Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2014-4650
python, redhat software collections +1 lainnya
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read...
|
9.8 Critical | — | 24,7% | 20 Feb 2020 |
|
CVE-2015-4410
moped project moped, fedoraproject fedora
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worke...
|
7.5 High | — | 5,7% | 20 Feb 2020 |
|
CVE-2015-4411
mongodb bson, fedoraproject fedora
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource co...
|
7.5 High | — | 6,4% | 20 Feb 2020 |
|
CVE-2014-7951
google android
Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Andr...
|
4.6 Medium | — | 1,1% | 20 Feb 2020 |
|
CVE-2019-19741
ea origin
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and C...
|
7.8 High | — | 0,72% | 20 Feb 2020 |
|
CVE-2020-9272
proftpd, siemens simatic net cp 1543-1 firmware +3 lainnya
ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.
|
7.5 High | — | 2,1% | 20 Feb 2020 |
|
CVE-2020-9273
proftpd, debian linux +5 lainnya
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possibl...
|
8.8 High | — | 12,1% | 20 Feb 2020 |
|
CVE-2014-4657
redhat ansible
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instruction...
|
9.8 Critical | — | 4,4% | 20 Feb 2020 |
|
CVE-2014-4658
redhat ansible
The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key infor...
|
5.5 Medium | — | 0,42% | 20 Feb 2020 |
|
CVE-2014-4659
redhat ansible
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by re...
|
5.5 Medium | — | 0,37% | 20 Feb 2020 |
|
CVE-2012-5362
microsoft windows 7, microsoft windows server 2003 +2 lainnya
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a di...
|
7.5 High | — | 14,5% | 20 Feb 2020 |
|
CVE-2012-5363
freebsd, netbsd
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbo...
|
7.5 High | — | 2,6% | 20 Feb 2020 |
|
CVE-2012-5364
microsoft windows 7, microsoft windows server 2003 +2 lainnya
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets contain...
|
7.5 High | — | 14,5% | 20 Feb 2020 |
|
CVE-2012-5365
freebsd, netbsd
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router...
|
7.5 High | — | 2,6% | 20 Feb 2020 |
|
CVE-2012-5366
apple mac os x
The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Adve...
|
7.5 High | — | 2,2% | 20 Feb 2020 |
|
CVE-2020-9308
libarchive, canonical ubuntu linux +1 lainnya
archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading...
|
8.8 High | — | 2,3% | 20 Feb 2020 |
|
CVE-2019-20479
mod auth openidc, debian linux +2 lainnya
A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.
|
6.1 Medium | — | 1,9% | 20 Feb 2020 |
|
CVE-2012-2629
axous
Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack the authentication o...
|
8.8 High | — | 2,3% | 20 Feb 2020 |
|
CVE-2011-2498
linux kernel, canonical ubuntu linux
The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggering creation of PTE pages.
|
5.5 Medium | — | 0,39% | 20 Feb 2020 |
|
CVE-2014-3484
musl-libc musl
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to...
|
9.8 Critical | — | 2,2% | 20 Feb 2020 |
|
CVE-2015-2923
freebsd
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_l...
|
6.5 Medium | — | 1,4% | 20 Feb 2020 |
|
CVE-2014-4660
redhat ansible
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive...
|
5.5 Medium | — | 0,38% | 20 Feb 2020 |
|
CVE-2014-4678
redhat ansible, debian linux
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instruction...
|
9.8 Critical | — | 5,2% | 20 Feb 2020 |
|
CVE-2016-3182
uclouvain openjpeg
The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 f...
|
5.5 Medium | — | 1,5% | 20 Feb 2020 |
|
CVE-2013-2018
universityofcalifornia boinc client
Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
|
9.8 Critical | — | 2,0% | 20 Feb 2020 |
|
CVE-2014-9617
netsweeper
Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct ph...
|
6.1 Medium | — | 8,0% | 19 Feb 2020 |
|
CVE-2015-7747
canonical ubuntu linux, fedoraproject fedora +1 lainnya
Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (pr...
|
8.8 High | — | 8,8% | 19 Feb 2020 |
|
CVE-2020-6970
emerson openenterprise scada server
A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all versions of Op...
|
9.8 Critical | — | 2,6% | 19 Feb 2020 |
|
CVE-2020-7942
puppet, puppet agent
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed acces...
|
6.5 Medium | — | 0,80% | 19 Feb 2020 |
|
CVE-2020-3943
vmware vrealize operations
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote...
|
9.8 Critical | — | 2,3% | 19 Feb 2020 |
|
CVE-2020-3944
vmware vrealize operations
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication bypass. An una...
|
8.6 High | — | 1,5% | 19 Feb 2020 |
|
CVE-2020-3945
vmware vrealize operations
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due to incorrect pairing implemen...
|
7.5 High | — | 1,4% | 19 Feb 2020 |
|
CVE-2020-3138
cisco enterprise nfv infrastructure software
A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file...
|
6.7 Medium | — | 0,21% | 19 Feb 2020 |
|
CVE-2020-3153
cisco anyconnect secure mobility client
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files...
|
6.5 Medium | KEV · ransomware | 28,3% | 19 Feb 2020 |
|
CVE-2020-3154
cisco cloud web security
A vulnerability in the web UI of Cisco Cloud Web Security (CWS) could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists b...
|
4.9 Medium | — | 0,87% | 19 Feb 2020 |
|
CVE-2020-3156
cisco identity services engine
A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated remote attacker to conduct cross-site scripting attacks. The vul...
|
6.1 Medium | — | 1,1% | 19 Feb 2020 |
|
CVE-2020-3158
cisco smart software manager on-prem
A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part o...
|
9.1 Critical | — | 2,6% | 19 Feb 2020 |
|
CVE-2020-3159
cisco finesse
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack agai...
|
6.1 Medium | — | 0,80% | 19 Feb 2020 |
|
CVE-2020-3160
cisco meeting server
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause...
|
5.3 Medium | — | 1,2% | 19 Feb 2020 |
|
CVE-2020-3163
cisco unified contact center enterprise
A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated, remote attacker to cause a denial of service (DoS) cond...
|
5.9 Medium | — | 0,90% | 19 Feb 2020 |
|
CVE-2020-3112
cisco data center network manager
A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the applicatio...
|
8.8 High | — | 1,5% | 19 Feb 2020 |
|
CVE-2020-3113
cisco data center network manager
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct a cross-site sc...
|
5.4 Medium | — | 0,63% | 19 Feb 2020 |
|
CVE-2020-3114
cisco data center network manager
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site...
|
8.8 High | — | 0,57% | 19 Feb 2020 |
|
CVE-2020-3132
cisco cloud email security, cisco email security appliance
A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker t...
|
5.9 Medium | — | 1,5% | 19 Feb 2020 |
|
CVE-2019-1950
cisco ios xe
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due...
|
8.4 High | — | 0,33% | 19 Feb 2020 |
|
CVE-2014-9606
netsweeper
Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web...
|
6.1 Medium | — | 4,2% | 19 Feb 2020 |
|
CVE-2014-9607
netsweeper
Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML...
|
6.1 Medium | — | 4,9% | 19 Feb 2020 |
|
CVE-2014-9608
netsweeper
Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote at...
|
6.1 Medium | — | 4,7% | 19 Feb 2020 |
|
CVE-2014-9609
netsweeper
Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers...
|
5.3 Medium | — | 12,6% | 19 Feb 2020 |
|
CVE-2014-9612
netsweeper
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute...
|
9.8 Critical | — | 4,9% | 19 Feb 2020 |