Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-20455
globalpayments php sdk
Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations.
|
5.9 Medium | — | 0,98% | 14 Feb 2020 |
|
CVE-2018-21032
hitachi device manager, hitachi compute systems manager +1 lainnya
A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical informat...
|
4.3 Medium | — | 0,87% | 14 Feb 2020 |
|
CVE-2018-21033
hitachi device manager, hitachi compute systems manager +6 lainnya
A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 a...
|
6.5 Medium | — | 0,84% | 14 Feb 2020 |
|
CVE-2020-7251
mcafee endpoint security
Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable se...
|
5.5 Medium | — | 0,22% | 14 Feb 2020 |
|
CVE-2020-5532
extrun ilbo
ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authenticatio...
|
4.3 Medium | — | 0,92% | 14 Feb 2020 |
|
CVE-2019-20454
pcre2, fedoraproject fedora +1 lainnya
An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications t...
|
7.5 High | — | 1,6% | 14 Feb 2020 |
|
CVE-2020-8991
redhat lvm2
vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2...
|
2.3 Low | — | 0,33% | 14 Feb 2020 |
|
CVE-2020-8992
linux kernel, canonical ubuntu linux +8 lainnya
ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journa...
|
5.5 Medium | — | 0,42% | 14 Feb 2020 |
|
CVE-2013-5687
aicorporation risknet acquirer
RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure.
|
7.5 High | — | 1,4% | 14 Feb 2020 |
|
CVE-2013-4791
prestashop
PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.
|
5.4 Medium | — | 0,56% | 14 Feb 2020 |
|
CVE-2013-4792
prestashop
PrestaShop before 1.4.11 allows logout CSRF.
|
5.5 Medium | — | 0,28% | 14 Feb 2020 |
|
CVE-2013-5212
easyxdm
Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file.
|
6.1 Medium | — | 0,91% | 14 Feb 2020 |
|
CVE-2013-7287
mobileiron sentry, mobileiron virtual smartphone platform
MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.
|
9.8 Critical | — | 1,4% | 13 Feb 2020 |
|
CVE-2013-6277
qnap viocard 300 firmware
QNAP VioCard 300 has hardcoded RSA private keys.
|
7.5 High | — | 1,6% | 13 Feb 2020 |
|
CVE-2013-6360
trendnet ts-s402 firmware
TRENDnet TS-S402 has a backdoor to enable TELNET.
|
7.5 High | — | 0,97% | 13 Feb 2020 |
|
CVE-2013-6362
xerox colorqube 9201 firmware, xerox colorqube 9202 firmware +10 lainnya
Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts.
|
9.8 Critical | — | 1,2% | 13 Feb 2020 |
|
CVE-2013-6927
triplc trilogi server
Internet TRiLOGI Server (unknown versions) could allow a local user to bypass security and create a local user account.
|
5.5 Medium | — | 0,34% | 13 Feb 2020 |
|
CVE-2013-7098
infradead openconnect
OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection.
|
9.8 Critical | — | 1,5% | 13 Feb 2020 |
|
CVE-2013-7173
belkin n750 firmware
Belkin n750 routers have a buffer overflow.
|
9.8 Critical | — | 2,0% | 13 Feb 2020 |
|
CVE-2014-1617
promotic
Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service.
|
6.5 Medium | — | 1,0% | 13 Feb 2020 |
|
CVE-2013-1634
intel 82574l controller firmware
A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be...
|
7.5 High | — | 2,5% | 13 Feb 2020 |
|
CVE-2019-3998
simplisafe ss3 firmware
Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network the base stat...
|
5.5 Medium | — | 0,36% | 13 Feb 2020 |
|
CVE-2020-8988
voatz
The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers (after using root access to make a copy of the lo...
|
5.9 Medium | — | 0,85% | 13 Feb 2020 |
|
CVE-2020-8989
voatz
In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the a...
|
5.3 Medium | — | 1,0% | 13 Feb 2020 |
|
CVE-2015-6589
kaseya virtual system administrator
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 bef...
