Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-7959
labvantage
LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be abl...
|
5.3 Medium | — | 1,4% | 17 Feb 2020 |
|
CVE-2020-8768
phoenixcontact ilc 2050 bi firmware, phoenixcontact ilc 2050 bi-l firmware
An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure mechanism for read and write...
|
9.4 Critical | — | 1,8% | 17 Feb 2020 |
|
CVE-2020-1829
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, and V500R001C60SPC500 have a v...
|
7.5 High | — | 0,75% | 17 Feb 2020 |
|
CVE-2020-1841
huawei cloudlink board firmware, huawei dp300 firmware +2 lainnya
Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C00, V600R00...
|
7.5 High | — | 0,97% | 17 Feb 2020 |
|
CVE-2020-1827
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C6...
|
7.5 High | — | 0,75% | 17 Feb 2020 |
|
CVE-2014-1947
imagemagick, suse linux enterprise desktop +2 lainnya
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) an...
|
7.8 High | — | 7,0% | 17 Feb 2020 |
|
CVE-2020-1828
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC50...
|
7.5 High | — | 0,75% | 17 Feb 2020 |
|
CVE-2020-1857
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C6...
|
5.5 Medium | — | 0,21% | 17 Feb 2020 |
|
CVE-2020-1858
huawei nip6800 firmware, huawei secospace usg6600 firmware +1 lainnya
Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SP...
|
7.5 High | — | 0,77% | 17 Feb 2020 |
|
CVE-2020-1693
redhat spacewalk
A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could...
|
9.8 Critical | — | 4,3% | 17 Feb 2020 |
|
CVE-2019-19325
silverstripe
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScr...
|
6.1 Medium | — | 0,69% | 17 Feb 2020 |
|
CVE-2019-10790
taffydb taffy
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which...
|
7.5 High | — | 1,9% | 17 Feb 2020 |
|
CVE-2019-18998
hitachienergy asset suite
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to direc...
|
7.1 High | — | 0,78% | 17 Feb 2020 |
|
CVE-2019-20474
zohocorp manageengine remote access plus
An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a...
|
4.3 Medium | — | 1,4% | 17 Feb 2020 |
|
CVE-2020-7597
codecov
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec fu...
|
8.8 High | — | 2,9% | 17 Feb 2020 |
|
CVE-2013-7324
webkitgtk
Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpectedly high sound volume via malicious javascript....
|
5.3 Medium | — | 1,4% | 17 Feb 2020 |
|
CVE-2015-4715
owncloud, owncloud server
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has...
|
4.9 Medium | — | 1,4% | 17 Feb 2020 |
|
CVE-2015-5215
ipsilon-project ipsilon
The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which mak...
|
6.1 Medium | — | 1,1% | 17 Feb 2020 |
|
CVE-2015-5216
ipsilon-project ipsilon
The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier...
|
6.1 Medium | — | 1,3% | 17 Feb 2020 |
|
CVE-2015-6922
kaseya virtual system administrator
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication,...
|
9.8 Critical | — | 82,1% | 17 Feb 2020 |
|
CVE-2015-0258
o-dyn collabtive, debian linux +1 lainnya
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute ar...
|
8.8 High | — | 3,8% | 17 Feb 2020 |
|
CVE-2020-9043
wpcentral
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
|
8.8 High | — | 7,4% | 17 Feb 2020 |
|
CVE-2020-1704
redhat openshift service mesh
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhe...
|
7.8 High | — | 0,27% | 17 Feb 2020 |
|
CVE-2019-12954
solarwinds network performance monitor orion platform 2018 netpath, solarwinds network performance monitor orion platform 2018 npm
SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element...
|
5.4 Medium | — | 1,4% | 17 Feb 2020 |
|
CVE-2013-3722
opensips
A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.
|
7.5 High | — | 1,1% | 17 Feb 2020 |
|
CVE-2020-1692
moodle
Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
|
6.5 Medium | — | 0,64% | 17 Feb 2020 |
|
CVE-2020-9038
joplin project joplin
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
|
5.4 Medium | — | 3,6% | 17 Feb 2020 |
|
CVE-2020-6850
miniorange saml sp single sign on
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to t...
|
6.1 Medium | — | 1,4% | 17 Feb 2020 |
|
CVE-2013-3738
zabbix
A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute ar...
|
9.8 Critical | — | 3,1% | 17 Feb 2020 |
|
CVE-2020-9006
sygnoos popup builder
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization...
|
9.8 Critical | — | 8,6% | 17 Feb 2020 |
|
CVE-2020-8795
gitlab
In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
|
7.5 High | — | 1,2% | 17 Feb 2020 |
|
CVE-2020-8427
unitrends backup
In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass.
|
9.8 Critical | — | 1,5% | 17 Feb 2020 |
|
CVE-2020-8518
horde groupware, fedoraproject fedora +1 lainnya
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
|
9.8 Critical | — | 71,7% | 17 Feb 2020 |
|
CVE-2019-12825
gitlab
Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers can read Dock...
|
4.3 Medium | — | 1,1% | 17 Feb 2020 |
|
CVE-2020-9005
valvesoftware dota 2
meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafted map, a...
|
7.8 High | — | 2,2% | 17 Feb 2020 |
|
CVE-2020-7252
mcafee data exchange layer
Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicio...
|
5.5 Medium | — | 0,50% | 17 Feb 2020 |
|
CVE-2020-5531
mitsubishielectric mi5122-vw firmware, mitsubishielectric q24dhccpu-v firmware +3 lainnya
Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1, CH2): First...
|
9.8 Critical | — | 2,0% | 17 Feb 2020 |
|
CVE-2020-9024
iteris vantage velocity firmware
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (e...
|
9.8 Critical | — | 1,8% | 17 Feb 2020 |
|
CVE-2020-9025
iteris vantage velocity firmware
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
|
6.1 Medium | — | 0,67% | 17 Feb 2020 |
|
CVE-2020-9026
eltex-co ntp-2 firmware, eltex-co ntp-rg-1402g firmware
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.
|
9.8 Critical | — | 3,1% | 17 Feb 2020 |
|
CVE-2020-9027
eltex-co ntp-2 firmware, eltex-co ntp-rg-1402g firmware
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.
|
9.8 Critical | — | 3,0% | 17 Feb 2020 |
|
CVE-2020-9028
microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, De...
|
6.1 Medium | — | 0,67% | 17 Feb 2020 |
|
CVE-2020-9029
microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php.
|
6.5 Medium | — | 1,2% | 17 Feb 2020 |
|
CVE-2020-9030
microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the syslog.php.
|
6.5 Medium | — | 1,1% | 17 Feb 2020 |
|
CVE-2020-9031
microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemonlog.php.
|
6.5 Medium | — | 1,1% | 17 Feb 2020 |
|
CVE-2020-9032
microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernlog.php.
|
6.5 Medium | — | 1,1% | 17 Feb 2020 |
|
CVE-2020-9033
microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authlog.php.
|
6.5 Medium | — | 1,3% | 17 Feb 2020 |
|
CVE-2020-9020
iteris vantage velocity firmware
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server...
|
9.8 Critical | — | 2,5% | 17 Feb 2020 |
|
CVE-2020-9021
postoaktraffic awam bluetooth field device firmware
Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system...
|
9.8 Critical | — | 2,1% | 17 Feb 2020 |
|
CVE-2020-9022
cambiumnetworks xh2-120 firmware, cambiumnetworks xr2436 firmware +2 lainnya
An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.
|
6.1 Medium | — | 0,67% | 17 Feb 2020 |