Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-10225
phpgurukul job portal
An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The vulnerability could be exploited by an unauthentic...
|
9.8 Critical | — | 4,3% | 8 Mar 2020 |
|
CVE-2020-10222
gonitro nitro pro
npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to Heap Corruption at npdf!nitro::get_property+2381 via a crafted PDF document.
|
8.1 High | — | 2,5% | 8 Mar 2020 |
|
CVE-2020-10221
rconfig
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parame...
|
8.8 High | KEV | 77,1% | 8 Mar 2020 |
|
CVE-2020-10220
rconfig
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
|
9.8 Critical | — | 99,7% | 7 Mar 2020 |
|
CVE-2020-10213
dlink dir-825 firmware, trendnet tew-632brp firmware
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the wps_sta_enrollee_pin parameter in a set_st...
|
8.8 High | — | 5,0% | 7 Mar 2020 |
|
CVE-2020-10214
dlink dir-825 firmware
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. There is a stack-based buffer overflow in the httpd binary. It allows an authenticated user to execute arbit...
|
8.8 High | — | 18,3% | 7 Mar 2020 |
|
CVE-2020-10215
dlink dir-825 firmware, trendnet tew-632brp firmware
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the dns_query_name parameter in a dns_query.cg...
|
8.8 High | — | 5,3% | 7 Mar 2020 |
|
CVE-2020-10216
dlink dir-825 firmware, trendnet tew-632brp firmware
An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a system_time.cgi POST r...
|
8.8 High | — | 5,0% | 7 Mar 2020 |
|
CVE-2020-9281
ckeditor, fedoraproject fedora +9 lainnya
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafte...
|
6.1 Medium | — | 4,3% | 7 Mar 2020 |
|
CVE-2020-9470
wftpserver wing ftp server
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of th...
|
7.8 High | — | 0,58% | 7 Mar 2020 |
|
CVE-2020-8439
monstra
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=v...
|
6.5 Medium | — | 1,6% | 7 Mar 2020 |
|
CVE-2020-8634
wftpserver wing ftp server
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved...
|
7.8 High | — | 0,43% | 7 Mar 2020 |
|
CVE-2020-8635
wftpserver wing ftp server
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily...
|
7.8 High | — | 0,81% | 7 Mar 2020 |
|
CVE-2020-10212
tecrail responsive filemanager
upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and because it is possible for a DN...
|
9.8 Critical | — | 1,5% | 7 Mar 2020 |
|
CVE-2019-19772
lexmark cs31x firmware, lexmark cs41x firmware +58 lainnya
Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark...
|
5.4 Medium | — | 0,65% | 6 Mar 2020 |
|
CVE-2019-19773
lexmark cs31x firmware, lexmark cs41x firmware +58 lainnya
Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.co...
|
5.4 Medium | — | 0,66% | 6 Mar 2020 |
|
CVE-2020-10110
citrix gateway firmware
Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vulnerability. There is no sensitive information disc...
|
5.3 Medium | — | 2,7% | 6 Mar 2020 |
|
CVE-2020-10111
citrix gateway firmware
Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. Citrix ADC o...
|
7.5 High | — | 2,0% | 6 Mar 2020 |
|
CVE-2020-10112
citrix gateway firmware
Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served un...
|
5.4 Medium | — | 1,5% | 6 Mar 2020 |
|
CVE-2020-5327
dell security management server
Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet a...
|
9.8 Critical | — | 3,7% | 6 Mar 2020 |
|
CVE-2020-5328
dell emc isilon onefs
Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but enc...
|
9.8 Critical | — | 1,4% | 6 Mar 2020 |
|
CVE-2020-7212
python urllib3
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an ineff...
|
7.5 High | — | 3,4% | 6 Mar 2020 |
|
CVE-2020-10193
eset cyber security, eset internet security +4 lainnya
ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects versions before 1294 of Smart Se...
|
7.5 High | — | 1,4% | 6 Mar 2020 |
|
CVE-2019-20503
usrsctp project usrsctp, debian linux +1 lainnya
usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
|
6.5 Medium | — | 3,1% | 6 Mar 2020 |
|
CVE-2020-9454
metagauss registrationmagic
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change a...
