Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-19224
dlink dsl-2680 firmware
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (binary file...
|
7.5 High | — | 2,5% | 4 Mar 2020 |
|
CVE-2019-19225
dlink dsl-2680 firmware
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authen...
|
7.5 High | — | 2,5% | 4 Mar 2020 |
|
CVE-2019-19226
dlink dsl-2680 firmware
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC address filtering...
|
7.5 High | — | 2,5% | 4 Mar 2020 |
|
CVE-2020-10057
metalgenix genixcms
GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token"...
|
8.8 High | — | 0,93% | 4 Mar 2020 |
|
CVE-2019-19222
dlink dsl-2680 firmware
A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an authenticated attacker to inject arbitrary JavaScript code into the in...
|
5.4 Medium | — | 1,9% | 4 Mar 2020 |
|
CVE-2019-19223
dlink dsl-2680 firmware
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboo...
|
7.5 High | — | 4,4% | 4 Mar 2020 |
|
CVE-2020-9757
craftcms craft cms
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
|
9.8 Critical | — | 72,8% | 4 Mar 2020 |
|
CVE-2020-9761
unctad asycuda world
An issue was discovered in UNCTAD ASYCUDA World 2001 through 2020. The Java RMI Server has an Insecure Default Configuration, leading to Java Code Execution from a remote...
|
9.8 Critical | — | 2,2% | 4 Mar 2020 |
|
CVE-2020-7988
phpipam
An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain acc...
|
8.8 High | — | 0,73% | 4 Mar 2020 |
|
CVE-2020-9364
creative-solutions creative contact form
An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in t...
|
5.3 Medium | — | 3,1% | 4 Mar 2020 |
|
CVE-2020-5251
parseplatform parse-server
In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and fi...
|
5.3 Medium | — | 0,85% | 4 Mar 2020 |
|
CVE-2020-10029
gnu glibc, fedoraproject fedora +9 lainnya
The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-c...
|
5.5 Medium | — | 0,76% | 4 Mar 2020 |
|
CVE-2019-3404
360 p0 router firmware, 360 f5c router firmware
By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 router P0 and F5...
|
7.5 High | — | 0,91% | 4 Mar 2020 |
|
CVE-2020-5535
plathome openblocks iot vx2 firmware
OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified...
|
8.8 High | — | 0,86% | 4 Mar 2020 |
|
CVE-2020-5536
plathome openblocks iot vx2 firmware
OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to bypass authentication and to initialize the device via unspecified...
|
8.8 High | — | 0,58% | 4 Mar 2020 |
|
CVE-2020-1734
redhat ansible engine, redhat ansible tower
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting...
|
7.4 High | — | 0,46% | 3 Mar 2020 |
|
CVE-2020-5403
broadcom reactor netty
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 resp...
|
7.5 High | — | 1,1% | 3 Mar 2020 |
|
CVE-2020-5404
broadcom reactor netty
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redi...
|
5.9 Medium | — | 0,65% | 3 Mar 2020 |
|
CVE-2020-1893
facebook hhvm
Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0...
|
7.5 High | — | 1,1% | 3 Mar 2020 |
|
CVE-2020-1888
facebook hhvm
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0,...
|
7.5 High | — | 1,1% | 3 Mar 2020 |
|
CVE-2020-1892
facebook hhvm
Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS. This issue aff...
|
8.1 High | — | 1,1% | 3 Mar 2020 |
|
CVE-2019-17549
eset cyber security
ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user to stop (kill) ESET processes. An attacker can abuse this bug to stop the protec...
|
6.5 Medium | — | 1,2% | 3 Mar 2020 |
|
CVE-2019-19792
eset cyber security
A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to root-owned files.
|
6.7 Medium | — | 0,40% | 3 Mar 2020 |
|
CVE-2020-4196
ibm tivoli netcool/omnibus
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering...
|
5.4 Medium | — | 0,56% | 3 Mar 2020 |
|
CVE-2020-4197
ibm tivoli netcool/omnibus
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908.
