Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2015-7339
widgetfactorylimited jce
JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script.
|
8.8 High | — | 1,1% | 9 Mar 2020 |
|
CVE-2015-7340
gwesystems jevents
JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
|
7.2 High | — | 0,98% | 9 Mar 2020 |
|
CVE-2015-7341
joobi jnews
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
|
8.8 High | — | 1,1% | 9 Mar 2020 |
|
CVE-2015-7342
joobi jnews
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
|
7.2 High | — | 0,98% | 9 Mar 2020 |
|
CVE-2020-9386
mahara
In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list d...
|
4.3 Medium | — | 1,0% | 9 Mar 2020 |
|
CVE-2020-9517
microfocus service manager
There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 and 9.60. The vulnerability ma...
|
5.4 Medium | — | 0,48% | 9 Mar 2020 |
|
CVE-2020-5256
bookstackapp bookstack
BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host...
|
8.8 High | — | 2,0% | 9 Mar 2020 |
|
CVE-2020-2157
jenkins skytap cloud ci
Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...
|
4.3 Medium | — | 0,51% | 9 Mar 2020 |
|
CVE-2020-2158
jenkins literate
Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabi...
|
8.8 High | — | 2,9% | 9 Mar 2020 |
|
CVE-2020-2159
jenkins cryptomove
Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account runn...
|
8.8 High | — | 2,0% | 9 Mar 2020 |
|
CVE-2020-2149
jenkins repository connector
Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulti...
|
5.3 Medium | — | 0,61% | 9 Mar 2020 |
|
CVE-2020-2150
jenkins sonar quality gates
Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resultin...
|
5.3 Medium | — | 0,61% | 9 Mar 2020 |
|
CVE-2020-2151
jenkins quality gates
Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in the...
|
5.3 Medium | — | 0,76% | 9 Mar 2020 |
|
CVE-2020-2152
jenkins subversion release manager
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-s...
|
6.1 Medium | — | 1,3% | 9 Mar 2020 |
|
CVE-2020-2153
jenkins backlog
Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
|
4.3 Medium | — | 0,65% | 9 Mar 2020 |
|
CVE-2020-2154
jenkins zephyr for jira test management
Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Jenkins master file system.
|
5.5 Medium | — | 0,27% | 9 Mar 2020 |
|
CVE-2020-2155
jenkins openshift deployer
Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting...
|
5.3 Medium | — | 0,61% | 9 Mar 2020 |
|
CVE-2020-2156
jenkins deployhub
Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
|
4.3 Medium | — | 0,64% | 9 Mar 2020 |
|
CVE-2020-2139
jenkins cobertura
An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any fil...
|
6.5 Medium | — | 1,6% | 9 Mar 2020 |
|
CVE-2020-2140
jenkins audit trail
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vul...
|
6.1 Medium | — | 76,0% | 9 Mar 2020 |
|
CVE-2020-2141
jenkins p4
A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.
|
4.3 Medium | — | 0,64% | 9 Mar 2020 |
|
CVE-2020-2142
jenkins p4
A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.
|
4.3 Medium | — | 0,62% | 9 Mar 2020 |
|
CVE-2020-2143
jenkins logstash
Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their...
|
5.3 Medium | — | 0,61% | 9 Mar 2020 |
|
CVE-2020-2144
jenkins rundeck
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
|
7.1 High | — | 1,1% | 9 Mar 2020 |
|
CVE-2020-2145
jenkins zephyr enterprise test management
Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file system.
|
5.5 Medium | — | 0,33% | 9 Mar 2020 |
|
CVE-2020-2146
jenkins mac
Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
|
7.4 High | — | 0,57% | 9 Mar 2020 |
|
CVE-2020-2147
jenkins mac
A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specifie...
|
4.3 Medium | — | 0,83% | 9 Mar 2020 |
|
CVE-2020-2148
jenkins mac
A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using atta...
|
4.3 Medium | — | 0,81% | 9 Mar 2020 |
|
CVE-2020-2134
jenkins script security
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted constructor bodies.
|
8.8 High | — | 1,0% | 9 Mar 2020 |
|
CVE-2020-2135
jenkins script security
Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that implement GroovyInterceptable.
|
8.8 High | — | 1,0% | 9 Mar 2020 |
|
CVE-2020-2136
jenkins git
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site sc...
|
5.4 Medium | — | 0,85% | 9 Mar 2020 |
|
CVE-2020-2137
jenkins timestamper
Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overa...
|
4.8 Medium | — | 0,70% | 9 Mar 2020 |
|
CVE-2020-2138
jenkins cobertura
Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
|
7.1 High | — | 0,93% | 9 Mar 2020 |
|
CVE-2020-1706
redhat openshift container platform
It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc...
|
7.0 High | — | 0,25% | 9 Mar 2020 |
|
CVE-2020-1737
redhat ansible engine, redhat ansible tower
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s)...
|
7.8 High | — | 0,37% | 9 Mar 2020 |
|
CVE-2020-10235
froxlor
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configurat...
|
8.8 High | — | 1,7% | 9 Mar 2020 |
|
CVE-2020-10236
froxlor
An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This all...
|
6.1 Medium | — | 0,32% | 9 Mar 2020 |
|
CVE-2020-10237
froxlor
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only a...
|
5.5 Medium | — | 0,23% | 9 Mar 2020 |
|
CVE-2019-10806
vega project vega
vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of...
|
4.3 Medium | — | 1,1% | 9 Mar 2020 |
|
CVE-2020-4217
ibm spectrum scale
The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability. An attacker can force the Spectrum Scale mmfsd/mmsdrse...
|
7.5 High | — | 1,3% | 9 Mar 2020 |
|
CVE-2020-9282
mahara
In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting network responses on the 'Edit acc...
|
6.5 Medium | — | 0,92% | 9 Mar 2020 |
|
CVE-2015-7344
hikashop
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
|
4.8 Medium | — | 0,54% | 9 Mar 2020 |
|
CVE-2015-7968
sap netweaver application server
nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI.
|
4.3 Medium | — | 0,62% | 9 Mar 2020 |
|
CVE-2015-7343
joobi jnews
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
|
4.8 Medium | — | 0,54% | 9 Mar 2020 |
|
CVE-2019-20504
quest kace systems management
service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the...
|
9.8 Critical | — | 9,6% | 9 Mar 2020 |
|
CVE-2016-11021
dlink dcs-930l firmware
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
|
7.2 High | KEV | 68,9% | 9 Mar 2020 |
|
CVE-2020-10232
sleuthkit the sleuth kit, debian linux +1 lainnya
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/ya...
|
9.8 Critical | — | 2,5% | 9 Mar 2020 |
|
CVE-2020-10233
sleuthkit the sleuth kit
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.
|
9.1 Critical | — | 2,7% | 9 Mar 2020 |
|
CVE-2020-10223
gonitro nitro pro
npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to JBIG2Decode CNxJBIG2DecodeStream Heap Corruption at npdf!CAPPDAnnotHandlerUtils::create_popup_for_markup+0x12fbe...
|
8.1 High | — | 2,5% | 8 Mar 2020 |
|
CVE-2020-10224
phpgurukul online book store
An unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul Online Book Store 1.0. The vulnerability could be exploited by an unauthen...
|
9.8 Critical | — | 5,5% | 8 Mar 2020 |