Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-9459
webnus modern events calendar lite
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users...
|
5.4 Medium | — | 1,0% | 28 Feb 2020 |
|
CVE-2019-10801
enpeem project enpeem
enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization.
|
9.8 Critical | — | 2,8% | 28 Feb 2020 |
|
CVE-2019-10802
mangoraft giting
giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any validation.
|
9.8 Critical | — | 2,5% | 28 Feb 2020 |
|
CVE-2018-21035
qt
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attack...
|
7.5 High | — | 2,3% | 28 Feb 2020 |
|
CVE-2019-19943
pablosoftwaresolutions quick 'n easy web server
The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parameter. It may...
|
7.5 High | — | 4,3% | 28 Feb 2020 |
|
CVE-2019-15609
kill-port-process project kill-port-process
The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.
|
9.8 Critical | — | 4,0% | 28 Feb 2020 |
|
CVE-2020-9465
eyesofnetwork
An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker t...
|
9.8 Critical | — | 82,2% | 28 Feb 2020 |
|
CVE-2020-9466
export users to csv project export users to csv
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
|
6.1 Medium | — | 1,3% | 28 Feb 2020 |
|
CVE-2020-8127
revealjs reveal.js
Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.
|
6.1 Medium | — | 1,2% | 28 Feb 2020 |
|
CVE-2020-8132
pdf-image project pdf-image
Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user inp...
|
9.8 Critical | — | 2,0% | 28 Feb 2020 |
|
CVE-2020-1876
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerability. An unauthenticated attacke...
|
7.5 High | — | 0,76% | 28 Feb 2020 |
|
CVE-2020-1877
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The software system acc...
|
4.4 Medium | — | 0,20% | 28 Feb 2020 |
|
CVE-2020-1881
huawei nip6800 firmware, huawei secospace usg6600 firmware +2 lainnya
NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have have a resource management error vulnerability. An atta...
|
7.5 High | — | 0,79% | 28 Feb 2020 |
|
CVE-2020-1844
huawei pcmanager
PCManager with versions earlier than 10.0.5.51 have a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can perform specif...
|
7.8 High | — | 0,23% | 28 Feb 2020 |
|
CVE-2020-1860
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass vulnerability. Attackers that...
|
7.5 High | — | 0,66% | 28 Feb 2020 |
|
CVE-2020-1861
huawei cloudengine 12800 firmware
CloudEngine 12800 with versions of V200R001C00SPC600,V200R001C00SPC700,V200R002C01,V200R002C50SPC800,V200R002C50SPC800PWE,V200R003C00SPC810,V200R003C00SPC810PWE,V200R005C...
|
4.4 Medium | — | 0,22% | 28 Feb 2020 |
|
CVE-2020-1873
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vulnerability. An unauthenticated...
|
7.5 High | — | 0,77% | 28 Feb 2020 |
|
CVE-2020-1874
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have a invalid pointer access vulnerability. The software system...
|
5.5 Medium | — | 0,20% | 28 Feb 2020 |
|
CVE-2020-1875
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The software system...
|
5.5 Medium | — | 0,20% | 28 Feb 2020 |
|
CVE-2020-1792
huawei honor v10 firmware
Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) have an out of bounds write vul...
|
5.5 Medium | — | 0,48% | 28 Feb 2020 |
|
CVE-2020-9463
centreon
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?obje...
|
8.8 High | — | 4,1% | 28 Feb 2020 |
|
CVE-2020-5247
puma, ruby-lang ruby +2 lainnya
In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `...
|
7.5 High | — | 2,5% | 28 Feb 2020 |
|
CVE-2020-9447
gwtupload project gwtupload
There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which conta...
|
6.1 Medium | — | 0,76% | 28 Feb 2020 |
|
CVE-2019-10064
w1.fi hostapd, debian linux
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inapp...
|
7.5 High | — | 3,8% | 28 Feb 2020 |
|
CVE-2019-8741
apple icloud, apple itunes +4 lainnya
A denial of service issue was addressed with improved input validation.
