Katalog CVE (hal. 5098)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 254.851–254.900 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-8810 gurux device language message specification director An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes an...	8.1 High	—	2,1%	25 Feb 2020
CVE-2019-3999 druva insync client Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary opera...	7.8 High	—	8,6%	25 Feb 2020
CVE-2016-11020 kunena Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.	9.8 Critical	—	2,9%	25 Feb 2020
CVE-2020-9008 blackboard learn Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool pro...	5.4 Medium	—	0,62%	25 Feb 2020
CVE-2020-9018 litecart LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.	5.3 Medium	—	0,42%	25 Feb 2020
CVE-2020-9019 wpjobboard The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.	6.1 Medium	—	1,6%	25 Feb 2020
CVE-2020-9391 linux kernel, fedoraproject fedora +7 lainnya An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, p...	5.5 Medium	—	0,52%	25 Feb 2020
CVE-2020-9334 enviragallery envira gallery A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticate...	5.4 Medium	—	0,78%	25 Feb 2020
CVE-2020-9335 10web photo gallery Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authentic...	4.8 Medium	—	1,4%	25 Feb 2020
CVE-2020-8793 opensmtpd, fedoraproject fedora +1 lainnya OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c an...	4.7 Medium	—	0,90%	25 Feb 2020
CVE-2020-8794 opensmtpd, canonical ubuntu linux +2 lainnya OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affect...	9.8 Critical	—	88,9%	25 Feb 2020
CVE-2020-9017 litecart LiteCart through 2.2.1 allows CSV injection via a customer's profile.	8.0 High	—	1,1%	25 Feb 2020
CVE-2019-12863 solarwinds netpath, solarwinds network performance monitor +1 lainnya SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen.	4.8 Medium	—	1,1%	25 Feb 2020
CVE-2019-5162 moxa awk-3131a firmware An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted...	8.8 High	—	2,6%	25 Feb 2020
CVE-2019-5165 moxa awk-3131a firmware An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device hostname c...	7.2 High	—	2,1%	25 Feb 2020
CVE-2020-9383 linux kernel, debian linux +10 lainnya An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is no...	7.1 High	—	0,76%	25 Feb 2020
CVE-2019-5136 moxa awk-3131a firmware An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted menu selection s...	8.8 High	—	2,4%	25 Feb 2020
CVE-2019-5137 moxa awk-3131a firmware The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A f...	7.5 High	—	2,3%	25 Feb 2020
CVE-2019-5138 moxa awk-3131a firmware An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagno...	9.9 Critical	—	5,2%	25 Feb 2020
CVE-2019-5139 moxa awk-3131a firmware An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. The device operating system cont...	7.1 High	—	0,32%	25 Feb 2020
CVE-2019-5140 moxa awk-3131a firmware An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file...	8.8 High	—	2,8%	25 Feb 2020
CVE-2019-5141 moxa awk-3131a firmware An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip parameter...	8.8 High	—	4,9%	25 Feb 2020
CVE-2019-5142 moxa awk-3131a firmware An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network conf...	7.2 High	—	6,6%	25 Feb 2020
CVE-2019-5143 moxa awk-3131a firmware An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time ser...	8.8 High	—	4,5%	25 Feb 2020
CVE-2019-5148 moxa awk-3131a firmware An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet can cause an...	7.5 High	—	2,5%	25 Feb 2020
CVE-2019-5153 moxa awk-3131a firmware An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A specially craf...	8.8 High	—	4,4%	25 Feb 2020
CVE-2019-4557 ibm qradar advisor IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB...	7.5 High	—	0,79%	25 Feb 2020
CVE-2019-4672 ibm qradar advisor IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further att...	5.3 Medium	—	1,4%	25 Feb 2020
CVE-2020-8818 cardgate payments, adobe magento An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/...	8.1 High	—	4,2%	25 Feb 2020
CVE-2020-8819 cardgate payments An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/...	8.1 High	—	4,9%	25 Feb 2020
CVE-2020-9385 zint A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EA...	7.5 High	—	1,6%	25 Feb 2020
CVE-2020-9382 widgets project widgets An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defin...	5.4 Medium	—	0,97%	24 Feb 2020
CVE-2020-9381 totaljs total.js cms controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction...	7.5 High	—	2,1%	24 Feb 2020
CVE-2020-1938 apache geode, apache tomcat +19 lainnya When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust t...	9.8 Critical	KEV	99,3%	24 Feb 2020
CVE-2020-1935 apache tomcat, debian linux +18 lainnya In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HT...	4.8 Medium	—	9,4%	24 Feb 2020
CVE-2019-17569 apache tomcat, apache tomee +14 lainnya The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Tr...	4.8 Medium	—	8,9%	24 Feb 2020
CVE-2020-1937 apache kylin Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.	8.8 High	—	3,1%	24 Feb 2020
CVE-2019-17229 stylemixthemes motors - car dealer, classifieds & listing includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XS...	6.1 Medium	—	1,4%	24 Feb 2020
CVE-2020-9374 tp-link tl-wr849n firmware On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shell metachara...	9.8 Critical	—	42,7%	24 Feb 2020
CVE-2019-17228 stylemixthemes motors - car dealer, classifieds & listing includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated...	6.5 Medium	—	1,2%	24 Feb 2020
CVE-2019-12510 netgear nighthawk x10-r9000 firmware In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplyin...	9.1 Critical	—	0,73%	24 Feb 2020
CVE-2019-12511 netgear nighthawk x10-r9000 firmware In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Gen...	9.8 Critical	—	2,3%	24 Feb 2020
CVE-2019-12512 netgear nighthawk x10-r9000 firmware In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while perf...	6.1 Medium	—	0,97%	24 Feb 2020
CVE-2019-12513 netgear nighthawk x10-r9000 firmware In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks agai...	6.1 Medium	—	0,84%	24 Feb 2020
CVE-2018-14705 drobo 5n2 firmware In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the net...	9.8 Critical	—	1,9%	24 Feb 2020
CVE-2018-13313 totolink a3002ru firmware In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which i...	6.5 Medium	—	1,0%	24 Feb 2020
CVE-2020-9369 sympa, fedoraproject fedora +1 lainnya Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via...	7.5 High	—	2,9%	24 Feb 2020
CVE-2020-5244 buddypress In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched i...	7.5 High	—	2,4%	24 Feb 2020
CVE-2020-5245 dropwizard validation, oracle blockchain platform Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting...	8.8 High	—	3,0%	24 Feb 2020
CVE-2019-10796 rpi project rpi rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec functio...	9.8 Critical	—	2,8%	24 Feb 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.