Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2013-4395
simplemachines simple machines forum
Simple Machines Forum (SMF) through 2.0.5 has XSS
|
6.1 Medium | — | 0,99% | 12 Feb 2020 |
|
CVE-2013-6236
izoncam izon ip firmware
IZON IP 2.0.2: hard-coded password vulnerability
|
9.8 Critical | — | 10,2% | 12 Feb 2020 |
|
CVE-2013-6681
mapway tube map
Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability
|
5.9 Medium | — | 1,2% | 12 Feb 2020 |
|
CVE-2019-4427
ibm cloud cli
IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer w...
|
7.5 High | — | 0,49% | 12 Feb 2020 |
|
CVE-2019-4431
ibm engineering lifecycle optimization - publishing
IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t...
|
5.4 Medium | — | 0,56% | 12 Feb 2020 |
|
CVE-2019-4741
ibm content navigator
IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system,...
|
5.3 Medium | — | 0,96% | 12 Feb 2020 |
|
CVE-2013-1924
skill commerce skrill
Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2
|
7.5 High | — | 1,1% | 12 Feb 2020 |
|
CVE-2013-1938
zimbra
Zimbra 2013 has XSS in aspell.php
|
6.1 Medium | — | 3,3% | 12 Feb 2020 |
|
CVE-2013-2097
zpanel project zpanel
ZPanel through 10.1.0 has Remote Command Execution
|
7.8 High | — | 26,0% | 12 Feb 2020 |
|
CVE-2013-3494
umplayer project umplayer
A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external libraries. which could let a malicious...
|
7.8 High | — | 1,6% | 12 Feb 2020 |
|
CVE-2013-3685
spritesoftware spritebackup, spritesoftware spritebud
A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a race condit...
|
7.0 High | — | 0,37% | 12 Feb 2020 |
|
CVE-2013-4090
varnish cache project varnish cache
Varnish HTTP cache before 3.0.4: ACL bug
|
7.5 High | — | 1,3% | 12 Feb 2020 |
|
CVE-2020-2126
jenkins digitalocean
Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to...
|
4.3 Medium | — | 0,69% | 12 Feb 2020 |
|
CVE-2020-2127
jenkins bmc release package and deployment
Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be...
|
4.3 Medium | — | 0,69% | 12 Feb 2020 |
|
CVE-2020-2128
jenkins ecx copy data management
Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with E...
|
4.3 Medium | — | 0,69% | 12 Feb 2020 |
|
CVE-2020-2129
jenkins eagle tester
Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with ac...
|
6.5 Medium | — | 0,85% | 12 Feb 2020 |
|
CVE-2020-2130
jenkins harvest scm
Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with acc...
|
6.5 Medium | — | 0,85% | 12 Feb 2020 |
|
CVE-2020-2131
jenkins harvest scm
Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re...
|
6.5 Medium | — | 0,85% | 12 Feb 2020 |
|
CVE-2020-2132
jenkins parasoft environment manager
Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users w...
|
6.5 Medium | — | 0,85% | 12 Feb 2020 |
|
CVE-2020-2133
jenkins applatix
Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read per...
|
6.5 Medium | — | 0,85% | 12 Feb 2020 |
|
CVE-2020-8815
iktm bearftp
Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach...
|
7.5 High | — | 2,2% | 12 Feb 2020 |
|
CVE-2020-8839
chiyu-t bf-430 firmware
Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
|
6.1 Medium | — | 2,1% | 12 Feb 2020 |
|
CVE-2020-8595
istio, redhat openshift service mesh
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic...
|
7.3 High | — | 2,6% | 12 Feb 2020 |
|
CVE-2020-2115
jenkins nunit
Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
|
8.8 High | — | 1,2% | 12 Feb 2020 |
|
CVE-2020-2116
jenkins pipeline github notify step
A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using...
|
8.8 High | — | 0,68% | 12 Feb 2020 |
|
CVE-2020-2117
jenkins pipeline github notify step
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifi...
|
4.3 Medium | — | 0,68% | 12 Feb 2020 |
|
CVE-2020-2118
jenkins pipeline github notify step
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate cre...
|
4.3 Medium | — | 0,68% | 12 Feb 2020 |
|
CVE-2020-2119
jenkins azure ad
Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their...
|
5.3 Medium | — | 0,92% | 12 Feb 2020 |
|
CVE-2020-2120
jenkins fitnesse
Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.
|
8.8 High | — | 1,2% | 12 Feb 2020 |
|
CVE-2020-2121
jenkins google kubernetes engine
Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code e...
|
8.8 High | — | 2,7% | 12 Feb 2020 |
|
CVE-2020-2122
jenkins brakeman
Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerabili...
|
5.4 Medium | — | 0,82% | 12 Feb 2020 |
|
CVE-2020-2123
jenkins radargun
Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabi...
|
8.8 High | — | 2,3% | 12 Feb 2020 |
|
CVE-2020-2124
jenkins dynamic extended choice parameter
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by u...
|
4.3 Medium | — | 0,69% | 12 Feb 2020 |
|
CVE-2020-2125
jenkins debian package builder
Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed...
|
4.3 Medium | — | 0,69% | 12 Feb 2020 |
|
CVE-2020-2109
jenkins pipeline
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
|
8.8 High | — | 1,3% | 12 Feb 2020 |
|
CVE-2020-2110
jenkins script security
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations t...
|
8.8 High | — | 1,3% | 12 Feb 2020 |
|
CVE-2020-2111
jenkins subversion
Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site...
|
5.4 Medium | — | 0,92% | 12 Feb 2020 |
|
CVE-2020-2112
jenkins git parameter
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable b...
|
5.4 Medium | — | 0,74% | 12 Feb 2020 |
|
CVE-2020-2113
jenkins git parameter
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by...
|
5.4 Medium | — | 0,74% | 12 Feb 2020 |
|
CVE-2020-2114
jenkins s3 publisher
Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in t...
|
7.5 High | — | 1,1% | 12 Feb 2020 |
|
CVE-2019-19194
telink-semi tlsr8258 ble sdk, telink-semi tlsr8269 ble sdk +3 lainnya
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x t...
|
8.8 High | — | 1,0% | 12 Feb 2020 |
|
CVE-2019-19196
telink-semi tlsr8258 ble sdk, telink-semi tlsr8269 ble sdk +3 lainnya
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x t...
|
6.5 Medium | — | 1,4% | 12 Feb 2020 |
|
CVE-2019-19921
linuxfoundation runc, debian linux +3 lainnya
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be abl...
|
7.0 High | — | 0,43% | 12 Feb 2020 |
|
CVE-2013-1410
perforce p4web
Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
|
6.1 Medium | — | 1,5% | 12 Feb 2020 |
|
CVE-2013-2010
automattic wp super cache, boldgrid w3 total cache
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
|
9.8 Critical | — | 73,9% | 12 Feb 2020 |
|
CVE-2013-7381
libnotify project libnotify
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
|
9.8 Critical | — | 2,7% | 12 Feb 2020 |
|
CVE-2015-5617
enorth webpublisher cms
SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbN...
|
9.8 Critical | — | 2,0% | 12 Feb 2020 |
|
CVE-2015-7890
samsung galaxy s6 edge firmware
Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of se...
|
5.5 Medium | — | 1,3% | 12 Feb 2020 |
|
CVE-2019-20098
atlassian jira data center, atlassian jira server
The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An att...
|
4.3 Medium | — | 0,82% | 12 Feb 2020 |
|
CVE-2019-20099
atlassian jira data center, atlassian jira server
The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An atta...
|
4.3 Medium | — | 0,74% | 12 Feb 2020 |