Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-10682
django-nopassword project django-nopassword
django-nopassword before 5.0.0 stores cleartext secrets in the database.
|
7.5 High | — | 1,2% | 18 Mar 2020 |
|
CVE-2019-11688
asustor exfat driver
An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asustornasapi.asu...
|
7.4 High | — | 1,1% | 18 Mar 2020 |
|
CVE-2019-11689
asustor exfat driver
An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses a...
|
8.1 High | — | 3,2% | 18 Mar 2020 |
|
CVE-2020-9324
aquaforest tiff server
Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.
|
7.5 High | — | 1,4% | 18 Mar 2020 |
|
CVE-2020-9325
aquaforest tiff server
Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download.
|
7.5 High | — | 1,8% | 18 Mar 2020 |
|
CVE-2020-9323
aquaforest tiff server
Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.
|
5.3 Medium | — | 1,6% | 18 Mar 2020 |
|
CVE-2020-6976
deltaww cncsoft screeneditor
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially crafted, malicio...
|
5.5 Medium | — | 0,83% | 18 Mar 2020 |
|
CVE-2020-4199
ibm tivoli netcool/omnibus
IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from...
|
4.3 Medium | — | 0,49% | 18 Mar 2020 |
|
CVE-2020-7002
deltaww cncsoft screeneditor
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. Multiple stack-based buffer overflows can be exploited when a valid user opens a specially crafted,...
|
7.8 High | — | 1,1% | 18 Mar 2020 |
|
CVE-2020-9443
zulipchat zulip desktop
Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially...
|
6.1 Medium | — | 0,64% | 18 Mar 2020 |
|
CVE-2019-14883
moodle
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a us...
|
5.3 Medium | — | 1,1% | 18 Mar 2020 |
|
CVE-2019-14884
moodle
A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.
|
6.1 Medium | — | 0,93% | 18 Mar 2020 |
|
CVE-2019-14881
moodle
A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.
|
6.1 Medium | — | 1,1% | 18 Mar 2020 |
|
CVE-2019-14882
moodle
A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
|
6.1 Medium | — | 1,1% | 18 Mar 2020 |
|
CVE-2020-3922
armorx lisomail
LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.
|
9.8 Critical | — | 1,5% | 18 Mar 2020 |
|
CVE-2020-10659
entrustdatacard entelligence security provider
Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for example) a us...
|
4.3 Medium | — | 0,38% | 18 Mar 2020 |
|
CVE-2020-8468
trendmicro apex one, trendmicro officescan +1 lainnya
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could...
|
8.8 High | KEV | 6,2% | 18 Mar 2020 |
|
CVE-2020-8470
trendmicro apex one, trendmicro officescan +1 lainnya
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to...
|
7.5 High | — | 4,6% | 18 Mar 2020 |
|
CVE-2020-8598
trendmicro apex one, trendmicro officescan +1 lainnya
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a remote attac...
|
9.8 Critical | — | 13,2% | 18 Mar 2020 |
|
CVE-2020-8599
trendmicro apex one, trendmicro officescan
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affe...
|
9.8 Critical | KEV | 11,9% | 18 Mar 2020 |
|
CVE-2020-8600
trendmicro worry-free business security
Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key file to bypa...
|
9.8 Critical | — | 4,2% | 18 Mar 2020 |
|
CVE-2020-8467
trendmicro apex one, trendmicro officescan
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affec...
|
8.8 High | KEV | 10,9% | 18 Mar 2020 |
|
CVE-2019-11939
facebook thrift
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send sh...
|
7.5 High | — | 1,6% | 18 Mar 2020 |
|
CVE-2020-3950
vmware fusion, vmware horizon client +1 lainnya
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privile...
|
7.8 High | KEV | 7,3% | 17 Mar 2020 |
|
CVE-2020-3951
vmware horizon client, vmware workstation
VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerability due to a heap-overflow issue...
|
3.8 Low | — | 0,27% | 17 Mar 2020 |
|
CVE-2020-1720
postgresql, redhat decision manager +2 lainnya
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw...
|
6.5 Medium | — | 1,2% | 17 Mar 2020 |
|
CVE-2020-10596
opencart
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
|
5.4 Medium | — | 2,7% | 17 Mar 2020 |
|
CVE-2020-10120
cpanel
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
|
7.2 High | — | 2,7% | 17 Mar 2020 |
|
CVE-2020-10121
cpanel
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
|
9.8 Critical | — | 1,8% | 17 Mar 2020 |
|
CVE-2020-10122
cpanel
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
|
6.5 Medium | — | 0,87% | 17 Mar 2020 |
|
CVE-2020-10113
cpanel
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
|
6.1 Medium | — | 0,64% | 17 Mar 2020 |
|
CVE-2020-10114
cpanel
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
|
6.1 Medium | — | 0,64% | 17 Mar 2020 |
|
CVE-2020-10115
cpanel
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).
|
7.2 High | — | 1,8% | 17 Mar 2020 |
|
CVE-2020-10116
cpanel
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
|
5.3 Medium | — | 0,84% | 17 Mar 2020 |
|
CVE-2020-10117
cpanel
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
|
9.1 Critical | — | 1,0% | 17 Mar 2020 |
|
CVE-2020-10118
cpanel
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
|
9.1 Critical | — | 1,0% | 17 Mar 2020 |
|
CVE-2020-10119
cpanel
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
|
9.8 Critical | — | 2,2% | 17 Mar 2020 |
|
CVE-2019-20494
cpanel
In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).
|
3.3 Low | — | 0,30% | 17 Mar 2020 |
|
CVE-2019-20495
cpanel
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
|
6.5 Medium | — | 0,99% | 17 Mar 2020 |
|
CVE-2019-20496
cpanel
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
|
5.5 Medium | — | 0,29% | 17 Mar 2020 |
|
CVE-2019-20497
cpanel
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
|
5.4 Medium | — | 0,61% | 17 Mar 2020 |
|
CVE-2019-20498
cpanel
cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
|
9.8 Critical | — | 1,6% | 17 Mar 2020 |
|
CVE-2019-20490
cpanel
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
|
8.8 High | — | 1,1% | 17 Mar 2020 |
|
CVE-2019-20492
cpanel
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
|
8.8 High | — | 1,3% | 17 Mar 2020 |
|
CVE-2019-20493
cpanel
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
|
6.1 Medium | — | 0,74% | 17 Mar 2020 |
|
CVE-2019-11074
paessler prtg network monitor
A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYST...
|
7.2 High | — | 4,5% | 17 Mar 2020 |
|
CVE-2018-18576
incsub hustle
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
|
5.3 Medium | — | 1,4% | 17 Mar 2020 |
|
CVE-2018-21037
intelliants subrion
Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.
|
8.8 High | — | 0,51% | 17 Mar 2020 |
|
CVE-2019-20452
pydio
A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager....
|
8.8 High | — | 2,1% | 17 Mar 2020 |
|
CVE-2019-20453
pydio
A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An...
|
8.8 High | — | 2,1% | 17 Mar 2020 |