Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-6387
google chrome
Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.
|
8.8 High | — | 1,8% | 11 Feb 2020 |
|
CVE-2020-6388
google chrome
Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 2,0% | 11 Feb 2020 |
|
CVE-2020-6389
google chrome
Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.
|
8.8 High | — | 1,7% | 11 Feb 2020 |
|
CVE-2020-6390
google chrome, fedoraproject fedora +6 lainnya
Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 3,1% | 11 Feb 2020 |
|
CVE-2020-6391
google chrome, opensuse backports sle +6 lainnya
Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML p...
|
4.3 Medium | — | 1,3% | 11 Feb 2020 |
|
CVE-2020-6392
google chrome, opensuse backports sle +6 lainnya
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass n...
|
4.3 Medium | — | 1,5% | 11 Feb 2020 |
|
CVE-2020-6393
google chrome, opensuse backports sle +6 lainnya
Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
|
6.5 Medium | — | 1,9% | 11 Feb 2020 |
|
CVE-2020-6394
google chrome, opensuse backports sle +6 lainnya
Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.
|
5.4 Medium | — | 1,7% | 11 Feb 2020 |
|
CVE-2020-6395
google chrome
Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a cr...
|
6.5 Medium | — | 2,0% | 11 Feb 2020 |
|
CVE-2020-6378
google chrome, fedoraproject fedora
Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 1,2% | 11 Feb 2020 |
|
CVE-2020-6379
google chrome, fedoraproject fedora
Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 1,2% | 11 Feb 2020 |
|
CVE-2014-8347
claris filemaker pro, claris filemaker pro advanced
An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which could let a...
|
7.8 High | — | 1,4% | 11 Feb 2020 |
|
CVE-2019-18210
moodle
Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g.,...
|
5.4 Medium | — | 0,79% | 11 Feb 2020 |
|
CVE-2018-14553
libgd, fedoraproject fedora +3 lainnya
gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Onl...
|
7.5 High | — | 3,4% | 11 Feb 2020 |
|
CVE-2020-7217
opensuse wicked
An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets with...
|
7.5 High | — | 1,6% | 11 Feb 2020 |
|
CVE-2020-8596
xnau participants database
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, li...
|
7.5 High | — | 1,6% | 11 Feb 2020 |
|
CVE-2020-3934
secom dr.id access control, secom dr.id attendance system
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject...
|
9.8 Critical | — | 1,4% | 11 Feb 2020 |
|
CVE-2020-3935
secom dr.id access control, secom dr.id attendance system
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to...
|
7.5 High | — | 0,93% | 11 Feb 2020 |
|
CVE-2020-5529
htmlunit, debian linux +2 lainnya
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Jav...
|
8.1 High | — | 4,7% | 11 Feb 2020 |
|
CVE-2020-3933
secom dr.id access control, secom dr.id attendance system
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system.
|
5.3 Medium | — | 1,2% | 11 Feb 2020 |
|
CVE-2019-14514
microvirt memu
An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary tha...
|
9.8 Critical | — | 7,0% | 11 Feb 2020 |
|
CVE-2016-5710
netapp snap creator framework
NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
|
4.6 Medium | — | 0,71% | 11 Feb 2020 |
|
CVE-2013-4267
pydio
Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/...
|
9.8 Critical | — | 4,1% | 11 Feb 2020 |
|
CVE-2013-5945
dlink dsr-150 firmware, dlink dsr-150n firmware +6 lainnya
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1....
|
9.8 Critical | — | 9,8% | 11 Feb 2020 |
|
CVE-2020-8840
fasterxml jackson-databind, debian linux +6 lainnya
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
|
9.8 Critical | — | 26,6% | 10 Feb 2020 |
|
CVE-2020-8841
testlink
An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection.
|
8.8 High | — | 1,4% | 10 Feb 2020 |
|
CVE-2019-6744
samsung knox
This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G9600ZHS3ARL1 S...
