Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-6586
nagios
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited acc...
|
5.4 Medium | — | 19,0% | 16 Mar 2020 |
|
CVE-2020-6980
rockwellautomation micrologix 1400 a firmware, rockwellautomation micrologix 1400 b firmware +2 lainnya
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001...
|
3.3 Low | — | 0,42% | 16 Mar 2020 |
|
CVE-2020-6984
rockwellautomation micrologix 1400 a firmware, rockwellautomation micrologix 1400 b firmware +2 lainnya
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001...
|
7.5 High | — | 2,8% | 16 Mar 2020 |
|
CVE-2020-6988
rockwellautomation micrologix 1400 a firmware, rockwellautomation micrologix 1400 b firmware +2 lainnya
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001...
|
7.5 High | — | 4,0% | 16 Mar 2020 |
|
CVE-2020-6990
rockwellautomation micrologix 1400 a firmware, rockwellautomation micrologix 1400 b firmware +2 lainnya
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001...
|
9.8 Critical | — | 4,4% | 16 Mar 2020 |
|
CVE-2020-1735
redhat ansible, redhat ansible tower +4 lainnya
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on...
|
4.6 Medium | — | 0,47% | 16 Mar 2020 |
|
CVE-2020-1736
redhat ansible, redhat ansible tower +3 lainnya
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable i...
|
3.3 Low | — | 0,40% | 16 Mar 2020 |
|
CVE-2020-10230
control-webpanel webpanel
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.
|
9.8 Critical | — | 15,8% | 16 Mar 2020 |
|
CVE-2020-10238
joomla!
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
|
7.5 High | — | 4,9% | 16 Mar 2020 |
|
CVE-2020-10239
joomla!
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
|
8.8 High | — | 2,7% | 16 Mar 2020 |
|
CVE-2020-10240
joomla!
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresse...
|
5.3 Medium | — | 1,3% | 16 Mar 2020 |
|
CVE-2020-10241
joomla!
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
|
8.8 High | — | 0,72% | 16 Mar 2020 |
|
CVE-2020-10242
joomla!
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
|
6.1 Medium | — | 1,0% | 16 Mar 2020 |
|
CVE-2020-10243
joomla!
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Article...
|
9.8 Critical | — | 1,8% | 16 Mar 2020 |
|
CVE-2019-4617
ibm cloud automation manager
IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. Thi...
|
4.4 Medium | — | 0,31% | 16 Mar 2020 |
|
CVE-2019-4619
ibm mq, ibm mq appliance +1 lainnya
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within...
|
5.5 Medium | — | 0,32% | 16 Mar 2020 |
|
CVE-2019-4656
ibm mq, ibm mq appliance +1 lainnya
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the qu...
|
6.5 Medium | — | 1,4% | 16 Mar 2020 |
|
CVE-2019-4719
ibm mq, ibm mq appliance +1 lainnya
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within...
|
5.5 Medium | — | 0,32% | 16 Mar 2020 |
|
CVE-2019-19851
sangoma freepbx
An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=sup...
|
4.8 Medium | — | 0,53% | 16 Mar 2020 |
|
CVE-2019-19940
swisscom centro grande firmware
Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute arbitrary...
|
7.2 High | — | 4,9% | 16 Mar 2020 |
|
CVE-2019-19941
swisscom centro grande firmware
Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain entry in the DNS service of the r...
|
5.4 Medium | — | 0,67% | 16 Mar 2020 |
|
CVE-2019-19942
swisscom centro grande firmware, swisscom centro business
Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Business 2.0 before 8.02.04 allows...
|
7.5 High | — | 1,7% | 16 Mar 2020 |
|
CVE-2019-19135
opcfoundation netstandard.opc.ua, opcfoundation ua-.netstandard
In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which...
|
7.4 High | — | 1,0% | 16 Mar 2020 |
|
CVE-2020-1753
redhat ansible engine, redhat ansible tower +2 lainnya
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior t...
|
5.5 Medium | — | 0,51% | 16 Mar 2020 |
|
CVE-2020-10557
atutor acontent
An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager pa...
