Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-10380
r-consortium rmysql
RMySQL through 0.10.19 allows SQL Injection.
|
9.8 Critical | — | 1,1% | 17 Mar 2020 |
|
CVE-2020-6646
fortinet fortiweb
An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclai...
|
5.4 Medium | — | 0,80% | 17 Mar 2020 |
|
CVE-2019-20407
atlassian jira data center, atlassian jira server
The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version info...
|
4.3 Medium | — | 1,2% | 17 Mar 2020 |
|
CVE-2019-20105
atlassian application links
The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before versi...
|
4.9 Medium | — | 1,5% | 17 Mar 2020 |
|
CVE-2020-8787
salesagility suitecrm
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
|
7.5 High | — | 0,88% | 16 Mar 2020 |
|
CVE-2020-9346
zohocorp manageengine password manager pro
Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.
|
8.8 High | — | 2,2% | 16 Mar 2020 |
|
CVE-2020-9347
zohocorp manageengine password manager pro
Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. N...
|
9.8 Critical | — | 7,8% | 16 Mar 2020 |
|
CVE-2020-7982
openwrt lede, openwrt
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents c...
|
8.1 High | — | 1,6% | 16 Mar 2020 |
|
CVE-2020-8783
salesagility suitecrm
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
|
9.8 Critical | — | 1,1% | 16 Mar 2020 |
|
CVE-2020-8784
salesagility suitecrm
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
|
9.8 Critical | — | 1,1% | 16 Mar 2020 |
|
CVE-2020-8785
salesagility suitecrm
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
|
9.8 Critical | — | 1,1% | 16 Mar 2020 |
|
CVE-2020-8786
salesagility suitecrm
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
|
9.8 Critical | — | 1,1% | 16 Mar 2020 |
|
CVE-2019-20191
sync oxygen xml author, sync oxygen xml developer +1 lainnya
Oxygen XML Editor 21.1.1 allows XXE to read any file.
|
7.5 High | — | 1,1% | 16 Mar 2020 |
|
CVE-2019-20326
gnome gthumb, linuxmint pix +1 lainnya
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix...
|
7.8 High | — | 2,1% | 16 Mar 2020 |
|
CVE-2019-19538
sangoma freepbx
In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege...
|
7.2 High | — | 3,1% | 16 Mar 2020 |
|
CVE-2019-19610
halvotec raquest
An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.
|
5.4 Medium | — | 0,87% | 16 Mar 2020 |
|
CVE-2019-19612
halvotec raquest
An issue was discovered in Halvotec RaQuest 10.23.10801.0. Several features of the application allow stored Cross-site Scripting (XSS). Fixed in Release 24.2020.20608.0.
|
5.4 Medium | — | 0,74% | 16 Mar 2020 |
|
CVE-2019-19613
halvotec raquest
An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an Open Redirect attack allowing an attacker to redire...
|
5.2 Medium | — | 0,51% | 16 Mar 2020 |
|
CVE-2019-19615
sangoma freepbx
Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX...
|
4.8 Medium | — | 0,56% | 16 Mar 2020 |
|
CVE-2019-19852
sangoma freepbx
An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?d...
|
4.8 Medium | — | 0,56% | 16 Mar 2020 |
|
CVE-2019-20491
cpanel
cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
|
5.4 Medium | — | 0,71% | 16 Mar 2020 |
|
CVE-2020-7248
openwrt
libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack based buffer overflow.
|
7.5 High | — | 2,5% | 16 Mar 2020 |
|
CVE-2020-7919
golang go, debian linux +2 lainnya
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a p...
|
7.5 High | — | 2,6% | 16 Mar 2020 |
|
CVE-2020-6175
citrix sd-wan center, citrix netscaler sd-wan center
Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation.
|
5.9 Medium | — | 0,59% | 16 Mar 2020 |
|
CVE-2020-9472
umbraco cms
Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
|
6.5 Medium | — | 2,1% | 16 Mar 2020 |
|
CVE-2020-9471
umbraco cms
Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.
