Katalog CVE (hal. 5079)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.399 (Critical 35.897 · High 103.353 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 253.901–253.950 dari 258.399 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-7603 closure-compiler-stream project closure-compiler-stream closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users wit...	9.8 Critical	—	2,6%	15 Mar 2020
CVE-2020-7604 pulverizr project pulverizr pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the var...	9.8 Critical	—	2,6%	15 Mar 2020
CVE-2020-7605 gulp-tape project gulp-tape gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options.	9.8 Critical	—	2,6%	15 Mar 2020
CVE-2020-7606 docker-compose-remote-api project docker-compose-remote-api docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr,...	9.8 Critical	—	2,7%	15 Mar 2020
CVE-2020-7607 gulp-styledocco project gulp-styledocco gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any...	9.8 Critical	—	2,6%	15 Mar 2020
CVE-2020-0088 google android In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with n...	6.5 Medium	—	0,67%	15 Mar 2020
CVE-2020-10594 styria django-rest-framework-json web tokens An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh...	9.1 Critical	—	1,6%	15 Mar 2020
CVE-2019-9473 google android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileg...	7.5 High	—	0,80%	15 Mar 2020
CVE-2019-9474 google android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileg...	7.5 High	—	0,80%	15 Mar 2020
CVE-2020-0086 google android In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to arbitrary code execution if IntSan were not enabled,...	9.8 Critical	—	0,64%	15 Mar 2020
CVE-2019-2216 google android In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a local escalation of privilege because the user is...	7.3 High	—	0,17%	15 Mar 2020
CVE-2019-2089 google android In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no add...	7.8 High	—	0,17%	15 Mar 2020
CVE-2019-2058 google android In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no additional execution privileges needed. User interaction i...	6.5 Medium	—	0,73%	15 Mar 2020
CVE-2019-2088 google android In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional execution privilege...	5.5 Medium	—	0,14%	15 Mar 2020
CVE-2020-10588 v2rayl project v2rayl v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged user but execute as root via Sud...	7.8 High	—	0,40%	15 Mar 2020
CVE-2020-10589 v2rayl project v2rayl v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains commands that are executed as root,...	7.8 High	—	0,39%	15 Mar 2020
CVE-2020-10591 walmart concord An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are no...	7.5 High	—	2,5%	15 Mar 2020
CVE-2019-15608 yarnpkg yarn The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again wh...	5.9 Medium	—	1,8%	15 Mar 2020
CVE-2020-8141 dot project dot The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value...	8.8 High	—	2,1%	15 Mar 2020
CVE-2020-10587 antixlinux antix linux, mxlinux mx linux antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo configuration.	7.8 High	—	0,47%	14 Mar 2020
CVE-2020-10577 meetecho janus An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race condition when cla...	4.8 Medium	—	0,47%	14 Mar 2020
CVE-2020-10578 q-cms qcms An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.	7.5 High	—	1,2%	14 Mar 2020
CVE-2020-10573 meetecho janus An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms in AudioBridge.	7.5 High	—	0,97%	14 Mar 2020
CVE-2020-10574 meetecho janus An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of a typo in...	9.8 Critical	—	1,4%	14 Mar 2020
CVE-2020-10575 meetecho janus An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some refer...	4.2 Medium	—	0,47%	14 Mar 2020
CVE-2020-10576 meetecho janus An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash.	5.9 Medium	—	0,65%	14 Mar 2020
CVE-2020-10571 psd-tools project psd-tools An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.	9.8 Critical	—	1,8%	14 Mar 2020
CVE-2020-10567 tecrail responsive filemanager An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what...	9.8 Critical	—	19,6%	14 Mar 2020
CVE-2020-10568 onthegosystems sitepress-multilingual-cms The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-i...	8.8 High	—	1,7%	14 Mar 2020
CVE-2020-10565 freebsd grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest...	7.8 High	—	0,41%	14 Mar 2020
CVE-2020-10566 freebsd grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow.	7.8 High	—	0,34%	14 Mar 2020
CVE-2020-10564 iptanus wordpress file upload An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file int...	9.8 Critical	—	8,6%	13 Mar 2020
CVE-2020-5240 labdigital wagtail-2fa In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special p...	8.5 High	—	1,00%	13 Mar 2020
CVE-2020-5257 thoughtbot administrate In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the S...	8.1 High	—	0,90%	13 Mar 2020
CVE-2020-10562 devome grr An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.	7.2 High	—	1,5%	13 Mar 2020
CVE-2020-10563 devome grr An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query.	9.8 Critical	—	1,7%	13 Mar 2020
CVE-2019-3769 dell wyse management suite Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could ex...	6.4 Medium	—	0,67%	13 Mar 2020
CVE-2019-3770 dell wyse management suite Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. A remote authenticated malicious user...	6.4 Medium	—	0,67%	13 Mar 2020
CVE-2019-18576 dell xtremio management server Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users wi...	6.7 Medium	—	0,31%	13 Mar 2020
CVE-2019-18577 dell xtremio management server Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit...	6.7 Medium	—	0,34%	13 Mar 2020
CVE-2019-18578 dell xtremio management server Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulne...	9.0 Critical	—	1,1%	13 Mar 2020
CVE-2019-19611 halvotec raquest An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as well as the s...	7.5 High	—	1,1%	13 Mar 2020
CVE-2019-13194 brother ads-2400n firmware, brother ads-2800w firmware +58 lainnya Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensitive information to an unauthen...	7.5 High	—	1,8%	13 Mar 2020
CVE-2019-13195 kyocera ecosys m5526cdw firmware The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user to retrieve...	7.5 High	—	3,5%	13 Mar 2020
CVE-2019-13196 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the arg4 and arg9 parameters of several functiona...	8.8 High	—	2,2%	13 Mar 2020
CVE-2019-13197 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of the web application that would a...	9.8 Critical	—	2,7%	13 Mar 2020
CVE-2019-13198 kyocera ecosys m5526cdw firmware The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XSS. Successful exploitation of this vulnerability c...	6.1 Medium	—	1,4%	13 Mar 2020
CVE-2019-13199 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerability can lead...	6.5 Medium	—	0,55%	13 Mar 2020
CVE-2019-13200 kyocera ecosys m5526cdw firmware The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected XSS. Successful exploitation of this vulnerabilit...	6.1 Medium	—	1,4%	13 Mar 2020
CVE-2019-13201 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service. This would allow an unauthentica...	9.8 Critical	—	2,7%	13 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.