Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-4669
ibm business process manager, ibm business automation workflow
IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnera...
|
6.3 Medium | — | 0,84% | 27 Feb 2020 |
|
CVE-2017-6363
libgd
In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue s...
|
8.1 High | — | 1,4% | 27 Feb 2020 |
|
CVE-2017-6371
synchro bbs
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.
|
7.5 High | — | 4,7% | 27 Feb 2020 |
|
CVE-2020-3923
tonnet tat-77104g1 firmware, tonnet tat-70432n firmware +6 lainnya
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gai...
|
9.8 Critical | — | 1,7% | 27 Feb 2020 |
|
CVE-2020-3924
tonnet tat-77104g1 firmware, tonnet tat-70432n firmware +6 lainnya
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and...
|
9.8 Critical | — | 1,3% | 27 Feb 2020 |
|
CVE-2015-5686
puppet enterprise
Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to red...
|
8.8 High | — | 0,45% | 27 Feb 2020 |
|
CVE-2019-18238
moxa iologik 2512 firmware, moxa iologik 2512-t firmware +18 lainnya
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in configuration f...
|
7.5 High | — | 0,59% | 26 Feb 2020 |
|
CVE-2019-17274
netapp fabric-attached storage 8700 firmware, netapp fabric-attached storage 8300 firmware +1 lainnya
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allo...
|
7.8 High | — | 0,58% | 26 Feb 2020 |
|
CVE-2019-17275
netapp oncommand cloud manager
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
|
9.8 Critical | — | 2,8% | 26 Feb 2020 |
|
CVE-2020-3169
cisco firepower extensible operating system
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with...
|
6.7 Medium | — | 0,45% | 26 Feb 2020 |
|
CVE-2020-3170
cisco nx-os
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. T...
|
5.3 Medium | — | 1,7% | 26 Feb 2020 |
|
CVE-2020-3171
cisco ucs manager, cisco fxos
A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arb...
|
7.8 High | — | 0,48% | 26 Feb 2020 |
|
CVE-2020-3172
cisco firepower extensible operating system, cisco ucs manager +1 lainnya
A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbit...
|
8.8 High | — | 1,9% | 26 Feb 2020 |
|
CVE-2020-3173
cisco ucs manager
A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the u...
|
7.8 High | — | 0,44% | 26 Feb 2020 |
|
CVE-2020-3174
cisco nx-os
A vulnerability in the anycast gateway feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to learn invalid Address Resolu...
|
4.7 Medium | — | 0,29% | 26 Feb 2020 |
|
CVE-2020-3175
cisco nx-os
A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote attacker to c...
|
8.6 High | — | 2,0% | 26 Feb 2020 |
|
CVE-2020-3165
cisco nx-os
A vulnerability in the implementation of Border Gateway Protocol (BGP) Message Digest 5 (MD5) authentication in Cisco NX-OS Software could allow an unauthenticated, remot...
|
8.2 High | — | 1,6% | 26 Feb 2020 |
|
CVE-2020-3166
cisco secure firewall threat defense, cisco adaptive security appliance software +1 lainnya
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system (OS). T...
|
6.7 Medium | — | 0,29% | 26 Feb 2020 |
|
CVE-2020-3167
cisco secure firewall threat defense, cisco adaptive security appliance software +2 lainnya
A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underly...
|
7.8 High | — | 0,90% | 26 Feb 2020 |
|
CVE-2020-3168
cisco nx-os
A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to cause an aff...
|
7.5 High | — | 1,6% | 26 Feb 2020 |
|
CVE-2020-8951
fiserv accurate reconciliation
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Tran...
|
5.4 Medium | — | 0,64% | 26 Feb 2020 |
|
CVE-2020-8952
fiserv accurate reconciliation
Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter.
|
6.1 Medium | — | 0,73% | 26 Feb 2020 |
|
CVE-2020-9274
pureftpd pure-ftpd, debian linux +3 lainnya
An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char ali...
