Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2012-1093
debian x11-common, debian linux
The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package installation.
|
7.8 High | — | 0,57% | 21 Feb 2020 |
|
CVE-2013-3587
f5 big-ip access policy manager, f5 big-ip advanced firewall manager +12 lainnya
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it e...
|
5.9 Medium | — | 6,0% | 21 Feb 2020 |
|
CVE-2012-0828
gnome gtk, xchat +1 lainnya
Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat clie...
|
9.8 Critical | — | 4,3% | 21 Feb 2020 |
|
CVE-2012-0844
netsurf-browser netsurf, debian linux
Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.
|
5.5 Medium | — | 0,42% | 21 Feb 2020 |
|
CVE-2012-6277
ibm domino, ibm notes +5 lainnya
Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security...
|
7.8 High | — | 8,1% | 21 Feb 2020 |
|
CVE-2013-3551
otrs, otrs itsm
Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8...
|
6.5 Medium | — | 1,6% | 21 Feb 2020 |
|
CVE-2013-4088
otrs
Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly restrict tick...
|
6.5 Medium | — | 2,4% | 21 Feb 2020 |
|
CVE-2012-0063
tucaneando tucan
Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbitrary code ith the permissions...
|
8.1 High | — | 2,3% | 21 Feb 2020 |
|
CVE-2019-19865
atos unify openscape uc web client
Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticat...
|
6.1 Medium | — | 0,65% | 21 Feb 2020 |
|
CVE-2019-19866
atos unify openscape uc web client
Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating th...
|
7.5 High | — | 1,9% | 21 Feb 2020 |
|
CVE-2020-6841
dlink dch-m225 firmware
D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter.
|
9.8 Critical | — | 2,8% | 21 Feb 2020 |
|
CVE-2020-6842
dlink dch-m225 firmware
D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name.
|
7.2 High | — | 2,3% | 21 Feb 2020 |
|
CVE-2020-5324
dell g3 3579 firmware, dell g3 3779 firmware +58 lainnya
Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during t...
|
4.4 Medium | — | 0,25% | 21 Feb 2020 |
|
CVE-2020-5326
dell chengming 3980 firmware, dell g3 3579 firmware +58 lainnya
Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manag...
|
5.3 Medium | — | 0,35% | 21 Feb 2020 |
|
CVE-2019-19452
patriotmemory viper rgb driver
A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integrity processes) can exploit thi...
|
7.8 High | — | 0,51% | 21 Feb 2020 |
|
CVE-2020-5524
nec aterm wg2600hs firmware, nec aterm wf1200c firmware +1 lainnya
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker...
|
8.8 High | — | 1,0% | 21 Feb 2020 |
|
CVE-2020-5525
nec aterm wg2600hs firmware, nec aterm wf1200c firmware +1 lainnya
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authentic...
|
8.0 High | — | 0,87% | 21 Feb 2020 |
|
CVE-2020-5533
nec aterm wg2600hs firmware
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
6.1 Medium | — | 0,80% | 21 Feb 2020 |
|
CVE-2020-5534
nec aterm wg2600hs firmware
Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspec...
|
8.0 High | — | 0,87% | 21 Feb 2020 |
|
CVE-2014-7914
google android
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass inte...
|
8.1 High | — | 0,48% | 21 Feb 2020 |
|
CVE-2016-4606
haxx curl
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-o...
|
9.8 Critical | — | 3,4% | 21 Feb 2020 |
|
CVE-2020-5243
uap-core project uap-core
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of...
|
7.5 High | — | 2,3% | 21 Feb 2020 |
|
CVE-2020-5242
openhab
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system wit...
|
8.8 High | — | 2,0% | 20 Feb 2020 |
|
CVE-2020-8601
trendmicro vulnerability protection
Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located in the sam...
|
7.8 High | — | 0,40% | 20 Feb 2020 |
|
CVE-2020-8960
westerndigital mycloud.com
Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.
|
6.1 Medium | — | 0,87% | 20 Feb 2020 |
|
CVE-2019-19694
trendmicro antivirus + security 2019, trendmicro internet security 2019 +3 lainnya
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manip...
