Katalog CVE (hal. 5088)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.399 (Critical 35.897 · High 103.353 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 254.351–254.400 dari 258.399 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-9102 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	8.8 High	—	1,6%	11 Mar 2020
CVE-2019-9103 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	5.3 Medium	—	1,3%	11 Mar 2020
CVE-2019-9104 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	7.5 High	—	1,0%	11 Mar 2020
CVE-2019-9095 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	9.8 Critical	—	0,72%	11 Mar 2020
CVE-2019-9096 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	9.8 Critical	—	1,8%	11 Mar 2020
CVE-2019-9097 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	5.3 Medium	—	1,5%	11 Mar 2020
CVE-2019-9098 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	7.5 High	—	2,2%	11 Mar 2020
CVE-2019-9099 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	9.8 Critical	—	4,0%	11 Mar 2020
CVE-2019-9101 moxa mb3170 firmware, moxa mb3270 firmware +4 lainnya An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1...	7.5 High	—	0,97%	11 Mar 2020
CVE-2012-1101 systemd project systemd systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure).	5.5 Medium	—	0,40%	11 Mar 2020
CVE-2020-10376 technicolor tc7337net firmware Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header.	9.8 Critical	—	1,1%	11 Mar 2020
CVE-2020-5203 fatfreeframework fat-free framework In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the...	9.8 Critical	—	2,1%	11 Mar 2020
CVE-2019-19381 abacus oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019_01_r4_20191021_0000 before prior to R4 (20.11.2019 Hotfix) allows Reflected Cross Site Scripting (XSS) via an error messa...	6.1 Medium	—	0,72%	11 Mar 2020
CVE-2019-16107 phpbb Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.	4.3 Medium	—	0,41%	11 Mar 2020
CVE-2020-6210 sap fiori launchpad SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad ht...	6.1 Medium	—	0,65%	10 Mar 2020
CVE-2020-6199 sap erp The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE...	5.4 Medium	—	0,33%	10 Mar 2020
CVE-2020-6200 sap commerce cloud The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS)...	5.4 Medium	—	0,54%	10 Mar 2020
CVE-2020-6201 sap commerce cloud The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters a...	6.1 Medium	—	0,80%	10 Mar 2020
CVE-2020-6202 sap netweaver application server java SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source co...	7.2 High	—	1,1%	10 Mar 2020
CVE-2020-6203 sap netweaver SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path informati...	9.1 Critical	—	1,9%	10 Mar 2020
CVE-2020-6204 sap treasury and risk management (ea-finserv), sap treasury and risk management (s4core) The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101,...	4.3 Medium	—	0,63%	10 Mar 2020
CVE-2020-6205 sap netweaver as abap business server pages SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not suff...	6.1 Medium	—	0,77%	10 Mar 2020
CVE-2020-6206 sap cloud platform integration SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow ma...	4.3 Medium	—	0,36%	10 Mar 2020
CVE-2020-6207 sap solution manager SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in comple...	9.8 Critical	KEV	98,1%	10 Mar 2020
CVE-2020-6208 sap crystal reports SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed...	8.2 High	—	1,1%	10 Mar 2020
CVE-2020-6209 sap disclosure management SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user w...	7.5 High	—	0,80%	10 Mar 2020
CVE-2020-6178 sap enable now SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosu...	5.4 Medium	—	0,73%	10 Mar 2020
CVE-2020-6196 sap businessobjects mobile SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting in a Denia...	7.5 High	—	1,4%	10 Mar 2020
CVE-2020-6197 sap enable now SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for...	3.3 Low	—	0,56%	10 Mar 2020
CVE-2020-6198 sap solution manager SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote function...	9.8 Critical	—	1,4%	10 Mar 2020
CVE-2020-10372 ramp altimeter Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEditValueForK...	5.4 Medium	—	0,61%	10 Mar 2020
CVE-2020-0062 google android In Euicc, there is a possible information disclosure due to an included test Certificate. This could lead to remote information disclosure with no additional execution pr...	7.5 High	—	0,61%	10 Mar 2020
CVE-2020-0063 google android In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. This could lead to local escalation of privilege with no additional execution p...	7.3 High	—	0,17%	10 Mar 2020
CVE-2020-0066 google android In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges...	6.4 Medium	—	0,14%	10 Mar 2020
CVE-2020-0084 google android In several functions of NotificationManagerService.java, there are missing permission checks. This could lead to local escalation of privilege by creating fake system not...	7.8 High	—	0,15%	10 Mar 2020
CVE-2020-0085 google android In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege to...	7.8 High	—	0,15%	10 Mar 2020
CVE-2020-0087 google android In getProcessPss of ActivityManagerService.java, there is a possible side channel information disclosure. This could lead to local information disclosure with no addition...	5.5 Medium	—	0,15%	10 Mar 2020
CVE-2020-0047 google android In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local silencing of audio with no additional execution privileges needed. Us...	3.3 Low	—	0,13%	10 Mar 2020
CVE-2020-0048 google android In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data. This could lead to local information disclosure with no addition...	5.5 Medium	—	0,14%	10 Mar 2020
CVE-2020-0049 google android In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no a...	6.5 Medium	—	0,73%	10 Mar 2020
CVE-2020-0050 google android In nfa_hciu_send_msg of nfa_hci_utils.cc, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege in th...	6.7 Medium	—	0,16%	10 Mar 2020
CVE-2020-0051 google android In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead to local escalation of privilege in Settings with no additional execution...	7.8 High	—	0,17%	10 Mar 2020
CVE-2020-0052 google android In smsSelected of AnswerFragment.java, there is a way to send an SMS from the lock screen due to a permissions bypass. This could lead to local escalation of privilege on...	4.3 Medium	—	0,16%	10 Mar 2020
CVE-2020-0053 google android In convertHidlNanDataPathInitiatorRequestToLegacy, and convertHidlNanDataPathIndicationResponseToLegacy of hidl_struct_util.cpp, there is a possible out of bounds write d...	6.7 Medium	—	0,16%	10 Mar 2020
CVE-2020-0054 google android In WifiNetworkSuggestionsManager of WifiNetworkSuggestionsManager.java, there is a possible permission revocation due to a missing permission check. This could lead to lo...	7.8 High	—	0,14%	10 Mar 2020
CVE-2020-0055 google android In l2c_link_process_num_completed_pkts of l2c_link.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosu...	5.5 Medium	—	0,17%	10 Mar 2020
CVE-2020-0056 google android In btu_hcif_connection_comp_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with...	5.5 Medium	—	0,16%	10 Mar 2020
CVE-2020-0057 google android In btm_process_inq_results of btm_inq.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no ad...	5.5 Medium	—	0,16%	10 Mar 2020
CVE-2020-0045 google android In StatsService::command of StatsService.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with System ex...	6.4 Medium	—	0,12%	10 Mar 2020
CVE-2020-0046 google android In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege...	7.8 High	—	0,16%	10 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.