Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2014-9613
netsweeper
Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to webadmin/aut...
|
9.8 Critical | — | 4,1% | 19 Feb 2020 |
|
CVE-2014-9614
netsweeper
The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a re...
|
9.8 Critical | — | 68,7% | 19 Feb 2020 |
|
CVE-2014-9615
netsweeper
Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.p...
|
6.1 Medium | — | 4,1% | 19 Feb 2020 |
|
CVE-2020-6061
coturn project coturn, fedoraproject fedora +2 lainnya
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to i...
|
9.8 Critical | — | 5,1% | 19 Feb 2020 |
|
CVE-2020-6062
coturn project coturn, debian linux +2 lainnya
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to server...
|
7.5 High | — | 6,1% | 19 Feb 2020 |
|
CVE-2019-10797
wso2 transport-http
Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.
|
6.5 Medium | — | 1,3% | 19 Feb 2020 |
|
CVE-2019-17333
tibco ebx
The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting...
|
5.4 Medium | — | 0,68% | 19 Feb 2020 |
|
CVE-2012-0055
linux kernel, canonical ubuntu linux
OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypass security...
|
7.8 High | — | 1,2% | 19 Feb 2020 |
|
CVE-2019-12437
silverstripe
In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,
|
8.8 High | — | 0,74% | 19 Feb 2020 |
|
CVE-2020-8824
hitrontech coda-4582u firmware
Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.
|
5.4 Medium | — | 0,56% | 19 Feb 2020 |
|
CVE-2020-8959
westerndigital sandiskssddashboardsetup.exe, westerndigitalssddashboardsetup.exe
Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.
|
7.8 High | — | 0,45% | 19 Feb 2020 |
|
CVE-2020-8441
jyaml project jyaml
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
|
9.8 Critical | — | 5,0% | 19 Feb 2020 |
|
CVE-2019-12246
silverstripe
SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.
|
4.3 Medium | — | 0,70% | 19 Feb 2020 |
|
CVE-2020-4230
ibm db2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenticated local attacker with spec...
|
6.7 Medium | — | 0,38% | 19 Feb 2020 |
|
CVE-2020-4135
ibm db2, netapp oncommand insight
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted packets to...
|
7.5 High | — | 2,9% | 19 Feb 2020 |
|
CVE-2020-4161
ibm db2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of cer...
|
6.5 Medium | — | 1,4% | 19 Feb 2020 |
|
CVE-2020-4200
ibm db2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specially crafted commands to cause a...
|
6.5 Medium | — | 1,6% | 19 Feb 2020 |
|
CVE-2020-4204
ibm db2
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking w...
|
7.8 High | — | 0,60% | 19 Feb 2020 |
|
CVE-2019-4429
ibm control desk, ibm maximo anywhere +8 lainnya
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a...
|
5.4 Medium | — | 0,56% | 19 Feb 2020 |
|
CVE-2019-4457
ibm jazz foundation
IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive information that could be used in fur...
|
6.5 Medium | — | 0,90% | 19 Feb 2020 |
|
CVE-2019-4640
ibm security secret server
IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which could result...
|
9.8 Critical | — | 0,52% | 19 Feb 2020 |
|
CVE-2012-1932
wolfcms wolf cms
A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via the setting[admin_email] parame...
|
4.8 Medium | — | 0,70% | 19 Feb 2020 |
|
CVE-2012-6614
dlink dsr-250n firmware
D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstrated by overwriting the super u...
|
7.2 High | — | 3,4% | 19 Feb 2020 |
|
CVE-2012-6685
nokogiri, redhat cloudforms management engine +6 lainnya
Nokogiri before 1.5.4 is vulnerable to XXE attacks
|
7.5 High | — | 2,2% | 19 Feb 2020 |
|
CVE-2014-2228
talend restlet
The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages.
|
9.8 Critical | — | 3,3% | 19 Feb 2020 |
|
CVE-2014-2727
trustwave mailmarshal
The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
|
9.8 Critical | — | 1,9% | 19 Feb 2020 |
|
CVE-2014-3622
php
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by...
|
9.8 Critical | — | 3,1% | 19 Feb 2020 |
|
CVE-2016-1000004
facebook hhvm
Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9....
|
9.8 Critical | — | 0,68% | 19 Feb 2020 |
|
CVE-2016-1000005
facebook hhvm
mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affec...
|
9.8 Critical | — | 1,4% | 19 Feb 2020 |
|
CVE-2016-1000109
facebook hhvm
HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in...
|
5.3 Medium | — | 5,1% | 19 Feb 2020 |
|
CVE-2019-20477
pyyaml, fedoraproject fedora
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subproce...
|
9.8 Critical | — | 5,1% | 19 Feb 2020 |
|
CVE-2019-20478
ruamel.yaml project ruamel.yaml
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue af...
|
9.8 Critical | — | 6,8% | 19 Feb 2020 |
|
CVE-2015-9543
openstack nova
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read...
|
3.3 Low | — | 0,41% | 19 Feb 2020 |
|
CVE-2015-0749
cisco unified communications manager
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected sof...
|
6.1 Medium | — | 0,79% | 19 Feb 2020 |
|
CVE-2011-2054
cisco asa 5500 firmware, cisco asa 5510 firmware +10 lainnya
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication typ...
|
7.5 High | — | 0,86% | 19 Feb 2020 |
|
CVE-2018-16994
phoenixcontact axl f bk pn firmware, phoenixcontact axl f bk eth firmware +1 lainnya
An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexroth S20-PN-...
|
7.5 High | — | 1,6% | 18 Feb 2020 |
|
CVE-2020-8633
synacor zimbra collaboration suite
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and acc...
|
5.3 Medium | — | 1,1% | 18 Feb 2020 |
|
CVE-2020-7796
synacor zimbra collaboration suite
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
|
9.8 Critical | KEV | 84,4% | 18 Feb 2020 |
|
CVE-2020-9268
soplanning
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.
|
7.5 High | — | 1,4% | 18 Feb 2020 |
|
CVE-2020-9269
soplanning
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.
|
7.2 High | — | 2,4% | 18 Feb 2020 |
|
CVE-2020-9270
icehrm
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.
|
8.8 High | — | 0,51% | 18 Feb 2020 |
|
CVE-2020-9271
icehrm
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.
|
6.5 Medium | — | 0,44% | 18 Feb 2020 |
|
CVE-2020-9265
ciprianmp phpmychat-plus
phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username.
|
8.2 High | — | 1,5% | 18 Feb 2020 |
|
CVE-2020-9266
soplanning
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.
|
6.5 Medium | — | 0,52% | 18 Feb 2020 |
|
CVE-2020-9267
soplanning
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.
|
6.5 Medium | — | 0,52% | 18 Feb 2020 |
|
CVE-2015-7507
netsurf-browser libnsbmp
libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (...
|
7.5 High | — | 2,0% | 18 Feb 2020 |
|
CVE-2013-4226
drupal authenticated user page caching
The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote attackers...
|
6.5 Medium | — | 1,6% | 18 Feb 2020 |
|
CVE-2013-4228
organic groups project organic groups
The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private group...
|
4.3 Medium | — | 1,2% | 18 Feb 2020 |
|
CVE-2015-7505
netsurf-browser libnsgif
Stack-based buffer overflow in the gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (application cras...
|
8.8 High | — | 3,1% | 18 Feb 2020 |
|
CVE-2015-7567
yeager cms
SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" parameter.
|
9.8 Critical | — | 3,7% | 18 Feb 2020 |