|
7.5 High | — | 6,0% | 26 Feb 2020 |
|
CVE-2019-4537
ibm websphere service registry and repository
IBM WebSphere Service Registry and Repository 8.5 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM...
|
5.3 Medium | — | 1,1% | 26 Feb 2020 |
|
CVE-2019-4596
ibm sterling b2b integrator
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript...
|
5.4 Medium | — | 0,56% | 26 Feb 2020 |
|
CVE-2019-4597
ibm sterling b2b integrator
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which...
|
6.3 Medium | — | 0,84% | 26 Feb 2020 |
|
CVE-2019-4598
ibm sterling b2b integrator
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which...
|
6.3 Medium | — | 0,84% | 26 Feb 2020 |
|
CVE-2019-4726
ibm sterling b2b integrator
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un...
|
4.3 Medium | — | 0,49% | 26 Feb 2020 |
|
CVE-2019-19986
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT statements...
|
7.5 High | — | 1,3% | 26 Feb 2020 |
|
CVE-2019-19987
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit...
|
6.5 Medium | — | 0,55% | 26 Feb 2020 |
|
CVE-2019-19988
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem...
|
8.8 High | — | 1,5% | 26 Feb 2020 |
|
CVE-2019-19989
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user without checking...
|
7.5 High | — | 1,3% | 26 Feb 2020 |
|
CVE-2019-19990
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Stored Cross-site scripting (XSS) vulnerabilities allow remote authenticated...
|
5.4 Medium | — | 0,86% | 26 Feb 2020 |
|
CVE-2019-19991
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Reflected Cross-site scripting (XSS) vulnerabilities allow remote authenticat...
|
5.4 Medium | — | 0,86% | 26 Feb 2020 |
|
CVE-2019-19992
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web...
|
6.5 Medium | — | 1,1% | 26 Feb 2020 |
|
CVE-2019-19993
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authe...
|
5.3 Medium | — | 1,2% | 26 Feb 2020 |
|
CVE-2019-19994
seling visual access manager
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execu...
|
9.8 Critical | — | 4,8% | 26 Feb 2020 |
|
CVE-2019-19134
heroplugins hero maps premium
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently...
|
6.1 Medium | — | 5,7% | 26 Feb 2020 |
|
CVE-2020-9337
golfbuddyglobal course manager
In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request.
|
6.5 Medium | — | 0,54% | 26 Feb 2020 |
|
CVE-2020-9405
iblsoft online weather
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
|
6.1 Medium | — | 0,61% | 26 Feb 2020 |
|
CVE-2020-9406
iblsoft online weather
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
|
9.8 Critical | — | 1,2% | 26 Feb 2020 |
|
CVE-2020-9407
iblsoft online weather
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
|
5.3 Medium | — | 0,52% | 26 Feb 2020 |
|
CVE-2020-9398
ispconfig
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
|
9.8 Critical | — | 1,3% | 25 Feb 2020 |
|
CVE-2015-5201
redhat enterprise virtualization, redhat enterprise virtualization hypervisor
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enter...
|
7.5 High | — | 1,5% | 25 Feb 2020 |
|
CVE-2019-4000
druva insync
Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python...
|
7.8 High | — | 0,73% | 25 Feb 2020 |
|
CVE-2015-0565
google native client
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.
|
10.0 Critical | — | 13,6% | 25 Feb 2020 |
|
CVE-2020-9393
pricing table by supsystic
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.
|
6.1 Medium | — | 0,92% | 25 Feb 2020 |
|
CVE-2020-9394
pricing table by supsystic
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.
|
8.8 High | — | 0,68% | 25 Feb 2020 |
|
CVE-2020-9379
mitel micontact center business
The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to access sensitiv...
|
6.5 Medium | — | 0,92% | 25 Feb 2020 |
|
CVE-2020-8809
gurux device language message specification director
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the u...
|
8.1 High | — | 1,2% | 25 Feb 2020 |