Katalog CVE (hal. 5092)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 254.551–254.600 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-10591 qualcomm apq8009 firmware, qualcomm apq8017 firmware +41 lainnya Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,...	7.5 High	—	0,81%	5 Mar 2020
CVE-2019-10593 qualcomm apq8009 firmware, qualcomm apq8017 firmware +49 lainnya Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\VOLTE call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consum...	9.8 Critical	—	0,90%	5 Mar 2020
CVE-2019-10594 qualcomm apq8009 firmware, qualcomm apq8017 firmware +52 lainnya Stack overflow can occur when SDP is received with multiple payload types in the FMTP attribute of a video M line in Snapdragon Auto, Snapdragon Compute, Snapdragon Consu...	9.8 Critical	—	0,90%	5 Mar 2020
CVE-2019-10526 qualcomm apq8009 firmware, qualcomm apq8017 firmware +28 lainnya Out of bound write in WLAN driver due to NULL character not properly placed after SSID name in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connec...	9.8 Critical	—	0,91%	5 Mar 2020
CVE-2019-10546 qualcomm apq8096 firmware, qualcomm apq8096au firmware +35 lainnya Buffer overflow can occur in WLAN firmware while parsing beacon/probe_response frames during roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap...	9.8 Critical	—	0,90%	5 Mar 2020
CVE-2019-10549 qualcomm msm8905 firmware, qualcomm msm8909 firmware +20 lainnya Null pointer dereference issue can happen due to improper validation of CSEQ header response received from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons...	7.5 High	—	0,81%	5 Mar 2020
CVE-2019-10550 qualcomm mdm9206 firmware, qualcomm mdm9607 firmware +38 lainnya Buffer Over-read when UE is trying to process the message received form the network without zero termination in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I...	9.1 Critical	—	0,88%	5 Mar 2020
CVE-2019-10552 qualcomm apq8009 firmware, qualcomm apq8017 firmware +53 lainnya Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI Realloc cmd in Snapdragon Auto, Snapdragon Compute...	9.1 Critical	—	0,88%	5 Mar 2020
CVE-2019-10553 qualcomm apq8009 firmware, qualcomm apq8017 firmware +52 lainnya Multiple Read overflows due to improper length checks while decoding authentication in Cs domain/RAU Reject and TC cmd in Snapdragon Auto, Snapdragon Compute, Snapdragon...	9.1 Critical	—	0,98%	5 Mar 2020
CVE-2019-10554 qualcomm apq8009 firmware, qualcomm apq8017 firmware +53 lainnya Multiple Read overflows issue due to improper length check while decoding Identity Request in CSdomain/Authentication Reject in CS domain/ PRAU accept/while logging DL me...	9.1 Critical	—	0,98%	5 Mar 2020
CVE-2019-10569 qualcomm apq8053 firmware, qualcomm apq8098 firmware +16 lainnya Stack buffer overflow due to instance id is misplaced inside definition of hardware accelerated effects in makefile in Snapdragon Auto, Snapdragon Compute, Snapdragon Con...	7.8 High	—	0,20%	5 Mar 2020
CVE-2019-10577 qualcomm apq8009 firmware, qualcomm apq8017 firmware +55 lainnya Improper input validation while processing SIP URI received from the network will lead to buffer over-read and then to denial of service in Snapdragon Auto, Snapdragon Co...	9.1 Critical	—	0,88%	5 Mar 2020
CVE-2019-10586 qualcomm apq8009 firmware, qualcomm apq8017 firmware +51 lainnya Filling media attribute tag names without validating the destination buffer size which can result in the buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdrago...	9.8 Critical	—	0,90%	5 Mar 2020
CVE-2018-11838 qualcomm apq8053 firmware, qualcomm mdm9640 firmware +4 lainnya Possible double free issue in WLAN due to lack of checking memory free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Sn...	7.8 High	—	0,20%	5 Mar 2020
CVE-2020-10103 zammad An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malici...	5.4 Medium	—	0,55%	5 Mar 2020
CVE-2020-10104 zammad An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to...	4.3 Medium	—	0,83%	5 Mar 2020
CVE-2020-10105 zammad An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of...	5.3 Medium	—	0,90%	5 Mar 2020
CVE-2020-10096 zammad An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or...	7.5 High	—	1,1%	5 Mar 2020
CVE-2020-10097 zammad An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This infor...	5.3 Medium	—	0,90%	5 Mar 2020
CVE-2020-10098 zammad An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript w...	5.4 Medium	—	0,55%	5 Mar 2020
CVE-2020-10099 zammad An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious J...	5.4 Medium	—	0,55%	5 Mar 2020