|
8.8 High | — | 1,1% | 6 Mar 2020 |
|
CVE-2020-9455
metagauss registrationmagic
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via...
|
4.3 Medium | — | 1,4% | 6 Mar 2020 |
|
CVE-2020-9456
metagauss registrationmagic
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges...
|
8.8 High | — | 2,5% | 6 Mar 2020 |
|
CVE-2020-9457
metagauss registrationmagic
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form s...
|
8.8 High | — | 2,5% | 6 Mar 2020 |
|
CVE-2020-9458
metagauss registrationmagic
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form da...
|
8.8 High | — | 2,5% | 6 Mar 2020 |
|
CVE-2020-8113
gitlab
GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
|
9.8 Critical | — | 1,4% | 6 Mar 2020 |
|
CVE-2020-9530
miui firmware
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mishandles the functionality of opening other compon...
|
6.5 Medium | — | 1,5% | 6 Mar 2020 |
|
CVE-2020-9531
miui firmware
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. Aft...
|
7.3 High | — | 1,3% | 6 Mar 2020 |
|
CVE-2020-10189
zohocorp manageengine desktop central
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. Thi...
|
9.8 Critical | KEV | 99,9% | 6 Mar 2020 |
|
CVE-2020-10188
netkit telnet project netkit telnet, fedoraproject fedora +4 lainnya
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involvi...
|
9.8 Critical | — | 74,3% | 6 Mar 2020 |
|
CVE-2020-9756
patriotmemory viper rgb firmware
Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050 and 0x80102054 allows a local user with low privil...
|
7.8 High | — | 0,51% | 6 Mar 2020 |
|
CVE-2020-10184
yubico yubikey one time password validation server
The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL...
|
7.5 High | — | 1,5% | 5 Mar 2020 |
|
CVE-2020-10185
yubico yubikey one time password validation server
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico wh...
|
8.6 High | — | 1,7% | 5 Mar 2020 |
|
CVE-2020-6971
emerson valvelink
In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges due to inse...
|
7.8 High | — | 0,28% | 5 Mar 2020 |
|
CVE-2020-6986
omron plc cj1 firmware, omron plc cj2 firmware
In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module,...
|
7.5 High | — | 1,6% | 5 Mar 2020 |
|
CVE-2020-5957
nvidia quadro firmware, nvidia geforce experience +1 lainnya
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with local system access can corrupt...
|
7.8 High | — | 0,32% | 5 Mar 2020 |
|
CVE-2019-20502
echatserver easy chat server
An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.
|
7.5 High | — | 1,1% | 5 Mar 2020 |
|
CVE-2019-17646
centreon
An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?obj...
|
7.5 High | — | 1,7% | 5 Mar 2020 |
|
CVE-2019-17647
centreon
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance pa...
|
9.8 Critical | — | 1,8% | 5 Mar 2020 |
|
CVE-2019-20382
qemu, opensuse leap +2 lainnya
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory a...
|
3.5 Low | — | 0,87% | 5 Mar 2020 |
|
CVE-2020-10180
eset cyber security, eset mobile security +3 lainnya
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Inte...
|
9.8 Critical | — | 1,7% | 5 Mar 2020 |
|
CVE-2020-5405
vmware spring cloud config
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration file...
|
6.5 Medium | — | 68,5% | 5 Mar 2020 |
|
CVE-2020-4082
hcltech connections
The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vuln...
|
5.4 Medium | — | 0,66% | 5 Mar 2020 |
|
CVE-2020-4083
hcltech connections
HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user.
|
5.5 Medium | — | 0,35% | 5 Mar 2020 |
|
CVE-2019-14886
redhat decision manager, redhat process automation manager
A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used f...
|
6.5 Medium | — | 0,29% | 5 Mar 2020 |
|
CVE-2019-17642
centreon
An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to cen...
|
8.8 High | — | 1,7% | 5 Mar 2020 |