Katalog CVE (hal. 5094)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 254.651–254.700 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-1731 redhat keycloak operator A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keyc...	9.8 Critical	—	1,3%	2 Mar 2020
CVE-2020-8013 suse linux enterprise server, opensuse leap A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set...	2.5 Low	—	0,32%	2 Mar 2020
CVE-2019-18902 opensuse leap, suse linux enterprise server A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause...	9.8 Critical	—	2,4%	2 Mar 2020
CVE-2019-18903 opensuse leap, suse linux enterprise server A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause...	9.8 Critical	—	2,4%	2 Mar 2020
CVE-2019-14892 fasterxml jackson-databind, redhat decision manager +6 lainnya A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using c...	9.8 Critical	—	5,6%	2 Mar 2020
CVE-2018-14384 seopanel seo panel The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to in...	4.8 Medium	—	0,79%	2 Mar 2020
CVE-2019-20486 netgear wnr1000 firmware An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS...	6.1 Medium	—	0,67%	2 Mar 2020
CVE-2019-20487 netgear wnr1000 firmware An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET reque...	8.8 High	—	0,46%	2 Mar 2020
CVE-2019-20488 netgear wnr1000 firmware An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injection, allow...	9.8 Critical	—	2,1%	2 Mar 2020
CVE-2019-20489 netgear wnr1000 firmware An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately al...	9.8 Critical	—	1,3%	2 Mar 2020
CVE-2020-8500 artica pandora fms In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this...	7.2 High	—	3,5%	2 Mar 2020
CVE-2020-5249 puma In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character t...	6.5 Medium	—	1,6%	2 Mar 2020
CVE-2019-18897 suse linux enterprise server, opensuse leap A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allo...	7.8 High	—	0,39%	2 Mar 2020
CVE-2019-18901 opensuse leap, suse linux enterprise server A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Serv...	5.5 Medium	—	0,38%	2 Mar 2020
CVE-2019-12183 safescan timemoto tm-616 firmware, safescan ta-8035 firmware +5 lainnya Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.	7.5 High	—	2,1%	2 Mar 2020
CVE-2017-12580 ultraedit An issue was discovered in IDM UltraEdit through 24.10.0.32. To exploit the vulnerability, on unpatched Windows systems, an attacker could include in the same directory a...	7.8 High	—	0,37%	2 Mar 2020
CVE-2015-1583 atutor Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) creat...	8.8 High	—	1,2%	2 Mar 2020
CVE-2020-4283 ibm security information queue IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for it...	8.6 High	—	1,3%	2 Mar 2020
CVE-2020-4292 ibm security information queue IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could d...	5.3 Medium	—	0,98%	2 Mar 2020
CVE-2018-17058 jaba xpress An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of ProductEdit.asp...	8.8 High	—	1,3%	2 Mar 2020
CVE-2020-5539 grandit GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and then...	6.5 Medium	—	0,84%	2 Mar 2020
CVE-2020-6796 mozilla firefox, mozilla firefox esr A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory...	8.8 High	—	1,6%	2 Mar 2020
CVE-2020-6797 mozilla firefox, mozilla firefox esr +1 lainnya By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as...	4.3 Medium	—	1,5%	2 Mar 2020
CVE-2020-6798 mozilla firefox, mozilla firefox esr +1 lainnya If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on t...	6.1 Medium	—	2,1%	2 Mar 2020
CVE-2020-6799 mozilla firefox, mozilla firefox esr Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as...	8.8 High	—	1,5%	2 Mar 2020
CVE-2020-6800 mozilla firefox, mozilla firefox esr +2 lainnya Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption a...	8.8 High	—	2,4%	2 Mar 2020
CVE-2020-6801 mozilla firefox, canonical ubuntu linux Mozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some...	8.8 High	—	1,4%	2 Mar 2020
CVE-2020-9549 pdfresurrect project pdfresurrect, debian linux In PDFResurrect 0.12 through 0.19, get_type in pdf.c has an out-of-bounds write via a crafted PDF document.	7.8 High	—	1,4%	2 Mar 2020
CVE-2020-6792 mozilla thunderbird, canonical ubuntu linux When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5.	4.3 Medium	—	1,3%	2 Mar 2020
CVE-2020-6793 mozilla thunderbird When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird < 68.5.	6.5 Medium	—	1,5%	2 Mar 2020
CVE-2020-6794 mozilla thunderbird, canonical ubuntu linux If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the olde...	6.5 Medium	—	1,0%	2 Mar 2020
CVE-2020-6795 mozilla thunderbird When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash...	6.5 Medium	—	1,3%	2 Mar 2020
CVE-2019-17026 mozilla firefox, mozilla thunderbird +1 lainnya Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this...	8.8 High	KEV	46,3%	2 Mar 2020
CVE-2020-9547 fasterxml jackson-databind, netapp active iq unified manager +14 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.Jt...	9.8 Critical	—	18,4%	2 Mar 2020
CVE-2020-9548 fasterxml jackson-databind, netapp active iq unified manager +23 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka...	9.8 Critical	—	18,9%	2 Mar 2020
CVE-2020-9546 fasterxml jackson-databind, netapp active iq unified manager +29 lainnya FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari....	9.8 Critical	—	4,6%	2 Mar 2020
CVE-2020-9545 palemoon pale moon Pale Moon 28.x before 28.8.4 has a segmentation fault related to module scripting, as demonstrated by a Lacoste web site.	7.5 High	—	1,3%	2 Mar 2020
CVE-2020-9534 dlink dir-615jx10 firmware fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup webpage parameter when f_radius_ip1 is malformed.	8.8 High	—	1,6%	2 Mar 2020
CVE-2020-9535 dlink dir-615jx10 firmware fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup_Wizard webpage parameter when f_radius_ip1 is malformed.	8.8 High	—	1,6%	2 Mar 2020
CVE-2020-9540 sophos hitmanpro.alert Sophos HitmanPro.Alert before build 861 allows local elevation of privilege.	7.8 High	—	0,36%	2 Mar 2020
CVE-2020-6803 mozilla webthings gateway An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in.	6.1 Medium	—	0,66%	28 Feb 2020
CVE-2020-6804 mozilla webthings gateway A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined...	6.1 Medium	—	0,75%	28 Feb 2020
CVE-2015-3006 juniper junos On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to...	6.5 Medium	—	0,77%	28 Feb 2020
CVE-2015-5361 juniper junos Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related...	6.5 Medium	—	0,48%	28 Feb 2020
CVE-2019-7007 avaya aura conferencing A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potentially allow an...	8.6 High	—	1,7%	28 Feb 2020
CVE-2019-4301 hcltech self-service application BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.	8.4 High	—	1,2%	28 Feb 2020
CVE-2019-10803 push-dir project push-dir push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git"...	9.8 Critical	—	2,8%	28 Feb 2020
CVE-2019-10804 serial-number project serial-number serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validatio...	9.8 Critical	—	2,8%	28 Feb 2020
CVE-2019-10805 sideralis valib.js valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a bu...	7.5 High	—	1,4%	28 Feb 2020
CVE-2020-9449 justblab blab! ax, justblab blab! ax pro +2 lainnya An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 allows an attacker (with a guest...	8.8 High	—	1,0%	28 Feb 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.