CVE-2020-10100 zammad An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does n...	6.5 Medium	—	0,90%	5 Mar 2020
CVE-2020-10101 zammad An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not proper...	7.5 High	—	1,1%	5 Mar 2020
CVE-2020-10102 zammad An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user email...	5.3 Medium	—	0,70%	5 Mar 2020
CVE-2019-17643 centreon An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monit...	7.5 High	—	1,7%	4 Mar 2020
CVE-2019-17644 centreon An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/con...	7.5 High	—	1,3%	4 Mar 2020
CVE-2020-8660 envoyproxy envoy CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extens...	5.3 Medium	—	0,61%	4 Mar 2020
CVE-2020-8659 envoyproxy envoy, redhat openshift service mesh +1 lainnya CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.	7.5 High	—	1,9%	4 Mar 2020
CVE-2020-8661 envoyproxy envoy, redhat openshift service mesh CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.	7.5 High	—	1,9%	4 Mar 2020
CVE-2020-8664 envoyproxy envoy CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources toge...	5.3 Medium	—	1,3%	4 Mar 2020
CVE-2020-7130 hp oneview global dashboard HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. HPE OneView Global Dashboard - After Upgrade or Install of OVGD Version 1.9, Ap...	7.5 High	—	2,2%	4 Mar 2020
CVE-2020-9054 zyxel nas326 firmware, zyxel nas520 firmware +25 lainnya Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote...	9.8 Critical	KEV	100,0%	4 Mar 2020
CVE-2020-9476 commscope arris tg1692a firmware ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding.	7.5 High	—	0,96%	4 Mar 2020
CVE-2020-9477 humaxdigital hga12r-02 firmware An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. A vulnerability in the authentication functionality in the web-based interface could allow an unauthenti...	9.8 Critical	—	1,3%	4 Mar 2020
CVE-2020-9550 rubetek smarthome firmware Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely.	9.8 Critical	—	0,75%	4 Mar 2020
CVE-2020-9371 codepeople appointment booking calendar Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attacker...	4.8 Medium	—	3,3%	4 Mar 2020
CVE-2020-9372 codepeople appointment booking calendar The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which...	7.8 High	—	8,6%	4 Mar 2020
CVE-2020-3176 cisco remote phy 120 firmware, cisco remote phy 220 firmware +1 lainnya A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device w...	6.7 Medium	—	0,45%	4 Mar 2020
CVE-2020-3181 cisco email security appliance A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) cou...	6.5 Medium	—	1,6%	4 Mar 2020
CVE-2020-3182 cisco webex meetings A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow an unauthenticated adjacent attacker to obtain sen...	4.3 Medium	—	0,51%	4 Mar 2020
CVE-2020-3185 cisco telepresence management suite A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow an authenticated, remote attacker to conduct a cross-site s...	5.4 Medium	—	0,63%	4 Mar 2020
CVE-2020-3190 cisco ios xr A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition for IPs...	5.8 Medium	—	1,3%	4 Mar 2020
CVE-2020-3192 cisco prime collaboration provisioning A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site sc...	6.1 Medium	—	0,80%	4 Mar 2020
CVE-2020-3193 cisco prime collaboration provisioning A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to obtain sensitive inform...	5.3 Medium	—	1,1%	4 Mar 2020
CVE-2020-3127 cisco webex meetings, cisco webex meetings online +2 lainnya Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arb...	7.8 High	—	2,4%	4 Mar 2020
CVE-2020-3128 cisco webex meetings, cisco webex meetings online +2 lainnya Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arb...	7.8 High	—	1,9%	4 Mar 2020
CVE-2020-3148 cisco prime network registrar A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery...	7.1 High	—	0,50%	4 Mar 2020
CVE-2020-3155 cisco intelligence proximity, cisco jabber +6 lainnya A vulnerability in the SSL implementation of the Cisco Intelligent Proximity solution could allow an unauthenticated, remote attacker to view or alter information shared...	7.4 High	—	0,90%	4 Mar 2020
CVE-2020-3157 cisco identity services engine A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site script...	5.4 Medium	—	0,63%	4 Mar 2020
CVE-2020-3164 cisco cloud email security, cisco content security management appliance +2 lainnya A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Sec...	5.3 Medium	—	1,3%	4 Mar 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.