Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-7209
hp linuxki
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
|
9.8 Critical | — | 98,8% | 13 Feb 2020 |
|
CVE-2019-18915
hp system event utility
A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local atta...
|
7.8 High | — | 1,5% | 13 Feb 2020 |
|
CVE-2019-5322
arubanetworks 5400r firmware, arubanetworks 3810 firmware +5 lainnya
A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 with GigT port, 2530 10/100 po...
|
7.5 High | — | 1,2% | 13 Feb 2020 |
|
CVE-2018-3987
rakuten viber
An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' functionality allow...
|
5.5 Medium | — | 0,38% | 13 Feb 2020 |
|
CVE-2020-1975
paloaltonetworks pan-os
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in...
|
8.8 High | — | 1,00% | 12 Feb 2020 |
|
CVE-2020-1976
paloaltonetworks globalprotect
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang...
|
5.5 Medium | — | 0,28% | 12 Feb 2020 |
|
CVE-2020-1977
paloaltonetworks expedition migration tool
Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrat...
|
8.8 High | — | 0,51% | 12 Feb 2020 |
|
CVE-2020-6975
digi connectport lts 32 mei bios, digi connectport lts 32 mei firmware
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Successful exploitation of this vulnerability could allow an...
|
4.9 Medium | — | 0,79% | 12 Feb 2020 |
|
CVE-2020-8955
weechat, fedoraproject fedora +3 lainnya
irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or p...
|
9.8 Critical | — | 3,7% | 12 Feb 2020 |
|
CVE-2013-6022
tikiwiki cms/groupware
A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitr...
|
6.1 Medium | — | 1,4% | 12 Feb 2020 |
|
CVE-2013-4602
avira antivir mailgate, avira antivir mailgate suite +8 lainnya
A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine.
|
5.5 Medium | — | 1,4% | 12 Feb 2020 |
|
CVE-2013-5106
python-mode project python-mode
A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19.
|
8.8 High | — | 1,7% | 12 Feb 2020 |
|
CVE-2011-4908
tinybrowser
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
|
9.8 Critical | — | 55,8% | 12 Feb 2020 |
|
CVE-2020-5399
cloudfoundry credhub, pivotal software cloud foundry cf-deployment
Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network bet...
|
7.4 High | — | 0,53% | 12 Feb 2020 |
|
CVE-2011-4906
tinybrowser
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
|
9.8 Critical | — | 9,6% | 12 Feb 2020 |
|
CVE-2020-8950
amd user experience program
The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing a crafted file in %PROGRAMDATA...
|
7.8 High | — | 0,99% | 12 Feb 2020 |
|
CVE-2020-6185
sap netweaver, sap s/4hana
Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an auth...
|
5.4 Medium | — | 0,54% | 12 Feb 2020 |
|
CVE-2020-6186
sap host agent
SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to De...
|
7.5 High | — | 1,2% | 12 Feb 2020 |
|
CVE-2020-6187
sap netweaver guided procedures
SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leadi...
|
4.9 Medium | — | 0,86% | 12 Feb 2020 |
|
CVE-2020-6188
sap erp, sap s/4 hana
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 10...
|
8.8 High | — | 0,68% | 12 Feb 2020 |
|
CVE-2020-6189
sap businessobjects business intelligence platform
Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network rela...
|
5.3 Medium | — | 0,88% | 12 Feb 2020 |
|
CVE-2020-6190
sap netweaver application server java
Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostnam...
|
5.8 Medium | — | 0,90% | 12 Feb 2020 |
|
CVE-2020-6191
sap landscape management
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape...
|
7.2 High | — | 1,6% | 12 Feb 2020 |
|
CVE-2020-6192
sap landscape management
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Man...
|
7.2 High | — | 1,7% | 12 Feb 2020 |
|
CVE-2020-6193
sap netweaver knowledge management
SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cr...
|
6.1 Medium | — | 0,71% | 12 Feb 2020 |
|
CVE-2020-6177
sap mobile platform
SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SA...