|
4.3 Medium | — | 0,36% | 10 Feb 2020 |
|
CVE-2019-19193
ti ble-stack, ti cc2640r2 software development kit
The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5.0 before Q4 2019 for CC2640R2...
|
6.5 Medium | — | 0,70% | 10 Feb 2020 |
|
CVE-2019-19195
microchip atmsamb11 blusdk smart
The Bluetooth Low Energy implementation on Microchip Technology BluSDK Smart through 6.2 for ATSAMB11 devices does not properly restrict link-layer data length on recepti...
|
6.5 Medium | — | 0,70% | 10 Feb 2020 |
|
CVE-2019-17517
dialog-semiconductor software development kit
The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length, allowing...
|
5.7 Medium | — | 0,63% | 10 Feb 2020 |
|
CVE-2019-17518
dialog-semiconductor software development kit
The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets with a payload length larger th...
|
6.5 Medium | — | 0,76% | 10 Feb 2020 |
|
CVE-2019-17520
ti cc2640r2 software development kit
The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception,...
|
6.5 Medium | — | 1,8% | 10 Feb 2020 |
|
CVE-2019-17137
netgear ac1200 r6220 firmware
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Route...
|
9.4 Critical | — | 2,7% | 10 Feb 2020 |
|
CVE-2019-17060
nxp mcuxpresso software development kit
The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly re...
|
6.5 Medium | — | 0,82% | 10 Feb 2020 |
|
CVE-2019-17061
cypress psoc 4 ble
The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memor...
|
6.5 Medium | — | 0,88% | 10 Feb 2020 |
|
CVE-2019-13322
mi browser
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploi...
|
8.8 High | — | 2,6% | 10 Feb 2020 |
|
CVE-2019-13321
mi browser
This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is required t...
|
8.0 High | — | 1,2% | 10 Feb 2020 |
|
CVE-2017-18642
syska smartlight rainbow led smart bulb firmware
Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replay attacks...
|
6.5 Medium | — | 0,55% | 10 Feb 2020 |
|
CVE-2019-19668
maxum rumpus ftp
A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on...
|
4.3 Medium | — | 0,38% | 10 Feb 2020 |
|
CVE-2019-19667
maxum rumpus ftp
A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via...
|
5.4 Medium | — | 0,37% | 10 Feb 2020 |
|
CVE-2019-19669
maxum rumpus ftp
A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the...
|
6.5 Medium | — | 0,43% | 10 Feb 2020 |
|
CVE-2019-19670
maxum rumpus ftp
A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can result in...
|
6.1 Medium | — | 0,72% | 10 Feb 2020 |
|
CVE-2019-19661
maxum rumpus ftp
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
|
6.1 Medium | — | 0,77% | 10 Feb 2020 |
|
CVE-2019-19666
maxum rumpus ftp
A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/EventNoticesSet....
|
4.3 Medium | — | 0,38% | 10 Feb 2020 |
|
CVE-2019-19662
maxum rumpus ftp
A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Dele...
|
6.5 Medium | — | 0,43% | 10 Feb 2020 |
|
CVE-2019-19664
maxum rumpus ftp
A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web set...
|
7.1 High | — | 0,37% | 10 Feb 2020 |
|
CVE-2013-2108
undolog cleanfix
WordPress WP Cleanfix Plugin 2.4.4 has CSRF
|
5.4 Medium | — | 2,2% | 10 Feb 2020 |
|
CVE-2013-2109
undolog wp cleanfix
WordPress plugin wp-cleanfix has Remote Code Execution
|
8.8 High | — | 2,0% | 10 Feb 2020 |
|
CVE-2019-19660
maxum rumpus
A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP se...
|
6.5 Medium | — | 0,43% | 10 Feb 2020 |
|
CVE-2019-19663
maxum rumpus
A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after exploiting it at...
|
6.5 Medium | — | 0,43% | 10 Feb 2020 |