|
8.8 High | — | 1,4% | 16 Mar 2020 |
|
CVE-2019-19208
codiad
Codiad Web IDE through 2.8.4 allows PHP Code injection.
|
9.8 Critical | — | 19,2% | 16 Mar 2020 |
|
CVE-2019-19209
dolibarr
Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.
|
7.5 High | — | 2,1% | 16 Mar 2020 |
|
CVE-2019-19210
dolibarr
Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.
|
5.4 Medium | — | 0,93% | 16 Mar 2020 |
|
CVE-2019-19211
dolibarr
Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.
|
6.1 Medium | — | 1,7% | 16 Mar 2020 |
|
CVE-2019-14512
limesurvey
LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
|
6.1 Medium | — | 1,0% | 16 Mar 2020 |
|
CVE-2019-14887
redhat jboss data grid, redhat jboss enterprise application platform +4 lainnya
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could targe...
|
9.1 Critical | — | 1,1% | 16 Mar 2020 |
|
CVE-2018-10125
contao
Contao before 4.5.7 has XSS in the system log.
|
6.1 Medium | — | 0,84% | 16 Mar 2020 |
|
CVE-2018-13060
easyappointments easy!appointments
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
|
6.5 Medium | — | 0,92% | 16 Mar 2020 |
|
CVE-2018-13063
easyappointments easy!appointments
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
|
7.5 High | — | 1,3% | 16 Mar 2020 |
|
CVE-2020-9518
microfocus service manager
Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerabil...
|
5.3 Medium | — | 0,86% | 16 Mar 2020 |
|
CVE-2019-10091
apache geode
When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during...
|
7.4 High | — | 1,4% | 16 Mar 2020 |
|
CVE-2020-9519
microfocus service manager
HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The v...
|
5.3 Medium | — | 0,86% | 16 Mar 2020 |
|
CVE-2020-5545
mitsubishielectric iu1-1m20-d firmware
TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to bypass access rest...
|
9.8 Critical | — | 2,3% | 16 Mar 2020 |
|
CVE-2020-5546
mitsubishielectric iu1-1m20-d firmware
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU...
|
8.8 High | — | 0,90% | 16 Mar 2020 |
|
CVE-2020-5547
mitsubishielectric iu1-1m20-d firmware
Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier a...
|
9.8 Critical | — | 2,3% | 16 Mar 2020 |
|
CVE-2020-5542
mitsubishielectric iu1-1m20-d firmware
Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote a...
|
9.8 Critical | — | 2,3% | 16 Mar 2020 |
|
CVE-2020-5543
mitsubishielectric iu1-1m20-d firmware
TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allo...
|
9.8 Critical | — | 2,2% | 16 Mar 2020 |
|
CVE-2020-5544
mitsubishielectric iu1-1m20-d firmware
Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier all...
|
9.8 Critical | — | 2,4% | 16 Mar 2020 |
|
CVE-2019-15708
fortinet fortiap, fortinet fortiap-s +2 lainnya
A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may...
|
6.7 Medium | — | 0,62% | 15 Mar 2020 |
|
CVE-2019-17654
fortinet fortimanager
An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Sit...
|
8.8 High | — | 0,47% | 15 Mar 2020 |
|
CVE-2019-6696
fortinet fortios
An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack...
|
6.1 Medium | — | 0,70% | 15 Mar 2020 |
|
CVE-2020-9287
fortinet forticlient emergency management server
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
|
7.8 High | — | 0,42% | 15 Mar 2020 |
|
CVE-2020-9290
fortinet forticlient, fortinet forticlient virtual private network
A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
|
7.8 High | — | 0,86% | 15 Mar 2020 |
|
CVE-2020-7601
gulp-scss-lint project gulp-scss-lint
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via th...
|
9.8 Critical | — | 2,7% | 15 Mar 2020 |
|
CVE-2020-7602
node-prompt-here project node-prompt-here
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is requir...
|
9.8 Critical | — | 2,6% | 15 Mar 2020 |