Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-10798
rdf-graph-array project rdf-graph-array
rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or...
|
5.3 Medium | — | 1,1% | 24 Feb 2020 |
|
CVE-2019-10799
compile-sass project compile-sass
compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" comm...
|
8.2 High | — | 2,3% | 24 Feb 2020 |
|
CVE-2020-9366
gnu screen
A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and...
|
9.8 Critical | — | 2,7% | 24 Feb 2020 |
|
CVE-2012-0785
cloudbees jenkins, jenkins
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1...
|
7.5 High | — | 3,4% | 24 Feb 2020 |
|
CVE-2020-9362
quickheal antivirus for server, quickheal antivirus pro +4 lainnya
The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Security, Total Se...
|
7.8 High | — | 1,5% | 24 Feb 2020 |
|
CVE-2020-9363
sophos cloud optix, sophos endpoint protection +4 lainnya
The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X...
|
7.8 High | — | 0,97% | 24 Feb 2020 |
|
CVE-2020-9365
pureftpd pure-ftpd, fedoraproject fedora
An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.
|
7.5 High | — | 7,1% | 24 Feb 2020 |
|
CVE-2020-4210
ibm spectrum protect
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker...
|
9.8 Critical | — | 15,5% | 24 Feb 2020 |
|
CVE-2020-4211
ibm spectrum protect
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker...
|
9.8 Critical | — | 71,1% | 24 Feb 2020 |
|
CVE-2020-4212
ibm spectrum protect
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker...
|
9.8 Critical | — | 15,0% | 24 Feb 2020 |
|
CVE-2020-4213
ibm spectrum protect
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker...
|
9.8 Critical | — | 15,5% | 24 Feb 2020 |
|
CVE-2020-4222
ibm spectrum protect
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker...
|
9.8 Critical | — | 15,5% | 24 Feb 2020 |
|
CVE-2019-4595
ibm sterling b2b integrator
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuadi...
|
6.1 Medium | — | 0,71% | 24 Feb 2020 |
|
CVE-2019-4703
ibm spectrum protect plus
IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain...
|
5.3 Medium | — | 0,46% | 24 Feb 2020 |
|
CVE-2019-4745
ibm maximo asset management, ibm maximo for aviation +5 lainnya
IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL...
|
4.3 Medium | — | 0,87% | 24 Feb 2020 |
|
CVE-2020-8131
yarnpkg yarn
Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by...
|
7.5 High | — | 5,2% | 24 Feb 2020 |
|
CVE-2020-8130
ruby-lang rake, canonical ubuntu linux +3 lainnya
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
|
6.4 Medium | — | 1,4% | 24 Feb 2020 |
|
CVE-2020-5186
dnnsoftware dotnetnuke
DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
|
5.4 Medium | — | 0,88% | 24 Feb 2020 |
|
CVE-2020-5187
dnnsoftware dotnetnuke
DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).
|
8.8 High | — | 2,4% | 24 Feb 2020 |
|
CVE-2020-5188
dnnsoftware dotnetnuke
DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
|
6.5 Medium | — | 1,9% | 24 Feb 2020 |
|
CVE-2019-18182
pacman project pacman, fedoraproject fedora
pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned databases are us...
|
9.8 Critical | — | 3,7% | 24 Feb 2020 |
|
CVE-2019-18183
pacman project pacman, fedoraproject fedora
pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function. This can be exploited when unsigned databases are use...
|
9.8 Critical | — | 3,7% | 24 Feb 2020 |
|
CVE-2019-20480
miele xgw 3000 zigbee gateway firmware
In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary changes in the...
|
8.8 High | — | 0,36% | 24 Feb 2020 |
|
CVE-2019-20481
miele xgw 3000 zigbee gateway firmware
In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunction with CVE-...
|
9.8 Critical | — | 0,59% | 24 Feb 2020 |
|
CVE-2015-9542
freeradius pam radius, debian linux +1 lainnya
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during...
