	19 Mar 2020
CVE-2019-19677 arxes-tolina arxes-tolina 3.0.0 allows User Enumeration.	4.3 Medium	—	0,73%	18 Mar 2020
CVE-2019-19676 arxes-tolina A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kundennummer, F...	9.6 Critical	—	1,3%	18 Mar 2020
CVE-2020-10365 logicaldoc LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some...	6.5 Medium	—	1,3%	18 Mar 2020
CVE-2020-10672 fasterxml jackson-databind, debian linux +29 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.X...	8.8 High	—	3,1%	18 Mar 2020
CVE-2020-10673 fasterxml jackson-databind, debian linux +29 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka ca...	8.8 High	—	8,0%	18 Mar 2020
CVE-2020-10674 perlspeak project perlspeak PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open.	9.8 Critical	—	1,3%	18 Mar 2020
CVE-2020-9423 logicaldoc LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a func...	9.8 Critical	—	5,0%	18 Mar 2020
CVE-2020-7256 mcafee network security manager Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecifie...	4.8 Medium	—	0,52%	18 Mar 2020
CVE-2020-7258 mcafee network security manager Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecifie...	4.8 Medium	—	0,52%	18 Mar 2020
CVE-2019-18979 claranova adaware antivirus Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malici...	7.8 High	—	0,48%	18 Mar 2020
CVE-2020-10665 docker desktop Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbi...	6.7 Medium	—	1,4%	18 Mar 2020
CVE-2019-3762 dell emc data protection central, dell emc integrated data protection appliance Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could p...	7.5 High	—	0,65%	18 Mar 2020
CVE-2019-20511 frappe erpnext ERPNext 11.1.47 allows blog?blog_category= Frame Injection.	6.1 Medium	—	0,68%	18 Mar 2020
CVE-2019-20512 open.edx ironwood Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.	6.1 Medium	—	0,41%	18 Mar 2020
CVE-2019-20528 igniterealtime openfire Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.	6.1 Medium	—	0,91%	18 Mar 2020
CVE-2019-20529 frappe In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authentication is...	7.5 High	—	1,3%	18 Mar 2020
CVE-2019-18581 dell emc data protection advisor, dell emc integrated data protection appliance firmware Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulne...	7.2 High	—	3,9%	18 Mar 2020
CVE-2019-18582 dell emc data protection advisor, dell emc integrated data protection appliance firmware Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vul...	7.2 High	—	4,6%	18 Mar 2020
CVE-2019-12921 graphicsmagick, debian linux +2 lainnya In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for SVG.	6.5 Medium	—	8,0%	18 Mar 2020
CVE-2019-12132 onap open network automation platform An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary comm...	9.8 Critical	—	1,5%	18 Mar 2020
CVE-2019-12365 cloudmagic newton The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTER...	6.1 Medium	—	0,99%	18 Mar 2020
CVE-2019-12366 9folders nine The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL...	6.1 Medium	—	0,99%	18 Mar 2020
CVE-2019-12367 blixhq bluemail The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EX...	6.1 Medium	—	0,97%	18 Mar 2020
CVE-2019-12368 edison mail The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EX...	6.1 Medium	—	0,97%	18 Mar 2020
CVE-2019-12369 typeapp The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXT...	6.1 Medium	—	0,97%	18 Mar 2020
CVE-2019-12370 readdle spark The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL...	6.1 Medium	—	1,1%	18 Mar 2020
CVE-2019-12769 solarwinds serv-u managed file transfer SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=...	8.8 High	—	0,77%	18 Mar 2020
CVE-2019-12112 onap open network automation platform An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary comman...	9.8 Critical	—	1,5%	18 Mar 2020
CVE-2019-12113 onap open network automation platform An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary command. Al...	8.8 High	—	1,3%	18 Mar 2020
CVE-2019-12114 onap open network automation platform An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker (who already has access to pod-to-...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12115 onap open network automation platform An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker (who already has access to pod-to-pod commu...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12116 onap open network automation platform An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker (who already has access to pod-to-pod commu...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12117 onap open network automation platform An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker (who already has access to pod-t...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12118 onap open network automation platform An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker (who already has access to pod-to-pod c...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12119 onap open network automation platform An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticated attacker (who already has access to pod-to-pod c...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12120 onap open network automation platform An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker (who already has access to pod-to-pod com...	9.8 Critical	—	2,1%	18 Mar 2020
CVE-2019-12121 onap open network automation platform An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to de...	7.5 High	—	0,73%	18 Mar 2020
CVE-2019-12122 onap open network automation platform An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve th...	6.5 Medium	—	0,58%	18 Mar 2020
CVE-2019-12123 onap open network automation platform An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. A...	8.8 High	—	1,3%	18 Mar 2020
CVE-2019-12124 onap open network automation platform An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file...	9.1 Critical	—	1,2%	18 Mar 2020
CVE-2019-12131 onap open network automation platform An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP header, an attacker may impersonate an arbitrary exist...	9.1 Critical	—	1,2%	18 Mar 2020
CVE-2019-19351 redhat openshift An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use this flaw...	7.0 High	—	0,25%	18 Mar 2020
CVE-2019-19355 redhat openshift An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use thi...	7.0 High	—	0,25%	18 Mar 2020
CVE-2019-19335 redhat openshift During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Bo...	4.4 Medium	—	0,33%	18 Mar 2020
CVE-2019-10178 dogtagpki It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulner...	6.1 Medium	—	0,98%	18 Mar 2020
CVE-2019-14871 newlib project newlib The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0...	6.5 Medium	—	1,0%	18 Mar 2020
CVE-2020-9326 beyondtrust privilege management for windows and mac BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerSh...	7.5 High	—	1,0%	18 Mar 2020
CVE-2019-10146 redhat enterprise linux, dogtagpki A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the ce...	4.7 Medium	—	0,68%	18 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.