|
4.7 Medium | — | 0,37% | 20 Feb 2020 |
|
CVE-2019-14688
trendmicro control manager, trendmicro endpoint sensor +6 lainnya
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that...
|
7.0 High | — | 1,9% | 20 Feb 2020 |
|
CVE-2020-8990
western digital ibi, western digital my cloud home
Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.
|
9.1 Critical | — | 1,00% | 20 Feb 2020 |
|
CVE-2020-9003
wpchill modula image gallery
A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticate...
|
5.4 Medium | — | 1,0% | 20 Feb 2020 |
|
CVE-2020-9015
arista dcs-7050qx-32s-r firmware, arista dcs-7050cx3-32s-r firmware +1 lainnya
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TA...
|
9.8 Critical | — | 16,5% | 20 Feb 2020 |
|
CVE-2020-9320
avira anti-malware sdk, avira antivirus server +6 lainnya
Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, Antivirus fo...
|
5.5 Medium | — | 2,9% | 20 Feb 2020 |
|
CVE-2019-16297
linuxfoundation open network operating system
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p4tutorial), the host event listener does not handle...
|
7.5 High | — | 1,7% | 20 Feb 2020 |
|
CVE-2019-16298
linuxfoundation open network operating system
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.virtualbng), the host event li...
|
7.5 High | — | 1,7% | 20 Feb 2020 |
|
CVE-2019-16299
linuxfoundation open network operating system
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host event listener does not handle the...
|
7.5 High | — | 1,7% | 20 Feb 2020 |
|
CVE-2019-16300
linuxfoundation open network operating system
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosproject.acl), the host event listener does not handle the...
|
7.5 High | — | 2,0% | 20 Feb 2020 |
|
CVE-2019-16301
linuxfoundation open network operating system
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.onosproject.vtn), the host event listener does not ha...
|
7.5 High | — | 1,7% | 20 Feb 2020 |
|
CVE-2019-16302
linuxfoundation open network operating system
An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.evpnopenflow), the host event listener does not han...
|
7.5 High | — | 1,7% | 20 Feb 2020 |
|
CVE-2019-11189
opennetworking onos
Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackers to bypass...
|
7.5 High | — | 1,1% | 20 Feb 2020 |
|
CVE-2020-9318
red-gate sql monitor
Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuring the SNMP alert settings in the UI. This is fixed...
|
7.2 High | — | 0,90% | 20 Feb 2020 |
|
CVE-2020-6968
honeywell inncom inncontrol firmware
Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files.
|
7.8 High | — | 0,26% | 20 Feb 2020 |
|
CVE-2020-6977
ge vivid e95 firmware, ge vivid e90 firmware +14 lainnya
A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape th...
|
6.8 Medium | — | 0,43% | 20 Feb 2020 |
|
CVE-2020-3764
adobe media encoder
Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
|
7.8 High | — | 5,1% | 20 Feb 2020 |
|
CVE-2020-3765
adobe after effects
Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
|
9.8 Critical | — | 5,6% | 20 Feb 2020 |
|
CVE-2020-9283
golang package ssh, debian linux
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can att...
|
7.5 High | — | 20,9% | 20 Feb 2020 |
|
CVE-2014-4019
zte zxv10 w300 firmware
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to...
|
7.5 High | — | 12,7% | 20 Feb 2020 |
|
CVE-2011-0699
linux kernel
Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (heap-based buffer overflow) or...
|
7.0 High | — | 0,32% | 20 Feb 2020 |
|
CVE-2011-4915
linux kernel, canonical ubuntu linux +1 lainnya
fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.
|
5.5 Medium | — | 0,51% | 20 Feb 2020 |
|
CVE-2012-3351
longtailvideo jw player
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1...
|
6.1 Medium | — | 2,6% | 20 Feb 2020 |
|
CVE-2019-4752
ibm emptoris spend analysis, ibm emptoris strategic supply management platform
IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injection. A remote attacker could...
|
8.8 High | — | 1,3% | 20 Feb 2020 |
|
CVE-2019-4583
ibm maximo asset management
IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future att...
|
4.3 Medium | — | 0,99% | 20 Feb 2020 |