Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-13333
foxitsoftware phantompdf
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit th...
|
7.8 High | — | 6,8% | 8 Feb 2020 |
|
CVE-2019-19356
netis-systems wf2419 firmware
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware versi...
|
7.5 High | KEV | 28,2% | 7 Feb 2020 |
|
CVE-2020-8808
corsair icue
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to r...
|
7.8 High | — | 0,58% | 7 Feb 2020 |
|
CVE-2020-8811
bludit
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.
|
4.3 Medium | — | 0,55% | 7 Feb 2020 |
|
CVE-2020-8812
bludit
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug.
|
5.4 Medium | — | 0,61% | 7 Feb 2020 |
|
CVE-2019-13163
fujitsu gp7000f firmware, fujitsu primepower firmware +20 lainnya
The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Se...
|
5.9 Medium | — | 0,60% | 7 Feb 2020 |
|
CVE-2011-1086
openfiler
Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter.
|
6.1 Medium | — | 1,7% | 7 Feb 2020 |
|
CVE-2020-1700
ceph, redhat openshift container storage +2 lainnya
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attem...
|
6.5 Medium | — | 2,4% | 7 Feb 2020 |
|
CVE-2020-1708
redhat openshift container platform
It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the permissions o...
|
7.0 High | — | 0,28% | 7 Feb 2020 |
|
CVE-2020-6768
bosch video management system viewer, bosch video management system
A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the C...
|
7.5 High | — | 1,7% | 7 Feb 2020 |
|
CVE-2020-6770
bosch video management system mobile video service, bosch divar ip 3000 firmware +1 lainnya
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affe...
|
9.8 Critical | — | 3,6% | 7 Feb 2020 |
|
CVE-2011-1084
smoothwall express
A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.
|
6.1 Medium | — | 0,65% | 7 Feb 2020 |
|
CVE-2011-1085
smoothwall express
CSRF vulnerability in Smoothwall Express 3.
|
8.8 High | — | 0,46% | 7 Feb 2020 |
|
CVE-2020-6769
bosch video streaming gateway, bosch divar ip 2000 firmware +1 lainnya
Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary configurat...
|
9.1 Critical | — | 2,2% | 7 Feb 2020 |
|
CVE-2020-8796
biscom secure file transfer
Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.
|
9.8 Critical | — | 2,9% | 7 Feb 2020 |
|
CVE-2013-3096
dlink dir865l firmware
D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability.
|
5.9 Medium | — | 1,3% | 7 Feb 2020 |
|
CVE-2013-3067
linksys wrt310n firmware
Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.
|
5.4 Medium | — | 0,76% | 7 Feb 2020 |
|
CVE-2013-3091
belkin n300 firmware
An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging."
|
9.8 Critical | — | 3,7% | 7 Feb 2020 |
|
CVE-2014-5087
sphider, sphider-plus +1 lainnya
A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote malicious user execute arbitrary code.
|
9.8 Critical | — | 7,2% | 7 Feb 2020 |
|
CVE-2014-5091
status2k
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary P...
|
9.8 Critical | — | 15,2% | 7 Feb 2020 |
|
CVE-2014-5278
docker
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.
|
5.3 Medium | — | 1,5% | 7 Feb 2020 |
|
CVE-2014-5468
getrailo railo
A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let...
|
8.8 High | — | 52,6% | 7 Feb 2020 |
|
CVE-2014-5288
kemptechnologies load master
A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.
|
8.8 High | — | 1,6% | 7 Feb 2020 |
|
CVE-2020-1768
otrs
The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will not be reac...
|
5.4 Medium | — | 0,75% | 7 Feb 2020 |
|
CVE-2019-18988
teamviewer
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared...
|
7.0 High | KEV | 4,7% | 7 Feb 2020 |
|
CVE-2010-4658
statusnet
statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.
|
5.3 Medium | — | 0,85% | 7 Feb 2020 |
|
CVE-2014-6413
watchguard fireware xtm
A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script.
|
6.1 Medium | — | 1,2% | 7 Feb 2020 |
|
CVE-2014-7224
google android
A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and accessibilityTraversal objects, whi...
|
8.8 High | — | 2,0% | 7 Feb 2020 |
|
CVE-2014-9530
nwjs nw
A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact.
|
9.8 Critical | — | 1,2% | 7 Feb 2020 |
|
CVE-2019-15604
nodejs node.js, debian linux +8 lainnya
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
|
7.5 High | — | 20,0% | 7 Feb 2020 |
|
CVE-2019-15605
nodejs node.js, debian linux +11 lainnya
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
|
9.8 Critical | — | 57,1% | 7 Feb 2020 |
|
CVE-2019-15606
nodejs node.js, oracle communications cloud native core network function cloud native environment +5 lainnya
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
|
9.8 Critical | — | 20,0% | 7 Feb 2020 |
|
CVE-2019-16155
fortinet forticlient
A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content...
|
7.1 High | — | 0,44% | 7 Feb 2020 |
|
CVE-2020-8126
ui edgeswitch
A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allowing an oper...
|
7.8 High | — | 0,52% | 7 Feb 2020 |
|
CVE-2013-3591
vtiger crm
vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability
|
8.8 High | — | 43,1% | 7 Feb 2020 |
|
CVE-2013-3628
zabbix
Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability
|
8.8 High | — | 67,5% | 7 Feb 2020 |
|
CVE-2013-3629
ispconfig
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
|
8.8 High | — | 43,1% | 7 Feb 2020 |
|
CVE-2013-3635
projectpier
ProjectPier 0.8.8 has stored XSS
|
5.4 Medium | — | 0,59% | 7 Feb 2020 |
|
CVE-2013-3636
projectpier
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
|
5.4 Medium | — | 1,0% | 7 Feb 2020 |
|
CVE-2013-3637
projectpier
ProjectPier 0.8.8 does not use the Secure flag for cookies
|
5.4 Medium | — | 0,59% | 7 Feb 2020 |
|
CVE-2013-4335
openpne opopensocialplugin
opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities
|
9.8 Critical | — | 2,5% | 7 Feb 2020 |
|
CVE-2013-1202
cisco ace application control engine module a2
Cisco ACE A2(3.6) allows log retention DoS.
|
7.5 High | — | 1,0% | 7 Feb 2020 |
|
CVE-2013-2008
automattic wp super cache
WordPress Super Cache Plugin 1.3 has XSS.
|
6.1 Medium | — | 1,5% | 7 Feb 2020 |
|
CVE-2013-2009
automattic wp super cache
WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution
|
8.8 High | — | 13,0% | 7 Feb 2020 |
|
CVE-2013-4334
tejimaya opwebapiplugin
opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities
|
9.8 Critical | — | 1,4% | 7 Feb 2020 |
|
CVE-2019-17268
omniauth-weibo-oauth2 project omniauth-weibo-oauth2
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0....
|
9.8 Critical | — | 2,4% | 7 Feb 2020 |
|
CVE-2020-8788
synaptivemedical clearcanvas
Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply...
|
6.1 Medium | — | 0,81% | 7 Feb 2020 |
|
CVE-2012-1566
linuxmint
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny.
|
7.5 High | — | 0,88% | 7 Feb 2020 |
|
CVE-2012-1567
linuxmint
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.
|
7.5 High | — | 1,0% | 7 Feb 2020 |
|
CVE-2013-0192
simplemachines simple machines forum
File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.
|
4.9 Medium | — | 3,8% | 7 Feb 2020 |