|
7.5 High | — | 3,5% | 24 Feb 2020 |
|
CVE-2019-20044
zsh, fedoraproject fedora +6 lainnya
In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original p...
|
7.8 High | — | 0,50% | 24 Feb 2020 |
|
CVE-2019-15299
centreon web
An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database becomes bla...
|
8.8 High | — | 1,6% | 24 Feb 2020 |
|
CVE-2019-3670
mcafee web advisor
Remote Code Execution vulnerability in the web interface in McAfee Web Advisor (WA) 8.0.34745 and earlier allows remote unauthenticated attacker to execute arbitrary code...
|
6.1 Medium | — | 1,2% | 24 Feb 2020 |
|
CVE-2020-9351
smartclient
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malf...
|
5.3 Medium | — | 1,1% | 23 Feb 2020 |
|
CVE-2020-9352
smartclient
An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developer...
|
9.8 Critical | — | 1,9% | 23 Feb 2020 |
|
CVE-2020-9353
smartclient
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (...
|
7.5 High | — | 1,5% | 23 Feb 2020 |
|
CVE-2020-9354
smartclient
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (...
|
7.5 High | — | 1,2% | 23 Feb 2020 |
|
CVE-2020-9355
networkmanager-ssh project networkmanager-ssh, debian linux
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.
|
9.8 Critical | — | 2,2% | 23 Feb 2020 |
|
CVE-2020-9350
sas visual analytics
Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.
|
5.4 Medium | — | 0,52% | 23 Feb 2020 |
|
CVE-2020-9342
f-secure cloud protection for salesforce, f-secure email and server security +1 lainnya
The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.60...
|
5.5 Medium | — | 1,6% | 22 Feb 2020 |
|
CVE-2020-9338
soplanning
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.
|
5.4 Medium | — | 0,53% | 22 Feb 2020 |
|
CVE-2020-9339
soplanning
SOPlanning 1.45 allows XSS via the Name or Comment to status.php.
|
5.4 Medium | — | 0,56% | 22 Feb 2020 |
|
CVE-2020-9340
fauzantrif election project fauzantrif election
fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.
|
7.2 High | — | 1,0% | 22 Feb 2020 |
|
CVE-2020-9341
auieo candidats
CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI.
|
8.8 High | — | 0,60% | 22 Feb 2020 |
|
CVE-2020-9336
fauzantrif election project fauzantrif election
fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field.
|
5.4 Medium | — | 0,53% | 22 Feb 2020 |
|
CVE-2020-8813
cacti, fedoraproject fedora +3 lainnya
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time p...
|
8.8 High | — | 74,0% | 22 Feb 2020 |
|
CVE-2020-9039
couchbase server
Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer REST endpoi...
|
9.8 Critical | — | 3,9% | 22 Feb 2020 |
|
CVE-2020-8860
google android
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devic...
|
8.0 High | — | 0,71% | 22 Feb 2020 |
|
CVE-2020-8861
dlink dap-1330 firmware
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authenticat...
|
8.8 High | — | 6,5% | 22 Feb 2020 |
|
CVE-2020-8862
dlink dap-2610 firmware
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is...
|
8.8 High | — | 13,3% | 22 Feb 2020 |
|
CVE-2020-9330
xerox workcentre 3655 firmware, xerox workcentre 3655i firmware +16 lainnya
Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP addres...
|
8.8 High | — | 1,1% | 21 Feb 2020 |
|
CVE-2020-9327
sqlite, netapp cloud backup +9 lainnya
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.
|
7.5 High | — | 3,7% | 21 Feb 2020 |
|
CVE-2020-9329
gogs
Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition.
|
5.9 Medium | — | 0,77% | 21 Feb 2020 |
|
CVE-2020-7907
jetbrains scala
In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.
|
7.5 High | — | 0,84% | 21 Feb 2020 |
|
CVE-2019-18846
open-xchange appsuite
OX App Suite through 7.10.2 allows SSRF.
|
5.0 Medium | — | 0,92% | 21 Feb 2020 |