|
7.5 High | — | 2,5% | 28 Feb 2020 |
|
CVE-2020-9399
avast antivirus for linux, avast antivirus pro +1 lainnya
The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro...
|
5.5 Medium | — | 1,2% | 28 Feb 2020 |
|
CVE-2020-9442
openvpn connect
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by co...
|
7.8 High | — | 0,64% | 28 Feb 2020 |
|
CVE-2019-3698
nagios, opensuse backports sle +1 lainnya
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Fact...
|
7.0 High | — | 0,68% | 28 Feb 2020 |
|
CVE-2020-9431
wireshark, opensuse leap +2 lainnya
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjus...
|
7.5 High | — | 2,7% | 27 Feb 2020 |
|
CVE-2020-9432
lua-openssl project lua-openssl
openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
|
9.1 Critical | — | 0,84% | 27 Feb 2020 |
|
CVE-2020-9433
lua-openssl project lua-openssl
openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
|
9.1 Critical | — | 0,84% | 27 Feb 2020 |
|
CVE-2020-9434
lua-openssl project lua-openssl
openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
|
9.1 Critical | — | 0,84% | 27 Feb 2020 |
|
CVE-2020-9428
wireshark, debian linux +2 lainnya
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful...
|
7.5 High | — | 3,1% | 27 Feb 2020 |
|
CVE-2020-9429
wireshark, opensuse leap
In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash. This was addressed in epan/dissectors/packet-wireguard.c by handling the situation where a certain data...
|
7.5 High | — | 1,5% | 27 Feb 2020 |
|
CVE-2020-9430
wireshark, fedoraproject fedora +2 lainnya
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validatin...
|
7.5 High | — | 2,8% | 27 Feb 2020 |
|
CVE-2020-6383
google chrome, fedoraproject fedora +4 lainnya
Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 6,4% | 27 Feb 2020 |
|
CVE-2020-6384
google chrome, fedoraproject fedora +4 lainnya
Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 1,7% | 27 Feb 2020 |
|
CVE-2020-6386
google chrome, fedoraproject fedora +4 lainnya
Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 1,7% | 27 Feb 2020 |
|
CVE-2020-6407
google chrome
Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 1,8% | 27 Feb 2020 |
|
CVE-2020-6418
google chrome, fedoraproject fedora +4 lainnya
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | KEV | 78,8% | 27 Feb 2020 |
|
CVE-2018-8877
asus firmware, asuswrt-merlin
Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acqu...
|
5.3 Medium | — | 1,5% | 27 Feb 2020 |
|
CVE-2018-8878
asuswrt-merlin, asus firmware
Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to acqu...
|
5.3 Medium | — | 1,5% | 27 Feb 2020 |
|
CVE-2020-7062
php, opensuse leap +2 lainnya
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.up...
|
7.5 High | — | 3,6% | 27 Feb 2020 |
|
CVE-2020-7063
php, tenable.sc +2 lainnya
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added...
|
5.3 Medium | — | 1,6% | 27 Feb 2020 |
|
CVE-2020-7061
php, tenable.sc
In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-...
|
9.1 Critical | — | 4,1% | 27 Feb 2020 |
|
CVE-2020-3866
apple mac os x
This was addressed with additional checks by Gatekeeper on files mounted through a network share. This issue is fixed in macOS Catalina 10.15.3. Searching for and opening...
|
5.5 Medium | — | 0,68% | 27 Feb 2020 |
|
CVE-2020-3867
apple icloud, apple itunes +6 lainnya
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, i...
|
6.1 Medium | — | 1,4% | 27 Feb 2020 |
|
CVE-2020-3868
apple icloud, apple itunes +5 lainnya
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes fo...
|
8.8 High | — | 2,7% | 27 Feb 2020 |
|
CVE-2020-3869
apple ipados, apple iphone os
An issue existed in the handling of the local user's self-view. The issue was corrected with improved logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A remote...
|
5.3 Medium | — | 0,67% | 27 Feb 2020 |
|
CVE-2020-3870
apple ipados, apple iphone os +3 lainnya
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1....
|
7.8 High | — | 1,1% | 27 Feb 2020 |