Katalog CVE (hal. 5103)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 255.101–255.150 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2012-0718 ibm tivoli endpoint manager IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies.	5.4 Medium	—	0,76%	18 Feb 2020
CVE-2019-10791 promise-probe project promise-probe promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without a...	9.8 Critical	—	2,0%	18 Feb 2020
CVE-2013-2679 belkin linksys e4200 firmware Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HT...	6.1 Medium	—	19,6%	18 Feb 2020
CVE-2013-3323 ibm change and configuration management database, ibm maximo asset management +11 lainnya A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure to invalida...	9.8 Critical	—	2,9%	18 Feb 2020
CVE-2013-6295 prestashop PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module	9.8 Critical	—	2,3%	18 Feb 2020
CVE-2014-3879 freebsd OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded...	9.8 Critical	—	2,7%	18 Feb 2020
CVE-2019-5613 freebsd In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. D...	9.8 Critical	—	0,58%	18 Feb 2020
CVE-2020-7450 freebsd In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3...	9.8 Critical	—	2,5%	18 Feb 2020
CVE-2019-10792 bodymen project bodymen bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__...	6.3 Medium	—	0,96%	18 Feb 2020
CVE-2019-10793 dot-object project dot-object dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__...	6.3 Medium	—	1,1%	18 Feb 2020
CVE-2019-10794 component-flatten project component-flatten All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a _...	6.3 Medium	—	0,73%	18 Feb 2020
CVE-2019-10795 undefsafe project undefsafe undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ p...	6.3 Medium	—	1,1%	18 Feb 2020
CVE-2019-18352 phoenixcontact fl nat 2208 firmware, phoenixcontact fl nat 2304-2gc-2sfp firmware Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using MAC-based port security.	8.2 High	—	0,44%	18 Feb 2020
CVE-2019-15875 freebsd In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735, and 11.3-RELEASE before 11.3...	3.3 Low	—	0,29%	18 Feb 2020
CVE-2020-9264 eset cyber security, eset internet security +4 lainnya ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of S...	5.5 Medium	—	1,2%	18 Feb 2020
CVE-2020-6844 topmanage olk webstore In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts.	8.8 High	—	0,72%	18 Feb 2020
CVE-2020-6845 topmanage olk webstore An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack.	6.1 Medium	—	0,87%	18 Feb 2020
CVE-2014-4966 redhat ansible Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attacke...	9.8 Critical	—	3,6%	18 Feb 2020
CVE-2014-4967 redhat ansible Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and p...	9.8 Critical	—	3,6%	18 Feb 2020
CVE-2013-4227 mozilla persona Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allo...	8.8 High	—	0,76%	18 Feb 2020
CVE-2013-4454 getbutterfly portable-phpmyadmin WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities	9.1 Critical	—	3,7%	18 Feb 2020
CVE-2014-4651 apache jclouds It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensitive data, c...	9.8 Critical	—	2,1%	18 Feb 2020
CVE-2015-6970 boschsecurity nbn-498 dinion2x day/night ip cameras firmware The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks v...	9.8 Critical	—	5,3%	18 Feb 2020
CVE-2015-7506 netsurf-browser libnsgif The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a...	6.5 Medium	—	1,3%	18 Feb 2020
CVE-2015-1425 jakweb gecko cms JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities	9.8 Critical	—	1,5%	18 Feb 2020
CVE-2013-5594 mozilla firefox Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding	4.3 Medium	—	0,68%	18 Feb 2020
CVE-2020-5530 realestateconnected easy property listings Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via...	8.8 High	—	0,82%	18 Feb 2020
CVE-2020-8010 broadcom unified infrastructure management CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A...	9.8 Critical	—	50,7%	18 Feb 2020
CVE-2020-8011 broadcom unified infrastructure management CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component....	7.5 High	—	2,2%	18 Feb 2020
CVE-2020-8012 broadcom unified infrastructure management CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote...	9.8 Critical	—	77,4%	18 Feb 2020
CVE-2020-1842 huawei hege-560 firmware, huawei osca-550 firmware +3 lainnya Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authenticatio...	6.8 Medium	—	0,24%	18 Feb 2020
CVE-2020-1843 huawei hege-560 firmware, huawei osca-550 firmware +3 lainnya Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), and OSCA-550X version 1.0.0.71(S...	6.8 Medium	—	0,23%	18 Feb 2020
CVE-2020-1855 huawei hege-560 firmware, huawei osca-550 firmware +4 lainnya Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability....	6.1 Medium	—	0,21%	18 Feb 2020
CVE-2020-1791 huawei mate 20 firmware HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system has a logic judging error under cert...	2.4 Low	—	0,21%	18 Feb 2020
CVE-2020-1812 huawei p30 firmware HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain applicati...	7.8 High	—	0,57%	18 Feb 2020
CVE-2020-1789 huawei osca-550 firmware, huawei osca-550a firmware +2 lainnya Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. The software does not require...	6.8 Medium	—	0,25%	18 Feb 2020
CVE-2020-1790 huawei gaussdb 200 GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the software does...	8.8 High	—	1,1%	18 Feb 2020
CVE-2020-1814 huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, a...	5.3 Medium	—	0,41%	18 Feb 2020
CVE-2020-1872 huawei p10 plus firmware Huawei smart phones P10 Plus with versions earlier than 9.1.0.201(C01E75R1P12T8), earlier than 9.1.0.252(C185E2R1P9T8), earlier than 9.1.0.252(C432E4R1P9T8), and earlier...	4.6 Medium	—	0,21%	18 Feb 2020
CVE-2020-1830 huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, a...	5.3 Medium	—	0,73%	18 Feb 2020
CVE-2020-1882 huawei mate 20 rs firmware, huawei mate 20 x firmware +2 lainnya Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C636E5R2P3); HUAWEI Mate 20 RS v...	4.6 Medium	—	0,21%	18 Feb 2020
CVE-2020-1811 huawei gaussdb 200 GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exploit this v...	8.8 High	—	1,1%	18 Feb 2020
CVE-2020-1815 huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, a...	7.5 High	—	0,72%	18 Feb 2020
CVE-2020-1816 huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, a...	7.5 High	—	0,86%	18 Feb 2020
CVE-2015-8751 jasper project jasper Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integ...	8.8 High	—	2,5%	17 Feb 2020
CVE-2014-4981 xorux lpar2rrd LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters.	9.8 Critical	—	6,2%	17 Feb 2020
CVE-2014-7236 twiki Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to...	9.1 Critical	—	55,6%	17 Feb 2020
CVE-2014-8089 zend framework, redhat enterprise linux +1 lainnya SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to e...	9.8 Critical	—	2,6%	17 Feb 2020
CVE-2020-1853 huawei gaussdb 200 GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an authenticated attacker can traverse directories and d...	6.5 Medium	—	0,73%	17 Feb 2020
CVE-2020-1856 huawei ngfw module firmware, huawei nip6300 firmware +4 lainnya Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00 have an information leakage vul...	7.5 High	—	0,76%	17 Feb 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.