|
4.3 Medium | — | 0,85% | 12 Feb 2020 |
|
CVE-2020-6181
sap abap platform, sap netweaver
Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752,...
|
5.8 Medium | — | 0,78% | 12 Feb 2020 |
|
CVE-2020-6183
sap host agent
SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and rece...
|
6.5 Medium | — | 0,69% | 12 Feb 2020 |
|
CVE-2020-6184
sap netweaver, sap s/4hana
Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not suff...
|
6.1 Medium | — | 0,96% | 12 Feb 2020 |
|
CVE-2011-2343
google android
The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer.
|
2.4 Low | — | 0,16% | 12 Feb 2020 |
|
CVE-2011-2499
mambo-foundation mambo cms
Mambo CMS through 4.6.5 has multiple XSS.
|
6.1 Medium | — | 0,65% | 12 Feb 2020 |
|
CVE-2011-3336
php, apple mac os x +2 lainnya
regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.
|
7.5 High | — | 6,5% | 12 Feb 2020 |
|
CVE-2011-3901
google android
Android SQLite Journal before 4.0.1 has an information disclosure vulnerability.
|
7.5 High | — | 0,68% | 12 Feb 2020 |
|
CVE-2019-17519
nxp mcuxpresso software development kit
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio r...
|
8.8 High | — | 1,2% | 12 Feb 2020 |
|
CVE-2019-19192
st wb55, st bluenrg-2
The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Protocol (ATT)...
|
6.5 Medium | — | 1,0% | 12 Feb 2020 |
|
CVE-2020-8949
gocloud s2a wl firmware, gocloud s2a firmware +3 lainnya
Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote att...
|
8.8 High | — | 2,9% | 12 Feb 2020 |
|
CVE-2011-4338
shaman project shaman
Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges a...
|
7.8 High | — | 0,40% | 12 Feb 2020 |
|
CVE-2013-3725
invisioncommunity invision power board
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.
|
9.8 Critical | — | 1,8% | 12 Feb 2020 |
|
CVE-2019-16336
cypress cyble-416045, cypress cybl11573
The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured li...
|
6.5 Medium | — | 1,5% | 12 Feb 2020 |
|
CVE-2019-11867
realtek ndis
Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greate...
|
5.5 Medium | — | 0,28% | 12 Feb 2020 |
|
CVE-2014-3860
xilisoft video converter
Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability
|
7.8 High | — | 0,66% | 12 Feb 2020 |
|
CVE-2020-8945
gpgme project gpgme, redhat openshift container platform +7 lainnya
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a cr...
|
7.5 High | — | 5,1% | 12 Feb 2020 |
|
CVE-2020-8946
netis-systems wf2471 firmware
Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_typ...
|
8.8 High | — | 1,9% | 12 Feb 2020 |
|
CVE-2020-8947
artica pandora fms
functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_li...
|
7.2 High | — | 22,5% | 12 Feb 2020 |
|
CVE-2013-7286
att mobileiron sentry, att mobileiron virtual smartphone platform
MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
|
7.5 High | — | 1,5% | 12 Feb 2020 |
|
CVE-2020-7046
dovecot, fedoraproject fedora
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated trigge...
|
7.5 High | — | 51,3% | 12 Feb 2020 |
|
CVE-2020-7957
dovecot, fedoraproject fedora
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > charac...
|
5.3 Medium | — | 1,9% | 12 Feb 2020 |
|
CVE-2013-2637
otrs faq, otrs itsm +1 lainnya
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ art...
|
6.1 Medium | — | 4,3% | 12 Feb 2020 |
|
CVE-2011-4661
cisco ios
A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820), when configured with Cisco ISR Web...
|
7.5 High | — | 1,0% | 12 Feb 2020 |
|
CVE-2012-0951
nvidia display driver
A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry.
|
7.8 High | — | 0,38% | 12 Feb 2020 |