Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-19665
maxum rumpus
A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server FTP set...
|
6.5 Medium | — | 0,43% | 10 Feb 2020 |
|
CVE-2020-8089
piwigo
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
|
5.4 Medium | — | 0,55% | 10 Feb 2020 |
|
CVE-2019-19659
maxum rumpus
A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a user account...
|
8.8 High | — | 0,49% | 10 Feb 2020 |
|
CVE-2012-1994
hp systems insight manager
HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information
|
5.7 Medium | — | 0,79% | 10 Feb 2020 |
|
CVE-2012-2204
ibm infosphere guardium
InfoSphere Guardium aix_ktap module: DoS
|
5.5 Medium | — | 0,28% | 10 Feb 2020 |
|
CVE-2012-5828
blackberry playbook firmware
BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error
|
6.5 Medium | — | 2,1% | 10 Feb 2020 |
|
CVE-2020-1697
redhat keycloak, redhat single sign-on
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow...
|
5.4 Medium | — | 0,76% | 10 Feb 2020 |
|
CVE-2019-20451
samsung prismview player 11, samsung prismview system 9
The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM...
|
9.8 Critical | — | 7,7% | 10 Feb 2020 |
|
CVE-2014-5085
sphider-plus
A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbit...
|
8.8 High | — | 5,8% | 10 Feb 2020 |
|
CVE-2014-5086
sphider, sphider-plus +1 lainnya
A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious u...
|
8.8 High | — | 9,8% | 10 Feb 2020 |
|
CVE-2014-5083
sphider
A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute a...
|
8.8 High | — | 5,8% | 10 Feb 2020 |
|
CVE-2014-5084
sphiderpro sphider pro
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitrary code. CV...
|
8.8 High | — | 7,7% | 10 Feb 2020 |
|
CVE-2012-6449
cpanel, cpanel whm
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
|
5.4 Medium | — | 0,59% | 10 Feb 2020 |
|
CVE-2012-6611
polycom hdx system software
An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform 2.14.g3. It ha...
|
9.8 Critical | — | 3,1% | 10 Feb 2020 |
|
CVE-2012-6666
vbseo
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
|
6.1 Medium | — | 0,86% | 10 Feb 2020 |
|
CVE-2013-1353
orangehrm
Orange HRM 2.7.1 allows XSS via the vacancy name.
|
5.4 Medium | — | 0,59% | 10 Feb 2020 |
|
CVE-2019-20062
mfscripts yetishare
MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used).
|
9.8 Critical | — | 1,6% | 10 Feb 2020 |
|
CVE-2019-20059
mfscripts yetishare
payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. T...
|
8.8 High | — | 0,94% | 10 Feb 2020 |
|
CVE-2019-20060
mfscripts yetishare
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-d...
|
7.5 High | — | 1,4% | 10 Feb 2020 |
|
CVE-2019-20061
mfscripts yetishare
The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the use...
|
7.5 High | — | 0,90% | 10 Feb 2020 |
|
CVE-2020-8825
vanillaforums vanilla
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
|
5.4 Medium | — | 1,9% | 10 Feb 2020 |
|
CVE-2020-7059
php, tenable.sc +3 lainnya
When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data...
|
9.1 Critical | — | 7,4% | 10 Feb 2020 |
|
CVE-2020-7060
php, tenable.sc +3 lainnya
When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to suppl...
|
9.1 Critical | — | 8,9% | 10 Feb 2020 |
|
CVE-2020-8823
sockjs project sockjs
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
|
6.1 Medium | — | 1,9% | 10 Feb 2020 |
|
CVE-2020-8822
digi transport wr21 firmware, digi transport wr44 firmware
Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
|
4.8 Medium | — | 0,56% | 10 Feb 2020 |
|
CVE-2017-18641
linuxcontainers lxc
In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
|
8.1 High | — | 1,5% | 10 Feb 2020 |
|
CVE-2015-5741
golang go, redhat openstack +1 lainnya
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling atta...
|
9.8 Critical | — | 2,7% | 8 Feb 2020 |
|
CVE-2012-4512
kde, redhat enterprise linux +3 lainnya
The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted fon...
|
8.8 High | — | 11,7% | 8 Feb 2020 |
|
CVE-2012-5570
basic webmail project basic webmail
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email add...
|
4.3 Medium | — | 1,1% | 8 Feb 2020 |
|
CVE-2015-3423
netcracker resource management system
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the (1)...
|
8.8 High | — | 2,4% | 8 Feb 2020 |
|
CVE-2015-2062
huge-it slider
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL command...
|
7.2 High | — | 2,4% | 8 Feb 2020 |
|
CVE-2015-2207
netcracker resource management system
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or...
|
5.4 Medium | — | 0,94% | 8 Feb 2020 |
|
CVE-2014-8739
creative-solutions creative contact form, jquery file upload project jquery file upload
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Conta...
|
9.8 Critical | — | 91,7% | 8 Feb 2020 |
|
CVE-2012-4029
chamilo
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the ca...
|
6.1 Medium | — | 1,4% | 8 Feb 2020 |
|
CVE-2012-4381
mediawiki
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartex...
|
8.1 High | — | 4,1% | 8 Feb 2020 |
|
CVE-2014-9126
open-school
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TO...
|
6.1 Medium | — | 1,1% | 8 Feb 2020 |
|
CVE-2014-9127
open-school
Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information v...
|
6.5 Medium | — | 1,4% | 8 Feb 2020 |
|
CVE-2014-9470
fork-cms fork cms
Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject...
|
6.1 Medium | — | 1,4% | 8 Feb 2020 |
|
CVE-2015-1394
10web photo gallery
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web scrip...
|
5.4 Medium | — | 2,3% | 8 Feb 2020 |
|
CVE-2014-7863
zohocorp manageengine applications manager, zohocorp manageengine it360 +1 lainnya
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10....
|
7.5 High | — | 83,4% | 8 Feb 2020 |
|
CVE-2014-2225
ui airvision controller, ui mfi controller +1 lainnya
Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of admin...
|
8.8 High | — | 1,3% | 8 Feb 2020 |
|
CVE-2011-3642
flowplayer flash
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attacke...
|
9.6 Critical | — | 8,8% | 8 Feb 2020 |
|
CVE-2019-11482
canonical ubuntu linux, apport project apport
Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.
|
4.7 Medium | — | 0,23% | 8 Feb 2020 |
|
CVE-2019-11483
apport project apport, canonical ubuntu linux
Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged proces...
|
3.3 Low | — | 0,40% | 8 Feb 2020 |
|
CVE-2019-11484
whoopsie project whoopsie, canonical ubuntu linux
Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.
|
7.8 High | — | 0,44% | 8 Feb 2020 |
|
CVE-2019-11485
apport project apport, canonical ubuntu linux
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.
|
3.3 Low | — | 0,26% | 8 Feb 2020 |
|
CVE-2019-11481
canonical ubuntu linux, apport project apport
Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could ge...
|
7.8 High | — | 0,45% | 8 Feb 2020 |
|
CVE-2019-13334
foxitsoftware phantompdf
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit th...
|
7.8 High | — | 6,8% | 8 Feb 2020 |
|
CVE-2019-17135
foxitsoftware phantompdf
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit th...
|
7.8 High | — | 5,2% | 8 Feb 2020 |
|
CVE-2019-17136
foxitsoftware phantompdf
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit th...
|
7.8 High | — | 5,5% | 8 Feb 2020 |