Katalog CVE (hal. 5080)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.399 (Critical 35.897 · High 103.353 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 253.951–254.000 dari 258.399 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-13202 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and failhtmlfile parameters of sev...	9.8 Critical	—	2,7%	13 Mar 2020
CVE-2019-14299 ricoh sp c250sf firmware, ricoh sp c252sf firmware +2 lainnya Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was pos...	9.8 Critical	—	1,4%	13 Mar 2020
CVE-2019-14303 ricoh sp c250sf firmware, ricoh sp c252sf firmware +2 lainnya Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). Some Ricoh printers were affected by a wrong LPD service implementation that lead to a denial of serv...	7.5 High	—	1,3%	13 Mar 2020
CVE-2019-14309 ricoh sp c250sf firmware, ricoh sp c252sf firmware +2 lainnya Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attacker to acce...	7.5 High	—	1,2%	13 Mar 2020
CVE-2019-14310 ricoh sp c250sf firmware, ricoh sp c252sf firmware +2 lainnya Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash. A memory...	9.8 Critical	—	1,9%	13 Mar 2020
CVE-2019-13171 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the Google Cloud Print implementa...	9.8 Critical	—	2,8%	13 Mar 2020
CVE-2019-13172 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie of the web application that wou...	9.8 Critical	—	3,0%	13 Mar 2020
CVE-2019-13192 brother ads-2400n firmware, brother ads-2800w firmware +58 lainnya Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse attribute names properly. Thi...	9.8 Critical	—	3,8%	13 Mar 2020
CVE-2019-13193 brother ads-2400n firmware, brother ads-2800w firmware +58 lainnya Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. Th...	8.8 High	—	3,1%	13 Mar 2020
CVE-2019-13165 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the request parser of the IPP service. This would allow a...	9.8 Critical	—	2,8%	13 Mar 2020
CVE-2019-13166 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via brute force...	7.5 High	—	1,0%	13 Mar 2020
CVE-2019-13167 xerox phaser 3320 firmware Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation of this vu...	6.1 Medium	—	1,0%	13 Mar 2020
CVE-2019-13168 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the attributes parser of the IPP service. This would allo...	9.8 Critical	—	2,8%	13 Mar 2020
CVE-2019-13169 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Header of the web application that...	9.8 Critical	—	2,7%	13 Mar 2020
CVE-2019-13170 xerox phaser 3320 firmware Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead...	6.5 Medium	—	0,41%	13 Mar 2020
CVE-2020-10075 gitlab GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped in...	6.1 Medium	—	0,73%	13 Mar 2020
CVE-2020-10076 gitlab GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.	6.1 Medium	—	0,69%	13 Mar 2020
CVE-2020-10077 gitlab GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.	9.8 Critical	—	1,2%	13 Mar 2020
CVE-2020-10073 gitlab GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a proj...	7.5 High	—	1,1%	13 Mar 2020
CVE-2020-10074 gitlab GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link.	9.8 Critical	—	1,3%	13 Mar 2020
CVE-2019-13203 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by an integer overflow vulnerability in the arg3 parameter of several functionalities o...	8.8 High	—	1,9%	13 Mar 2020
CVE-2019-13204 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by multiple buffer overflow vulnerabilities in the IPP service. This would allow an una...	9.8 Critical	—	2,7%	13 Mar 2020
CVE-2019-13205 kyocera ecosys m5526cdw firmware All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated users. This information was onl...	7.5 High	—	1,1%	13 Mar 2020
CVE-2019-13206 kyocera ecosys m5526cdw firmware Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in multiple parameters of the Document Boxes functio...	8.8 High	—	2,0%	13 Mar 2020
CVE-2019-13393 netgear cg3700b firmware The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either a...	7.5 High	—	1,2%	13 Mar 2020
CVE-2019-13394 netgear cg3700b firmware The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.	9.8 Critical	—	0,78%	13 Mar 2020
CVE-2019-13395 netgear cg3700b firmware The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore t...	8.8 High	—	0,49%	13 Mar 2020
CVE-2020-10092 gitlab GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.	6.1 Medium	—	0,69%	13 Mar 2020
CVE-2020-10218 sapplica sentrifugo A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction...	6.5 Medium	—	1,2%	13 Mar 2020
CVE-2020-10082 gitlab GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered.	5.3 Medium	—	1,1%	13 Mar 2020
CVE-2020-10083 gitlab GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.	9.1 Critical	—	1,1%	13 Mar 2020
CVE-2020-10084 gitlab GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a...	5.3 Medium	—	0,91%	13 Mar 2020
CVE-2020-10085 gitlab GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles.	5.3 Medium	—	0,93%	13 Mar 2020
CVE-2020-10086 gitlab GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read.	5.3 Medium	—	1,3%	13 Mar 2020
CVE-2020-10087 gitlab GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.	7.5 High	—	1,2%	13 Mar 2020
CVE-2020-10088 gitlab GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level...	8.1 High	—	0,81%	13 Mar 2020
CVE-2020-10089 gitlab GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,	7.5 High	—	1,1%	13 Mar 2020
CVE-2020-10090 gitlab GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed.	5.3 Medium	—	0,93%	13 Mar 2020
CVE-2020-10091 gitlab GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.	6.1 Medium	—	0,69%	13 Mar 2020
CVE-2020-10078 gitlab GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.	6.1 Medium	—	0,69%	13 Mar 2020
CVE-2020-10079 gitlab GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not...	5.3 Medium	—	0,99%	13 Mar 2020
CVE-2020-10080 gitlab GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group.	5.3 Medium	—	0,93%	13 Mar 2020
CVE-2020-10081 gitlab GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects no...	6.5 Medium	—	0,95%	13 Mar 2020
CVE-2019-12182 safescan ta-8010 firmware, safescan ta-8015 firmware +5 lainnya Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API.	9.8 Critical	—	5,0%	13 Mar 2020
CVE-2019-19799 zohocorp manageengine applications manager Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.	5.3 Medium	—	6,4%	13 Mar 2020
CVE-2019-6699 fortinet fortiadc An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field...	5.4 Medium	—	0,55%	13 Mar 2020
CVE-2020-10195 sygnoos popup builder The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post acti...	6.3 Medium	—	1,1%	13 Mar 2020
CVE-2020-10196 sygnoos popup builder An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured...	6.1 Medium	—	1,4%	13 Mar 2020
CVE-2020-8571 netapp storagegrid StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unauthenticated...	7.5 High	—	1,8%	13 Mar 2020
CVE-2019-19756 lenovo xclarity administrator An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being wri...	6.0 Medium	—	0,31%	13 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.