|
8.8 High | — | 13,6% | 13 Feb 2020 |
|
CVE-2013-1400
cardozatechnologies wordpress poll
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_...
|
9.8 Critical | — | 3,2% | 13 Feb 2020 |
|
CVE-2013-1401
cardozatechnologies wordpress poll
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote a...
|
9.8 Critical | — | 5,0% | 13 Feb 2020 |
|
CVE-2015-3309
etherpad
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user run...
|
7.5 High | — | 2,3% | 13 Feb 2020 |
|
CVE-2014-3208
askpop3d project askpop3d
A Denial of Service vulnerability exists in askpop3d 0.7.7 in free (pszQuery),
|
7.5 High | — | 1,5% | 13 Feb 2020 |
|
CVE-2012-6091
magentocommerce magento
Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.
|
7.5 High | — | 2,0% | 13 Feb 2020 |
|
CVE-2020-0563
intel manycore platform software stack
Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local acces...
|
7.8 High | — | 0,29% | 13 Feb 2020 |
|
CVE-2020-0564
intel raid web console 3
Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privi...
|
7.8 High | — | 0,29% | 13 Feb 2020 |
|
CVE-2020-0561
intel software guard extensions sdk, opensuse backports +1 lainnya
Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
|
7.8 High | — | 0,41% | 13 Feb 2020 |
|
CVE-2020-0562
intel raid web console 2
Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
|
7.8 High | — | 0,29% | 13 Feb 2020 |
|
CVE-2019-14598
intel converged security management engine firmware, netapp steelstore cloud integrated storage
Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may...
|
6.7 Medium | — | 0,45% | 13 Feb 2020 |
|
CVE-2012-5623
squirrelmail change passwd
Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.
|
7.5 High | — | 0,67% | 13 Feb 2020 |
|
CVE-2014-3919
netgear cg3100 firmware
A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtai...
|
9.3 Critical | — | 0,92% | 13 Feb 2020 |
|
CVE-2014-4170
freereprintables articlefr
A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a re...
|
9.8 Critical | — | 14,5% | 13 Feb 2020 |
|
CVE-2014-4198
bssys rbs bs-client. retail client
A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, whi...
|
9.1 Critical | — | 1,3% | 13 Feb 2020 |
|
CVE-2019-10785
linuxfoundation dojox, debian linux
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode onl...
|
6.1 Medium | — | 1,8% | 13 Feb 2020 |
|
CVE-2020-0560
intel renesas electronics usb 3.0 driver
Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enable escalati...
|
7.8 High | — | 0,29% | 13 Feb 2020 |
|
CVE-2020-8981
mantisbt source integration
A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repo...
|
6.1 Medium | — | 1,1% | 13 Feb 2020 |
|
CVE-2012-1500
atlassian greenhopper, atlassian jira
Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.
|
5.4 Medium | — | 1,1% | 13 Feb 2020 |
|
CVE-2012-1903
telligent community
XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter.
|
5.4 Medium | — | 0,55% | 13 Feb 2020 |
|
CVE-2020-8801
salesagility suitecrm
SuiteCRM through 7.11.11 allows PHAR Deserialization.
|
7.2 High | — | 2,8% | 13 Feb 2020 |
|
CVE-2020-8802
salesagility suitecrm
SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
|
9.8 Critical | — | 2,6% | 13 Feb 2020 |
|
CVE-2020-8803
salesagility suitecrm
SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.
|
9.8 Critical | — | 3,3% | 13 Feb 2020 |
|
CVE-2020-8804
salesagility suitecrm
SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
|
6.5 Medium | — | 1,4% | 13 Feb 2020 |
|
CVE-2020-8800
salesagility suitecrm
SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.
|
8.8 High | — | 2,8% | 13 Feb 2020 |
|
CVE-2020-8614
askey ap4000w firmware
An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted network packer to the b...
|
9.8 Critical | — | 2,6% | 13 Feb 2020 |