|
2.4 Low | — | 0,34% | 3 Mar 2020 |
|
CVE-2020-4198
ibm tivoli netcool/omnibus
IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering...
|
5.4 Medium | — | 0,56% | 3 Mar 2020 |
|
CVE-2019-3695
opensuse pcp
A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Pe...
|
7.8 High | — | 0,48% | 3 Mar 2020 |
|
CVE-2019-3696
opensuse pcp
A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Lin...
|
7.3 High | — | 0,46% | 3 Mar 2020 |
|
CVE-2020-9751
naver cloud explorer
Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade.
|
9.1 Critical | — | 0,49% | 3 Mar 2020 |
|
CVE-2020-10018
webkitgtk, wpewebkit wpe webkit +4 lainnya
WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to a...
|
9.8 Critical | — | 5,0% | 2 Mar 2020 |
|
CVE-2018-5951
mikrotik routeros
An issue was discovered in Mikrotik RouterOS. Crafting a packet that has a size of 1 byte and sending it to an IPv6 address of a RouterOS box with IP Protocol 97 will cau...
|
7.5 High | — | 4,3% | 2 Mar 2020 |
|
CVE-2019-14893
fasterxml jackson-databind, netapp oncommand api services +2 lainnya
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using...
|
9.8 Critical | — | 4,1% | 2 Mar 2020 |
|
CVE-2018-19798
fleetco fleet maintenance management
Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_add.php?subm...
|
8.8 High | — | 3,1% | 2 Mar 2020 |
|
CVE-2018-20343
advsys build engine
Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. An attacker could craft a special map file to execute arbitrary code when the ma...
|
7.8 High | — | 2,2% | 2 Mar 2020 |
|
CVE-2018-16356
pbootcms
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.
|
9.8 Critical | — | 1,8% | 2 Mar 2020 |
|
CVE-2018-16357
pbootcms
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.
|
9.8 Critical | — | 1,8% | 2 Mar 2020 |
|
CVE-2018-17572
influxdata influxdb
InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
|
4.8 Medium | — | 0,73% | 2 Mar 2020 |
|
CVE-2018-19599
monstra cms
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product.
|
5.4 Medium | — | 0,73% | 2 Mar 2020 |
|
CVE-2018-19658
evernote yinxiang biji
The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a v...
|
5.4 Medium | — | 0,52% | 2 Mar 2020 |
|
CVE-2018-15819
easyio 30p firmware
EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js.
|
7.5 High | — | 1,8% | 2 Mar 2020 |
|
CVE-2018-15820
easyio 30p firmware
EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.
|
6.1 Medium | — | 0,86% | 2 Mar 2020 |
|
CVE-2020-8776
alfresco
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.
|
5.4 Medium | — | 2,7% | 2 Mar 2020 |
|
CVE-2020-8777
alfresco
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG docu...
|
5.4 Medium | — | 3,2% | 2 Mar 2020 |
|
CVE-2020-8778
alfresco
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.
|
5.4 Medium | — | 2,6% | 2 Mar 2020 |
|
CVE-2020-8437
bittorrent utorrent
The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denial of servic...
|
7.5 High | — | 12,0% | 2 Mar 2020 |
|
CVE-2019-19370
mitel micollab
A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated at...
|
6.1 Medium | — | 1,0% | 2 Mar 2020 |
|
CVE-2019-19371
mitel micollab audio, web & video conferencing
A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a ref...
|
6.1 Medium | — | 1,0% | 2 Mar 2020 |
|
CVE-2019-19607
mitel micollab audio, web & video conferencing
A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input valid...
|
9.8 Critical | — | 1,7% | 2 Mar 2020 |
|
CVE-2019-19608
mitel micollab audio, web & video conferencing
A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input va...
|
9.8 Critical | — | 1,7% | 2 Mar 2020 |
|
CVE-2019-18863
mitel 6863i firmware, mitel 6865i firmware +6 lainnya
A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an att...
|
5.9 Medium | — | 0,51% | 2 Mar 2020 |