|
8.8 High | — | 2,3% | 16 Mar 2020 |
|
CVE-2020-7608
yargs-parser
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
|
5.3 Medium | — | 0,51% | 16 Mar 2020 |
|
CVE-2019-19461
teampasswordmanager team password manager
Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code a...
|
5.4 Medium | — | 0,54% | 16 Mar 2020 |
|
CVE-2019-19937
jfrog artifactory
In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable r...
|
7.2 High | — | 1,5% | 16 Mar 2020 |
|
CVE-2019-18917
hp envy 5000 m2u85a firmware, hp envy 5000 m2u85b firmware +6 lainnya
A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.
|
6.5 Medium | — | 1,5% | 16 Mar 2020 |
|
CVE-2019-19212
dolibarr
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).
|
9.8 Critical | — | 3,9% | 16 Mar 2020 |
|
CVE-2017-12842
bitcoin core
Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actuall...
|
7.5 High | — | 2,2% | 16 Mar 2020 |
|
CVE-2019-11073
paessler prtg network monitor
A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization when passi...
|
7.2 High | — | 6,3% | 16 Mar 2020 |
|
CVE-2020-9321
traefik, traefik enterprise
configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.
|
7.5 High | — | 0,74% | 16 Mar 2020 |
|
CVE-2020-7916
thimpress learnpress
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-a...
|
6.5 Medium | — | 1,1% | 16 Mar 2020 |
|
CVE-2020-6581
nagios remote plug in executor, fedoraproject fedora
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence)....
|
7.3 High | — | 1,6% | 16 Mar 2020 |
|
CVE-2020-6582
nagios remote plug in executor, fedoraproject fedora
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
|
7.5 High | — | 4,4% | 16 Mar 2020 |
|
CVE-2020-3947
vmware fusion, vmware workstation
VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. Successful exploitation of this issue may lead to...
|
8.8 High | — | 0,61% | 16 Mar 2020 |
|
CVE-2020-3948
vmware fusion, vmware workstation
Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to improper file...
|
7.8 High | — | 0,28% | 16 Mar 2020 |
|
CVE-2020-5844
artica pandora fms
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them v...
|
7.2 High | — | 30,3% | 16 Mar 2020 |
|
CVE-2020-5847
unraid
Unraid through 6.8.0 allows Remote Code Execution.
|
9.8 Critical | KEV | 95,8% | 16 Mar 2020 |
|
CVE-2020-5849
unraid
Unraid 6.8.0 allows authentication bypass.
|
7.5 High | KEV | 93,2% | 16 Mar 2020 |
|
CVE-2019-19821
combodo itop
A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with adm...
|
8.1 High | — | 1,4% | 16 Mar 2020 |
|
CVE-2019-19945
openwrt
uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash...
|
7.5 High | — | 1,6% | 16 Mar 2020 |
|
CVE-2019-19946
dradisframework dradis
The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.
|
6.5 Medium | — | 1,2% | 16 Mar 2020 |
|
CVE-2019-5543
vmware horizon client, vmware remote console +1 lainnya
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15...
|
7.8 High | — | 0,39% | 16 Mar 2020 |
|
CVE-2020-1738
redhat ansible, redhat ansible tower +2 lainnya
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious us...
|
3.9 Low | — | 0,40% | 16 Mar 2020 |
|
CVE-2020-1740
redhat ansible, redhat ansible tower +4 lainnya
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can...
|
4.7 Medium | — | 0,36% | 16 Mar 2020 |
|
CVE-2020-6584
nagios
Nagios Log Server 2.1.3 has Incorrect Access Control.
|
6.5 Medium | — | 3,9% | 16 Mar 2020 |
|
CVE-2020-6585
nagios
Nagios Log Server 2.1.3 has CSRF.
|
8.8 High | — | 1,2% | 16 Mar 2020 |