Katalog CVE (hal. 5109)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.217 (Critical 35.883 · High 103.262 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 255.401–255.450 dari 258.217 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-20100 atlassian jira, atlassian jira data center +1 lainnya The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version...	4.7 Medium	—	1,0%	12 Feb 2020
CVE-2013-7378 hubot scripts project hubot scripts scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.	9.8 Critical	—	2,7%	12 Feb 2020
CVE-2014-2560 phonerlite The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain ac...	7.5 High	—	1,7%	12 Feb 2020
CVE-2014-4607 oberhumer liblzo2, oberhumer lzo2 Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a...	8.8 High	—	5,3%	12 Feb 2020
CVE-2009-5139 google gizmo5 The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote att...	7.5 High	—	0,37%	12 Feb 2020
CVE-2009-5140 linksys spa2102 firmware The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for re...	8.8 High	—	1,4%	12 Feb 2020
CVE-2012-0810 linux kernel The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a...	5.5 Medium	—	0,38%	12 Feb 2020
CVE-2014-8128 libtiff LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds wr...	6.5 Medium	—	3,9%	12 Feb 2020
CVE-2015-7508 netsurf-browser libnsbmp Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (application cra...	8.8 High	—	3,1%	12 Feb 2020
CVE-2014-6262 zenoss core, debian linux Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrar...	7.5 High	—	7,2%	12 Feb 2020
CVE-2014-9390 git-scm git, mercurial +4 lainnya Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Ap...	9.8 Critical	—	75,6%	12 Feb 2020
CVE-2014-0234 redhat openshift The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hij...	9.8 Critical	—	3,8%	12 Feb 2020
CVE-2014-2595 barracuda web application firewall Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query s...	9.8 Critical	—	16,9%	12 Feb 2020
CVE-2014-4968 boatmob boat browser The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attackers to execute arbitra...	8.8 High	—	6,2%	12 Feb 2020
CVE-2020-8890 misp-project misp An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to b...	5.9 Medium	—	1,1%	12 Feb 2020
CVE-2020-8891 misp-project misp An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests.	5.9 Medium	—	1,4%	12 Feb 2020
CVE-2020-8892 misp-project misp An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests.	8.1 High	—	1,7%	12 Feb 2020
CVE-2020-8893 misp-project misp An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp.	7.5 High	—	2,1%	12 Feb 2020
CVE-2020-8894 misp-project misp An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php.	6.5 Medium	—	1,4%	12 Feb 2020
CVE-2020-0792 microsoft windows 10, microsoft windows server 2016 An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Priv...	8.8 High	—	1,3%	11 Feb 2020
CVE-2020-0756 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulner...	5.5 Medium	—	1,6%	11 Feb 2020
CVE-2020-0757 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists when Windows improperly handles Secure Socket Shell remote commands, aka 'Windows SSH Elevation of Privilege Vulnerability'...	7.8 High	—	0,91%	11 Feb 2020
CVE-2020-0759 microsoft excel, microsoft office 365 proplus A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Ex...	8.8 High	—	15,2%	11 Feb 2020
CVE-2020-0767 microsoft edge, microsoft chakracore A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerabil...	7.5 High	—	17,6%	11 Feb 2020
CVE-2020-0749 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service E...	7.8 High	—	0,85%	11 Feb 2020
CVE-2020-0750 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service E...	7.8 High	—	0,85%	11 Feb 2020
CVE-2020-0751 microsoft windows 10, microsoft windows server 2016 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating syste...	6.0 Medium	—	1,4%	11 Feb 2020
CVE-2020-0752 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,79%	11 Feb 2020
CVE-2020-0753 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege V...	7.8 High	—	2,3%	11 Feb 2020
CVE-2020-0754 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege V...	7.8 High	—	1,5%	11 Feb 2020
CVE-2020-0755 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulner...	5.5 Medium	—	1,6%	11 Feb 2020
CVE-2020-0737 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the tapisrv.dll handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID...	7.8 High	—	0,79%	11 Feb 2020
CVE-2020-0738 microsoft windows 10, microsoft windows 7 +6 lainnya A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerability'.	8.8 High	—	6,1%	11 Feb 2020
CVE-2020-0739 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creation in a secured location, aka 'W...	7.8 High	—	0,79%	11 Feb 2020
CVE-2020-0740 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service E...	7.8 High	—	0,85%	11 Feb 2020
CVE-2020-0741 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service E...	7.8 High	—	0,85%	11 Feb 2020
CVE-2020-0742 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service E...	7.8 High	—	0,85%	11 Feb 2020
CVE-2020-0743 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service E...	7.8 High	—	0,85%	11 Feb 2020
CVE-2020-0744 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve inf...	5.5 Medium	—	1,9%	11 Feb 2020
CVE-2020-0745 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Priv...	7.8 High	—	0,91%	11 Feb 2020
CVE-2020-0746 microsoft windows 10, microsoft windows server 2016 +1 lainnya An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disc...	5.5 Medium	—	5,1%	11 Feb 2020
CVE-2020-0747 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data Sharing Service Elevation of Pr...	7.8 High	—	0,79%	11 Feb 2020
CVE-2020-0748 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulner...	5.5 Medium	—	1,6%	11 Feb 2020
CVE-2020-0729 microsoft windows 10, microsoft windows 7 +6 lainnya A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploite...	8.8 High	—	30,9%	11 Feb 2020
CVE-2020-0730 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of...	7.1 High	—	0,90%	11 Feb 2020
CVE-2020-0731 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	—	1,1%	11 Feb 2020
CVE-2020-0732 microsoft windows 10, microsoft windows server 2016 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'. This CVE ID is uniqu...	7.8 High	—	0,96%	11 Feb 2020
CVE-2020-0733 microsoft windows malicious software removal tool An elevation of privilege vulnerability exists when the Windows Malicious Software Removal Tool (MSRT) improperly handles junctions.To exploit this vulnerability, an atta...	7.8 High	—	0,82%	11 Feb 2020
CVE-2020-0734 microsoft windows 10, microsoft windows 7 +6 lainnya A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execu...	8.8 High	—	16,5%	11 Feb 2020
CVE-2020-0735 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,79%	11 Feb 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.