Katalog CVE (hal. 5105)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.286 (Critical 35.887 · High 103.298 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 12:38 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 255.201–255.250 dari 258.286 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-9023 iteris vantage velocity firmware Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetoo...	9.8 Critical	—	1,5%	17 Feb 2020
CVE-2020-9034 microchip syncserver s100 firmware, microchip syncserver s200 firmware +3 lainnya Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modif...	7.5 High	—	0,91%	17 Feb 2020
CVE-2020-9016 dolibarr erp/crm Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.	5.4 Medium	—	0,85%	16 Feb 2020
CVE-2020-9013 arvato skillpipe Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.	4.3 Medium	—	1,3%	16 Feb 2020
CVE-2020-9007 codologic codoforum Codoforum 4.8.8 allows self-XSS via the title of a new topic.	5.4 Medium	—	0,53%	16 Feb 2020
CVE-2020-9012 gluu server A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or...	6.1 Medium	—	0,78%	16 Feb 2020
CVE-2019-20456 goverlan client agent, goverlan reach console +1 lainnya Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Inject...	7.8 High	—	0,72%	16 Feb 2020
CVE-2020-8996 aishu anyshare cloud AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI.	4.3 Medium	—	1,1%	16 Feb 2020
CVE-2020-8997 abbott freestyle libre firmware Older generation Abbott FreeStyle Libre sensors allow remote attackers within close proximity to enable write access to memory via a specific NFC unlock command. NOTE: Th...	8.8 High	—	0,63%	16 Feb 2020
CVE-2020-7050 codologic codoforum Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DO...	5.4 Medium	—	0,54%	15 Feb 2020
CVE-2020-8128 jsreport An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.	9.8 Critical	—	2,7%	14 Feb 2020
CVE-2020-8129 script-manager project script-manager An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.	9.8 Critical	—	2,9%	14 Feb 2020
CVE-2020-6068 accusoft imagegear An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted PNG file can...	8.8 High	—	3,7%	14 Feb 2020
CVE-2019-15592 gitlab GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activit...	4.3 Medium	—	1,0%	14 Feb 2020
CVE-2019-15594 gitlab GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.	4.3 Medium	—	0,82%	14 Feb 2020
CVE-2019-13965 combodo itop Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php...	6.1 Medium	—	1,6%	14 Feb 2020
CVE-2019-13966 combodo itop In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (whi...	6.1 Medium	—	0,79%	14 Feb 2020
CVE-2019-13967 combodo itop iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the p...	7.5 High	—	1,3%	14 Feb 2020
CVE-2019-4392 hcltech appscan HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.	9.8 Critical	—	1,4%	14 Feb 2020
CVE-2019-5187 accusoft imagegear An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially crafted TI...	8.8 High	—	3,7%	14 Feb 2020
CVE-2013-4211 openx A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbi...	9.8 Critical	—	70,7%	14 Feb 2020
CVE-2020-8594 ninjaforms ninja forms The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[re...	5.4 Medium	—	1,2%	14 Feb 2020
CVE-2020-8612 progess moveit transfer, progress moveit transfer In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an aut...	9.0 Critical	—	1,7%	14 Feb 2020
CVE-2020-8843 istio An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the...	7.4 High	—	1,1%	14 Feb 2020
CVE-2020-8854 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit th...	7.8 High	—	8,3%	14 Feb 2020
CVE-2020-8855 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit thi...	7.8 High	—	6,1%	14 Feb 2020
CVE-2020-8856 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit thi...	7.8 High	—	19,8%	14 Feb 2020
CVE-2020-8857 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this v...	7.8 High	—	6,1%	14 Feb 2020
CVE-2020-8858 moxa mgate 5105-mb-eip firmware, moxa mgate 5105-mb-eip-t firmware This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required...	8.8 High	—	8,6%	14 Feb 2020
CVE-2020-8844 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this v...	7.8 High	—	23,7%	14 Feb 2020
CVE-2020-8845 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit thi...	7.8 High	—	19,5%	14 Feb 2020
CVE-2020-8846 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit thi...	7.8 High	—	19,8%	14 Feb 2020
CVE-2020-8847 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this v...	7.8 High	—	6,1%	14 Feb 2020
CVE-2020-8848 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this v...	7.8 High	—	6,1%	14 Feb 2020
CVE-2020-8849 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this v...	7.8 High	—	6,0%	14 Feb 2020
CVE-2020-8850 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this v...	7.8 High	—	6,0%	14 Feb 2020
CVE-2020-8851 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this v...	7.8 High	—	6,0%	14 Feb 2020
CVE-2020-8852 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploi...	3.3 Low	—	4,2%	14 Feb 2020
CVE-2020-8853 foxitsoftware reader, foxitsoftware phantompdf This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit th...	7.8 High	—	8,2%	14 Feb 2020
CVE-2020-8611 progess moveit transfer, progress moveit transfer In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an...	8.8 High	—	1,2%	14 Feb 2020
CVE-2019-11215 combodo itop In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a malicio...	8.1 High	—	1,2%	14 Feb 2020
CVE-2019-6193 lenovo xclarity administrator An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some confi...	7.5 High	—	1,0%	14 Feb 2020
CVE-2019-6194 lenovo xclarity administrator An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure...	5.5 Medium	—	0,74%	14 Feb 2020
CVE-2019-6195 lenovo xclarity controller An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser...	4.8 Medium	—	0,64%	14 Feb 2020
CVE-2019-6190 lenovo thinkcentre e93 firmware, lenovo thinkcentre m6500s firmware +58 lainnya Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that co...	5.5 Medium	—	0,28%	14 Feb 2020
CVE-2019-19879 hashicorp sentinel HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2.	7.5 High	—	1,2%	14 Feb 2020
CVE-2019-20045 s3india husky rtu 6049-e70 firmware The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafted malicious packets could caus...	7.5 High	—	1,2%	14 Feb 2020
CVE-2019-20046 s3india husky rtu 6049-e70 firmware The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not require adequate...	9.8 Critical	—	2,2%	14 Feb 2020
CVE-2019-19757 lenovo xclarity administrator An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions p...	5.4 Medium	—	0,52%	14 Feb 2020
CVE-2019-19758 lenovo ez media & backup center ix2 firmware, lenovo ez media & backup center ix2-dl firmware A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to r...	6.1 Medium	—	0,86%	14 Feb 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.