Katalog CVE (hal. 5116)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.217 (Critical 35.883 · High 103.262 · KEV 1.745 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 255.751–255.800 dari 258.217 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-14057 qualcomm apq8009 firmware, qualcomm apq8017 firmware +46 lainnya Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec...	9.1 Critical	—	0,88%	7 Feb 2020
CVE-2019-14060 qualcomm apq8009 firmware, qualcomm apq8017 firmware +48 lainnya Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due to lack of check of return value...	7.8 High	—	0,20%	7 Feb 2020
CVE-2019-14063 qualcomm ipq4019 firmware, qualcomm ipq6018 firmware +18 lainnya Out of bound access due to Invalid inputs to dapm mux settings which results into kernel failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrag...	9.1 Critical	—	0,88%	7 Feb 2020
CVE-2019-14088 qualcomm apq8009 firmware, qualcomm mdm9206 firmware +7 lainnya Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdragon Auto, Snapdragon Compute,...	7.8 High	—	0,28%	7 Feb 2020
CVE-2019-14002 qualcomm apq8053 firmware, qualcomm apq8096au firmware +27 lainnya APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon Auto, Snapdragon Compute, Snapdragon Co...	7.8 High	—	0,18%	7 Feb 2020
CVE-2019-14040 qualcomm apq8009 firmware, qualcomm apq8017 firmware +35 lainnya Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown code in Snapdragon Auto, Snapdragon Comput...	7.8 High	—	0,52%	7 Feb 2020
CVE-2019-14041 qualcomm apq8009 firmware, qualcomm apq8017 firmware +41 lainnya During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating message buffer with physical address informati...	7.8 High	—	0,43%	7 Feb 2020
CVE-2019-14044 qualcomm qcs605 firmware, qualcomm sdm439 firmware +4 lainnya Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon Consumer IOT, Snapdragon Mobile in...	7.8 High	—	0,20%	7 Feb 2020
CVE-2019-14046 qualcomm qcs605 firmware, qualcomm sdm439 firmware +1 lainnya Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Co...	7.8 High	—	0,20%	7 Feb 2020
CVE-2019-14049 qualcomm apq8017 firmware, qualcomm apq8053 firmware +19 lainnya Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdragon Compute...	7.8 High	—	0,20%	7 Feb 2020
CVE-2019-14051 qualcomm mdm9206 firmware, qualcomm mdm9607 firmware Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow in Snapdragon Industrial IOT i...	7.8 High	—	0,20%	7 Feb 2020
CVE-2019-14055 qualcomm apq8009 firmware, qualcomm apq8017 firmware +36 lainnya Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Snapdragon Auto, Snapdragon Compu...	7.8 High	—	0,22%	7 Feb 2020
CVE-2019-10567 qualcomm apq8009 firmware, qualcomm apq8017 firmware +46 lainnya There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could allow unintended GPU opcodes to...	7.8 High	—	0,25%	7 Feb 2020
CVE-2019-10590 qualcomm apq8009 firmware, qualcomm apq8017 firmware +45 lainnya Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi...	9.8 Critical	—	0,91%	7 Feb 2020
CVE-2020-8645 simplejobscript An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parame...	9.8 Critical	—	1,8%	7 Feb 2020
CVE-2020-8654 eyesofnetwork An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via t...	8.8 High	—	91,7%	7 Feb 2020
CVE-2020-8655 eyesofnetwork An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary comman...	7.8 High	KEV	60,1%	7 Feb 2020
CVE-2020-8656 eyesofnetwork An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as...	9.8 Critical	—	84,6%	7 Feb 2020
CVE-2013-3564 videolan vlc media player The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue...	5.3 Medium	—	1,1%	6 Feb 2020
CVE-2013-3568 cisco linksys wrt110 firmware Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified i...	8.8 High	—	25,1%	6 Feb 2020
CVE-2013-3638 boonex dolphin SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.p...	8.8 High	—	1,4%	6 Feb 2020
CVE-2020-6760 schmid-telecom zi 620 v400 firmware Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonstrated by pi...	9.8 Critical	—	1,7%	6 Feb 2020
CVE-2013-2683 cisco linksys e4200 firmware Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private IP addresses and other sensitiv...	5.3 Medium	—	13,4%	6 Feb 2020
CVE-2013-2684 cisco linksys e4200 firmware Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.	6.1 Medium	—	3,7%	6 Feb 2020
CVE-2012-6341 netgear wgr614v9 firmware, netgear wgr614v7 firmware An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used passwords o...	6.5 Medium	—	1,3%	6 Feb 2020
CVE-2012-6306 hcview project hcview A vulnerability exists in HCView (aka Hardcoreview) 1.4 due to a write access violation with a GIF file.	9.8 Critical	—	1,3%	6 Feb 2020
CVE-2012-6307 impulseadventure jpegsnoop A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitrary code	8.8 High	—	5,6%	6 Feb 2020
CVE-2012-6309 arctic torrent project arctic torrent A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Denial of Service.	7.5 High	—	1,1%	6 Feb 2020
CVE-2012-6340 netgear wgr614v9 firmware, netgear wgr614v7 firmware An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002.	4.6 Medium	—	1,2%	6 Feb 2020
CVE-2020-8657 eyesofnetwork An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by defau...	9.8 Critical	KEV	91,9%	6 Feb 2020
CVE-2020-5317 dell emc elastic cloud storage Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or Jav...	4.8 Medium	—	0,62%	6 Feb 2020
CVE-2020-5318 dell emc isilon onefs Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain acc...	7.5 High	—	1,1%	6 Feb 2020
CVE-2020-5319 dell emc unity operating environment, dell emc unity xt operating environment +1 lainnya Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that i...	7.5 High	—	1,4%	6 Feb 2020
CVE-2012-6297 dd-wrt Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote...	8.8 High	—	1,7%	6 Feb 2020
CVE-2020-8772 revmakx infinitewp client The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an...	9.8 Critical	—	88,0%	6 Feb 2020
CVE-2020-8771 wptimecapsule wp time capsule The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first a...	9.8 Critical	—	46,5%	6 Feb 2020
CVE-2020-6767 bosch video management system viewer, bosch video management system A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Ce...	6.5 Medium	—	1,3%	6 Feb 2020
CVE-2020-7920 percona monitoring and management pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service.	7.5 High	—	2,1%	6 Feb 2020
CVE-2020-7953 opservices opmon An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to the use of the nmap -iL (aka inp...	7.5 High	—	1,2%	6 Feb 2020
CVE-2020-7954 opservices opmon An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of correct confi...	7.8 High	—	0,38%	6 Feb 2020
CVE-2020-6855 sos-berlin jobscheduler A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a way that e...	6.5 Medium	—	0,91%	6 Feb 2020
CVE-2020-6856 sos-berlin jobscheduler An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an e...	6.5 Medium	—	0,93%	6 Feb 2020
CVE-2020-8608 libslirp project libslirp, debian linux +1 lainnya In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.	5.6 Medium	—	2,5%	6 Feb 2020
CVE-2020-8636 opservices opmon An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .	9.8 Critical	—	4,0%	6 Feb 2020
CVE-2020-5720 mikrotik winbox MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vuln...	5.9 Medium	—	1,1%	6 Feb 2020
CVE-2019-19800 zohocorp manageengine applications manager Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.	5.3 Medium	—	3,9%	6 Feb 2020
CVE-2019-12426 apache ofbiz an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06	5.3 Medium	—	4,9%	6 Feb 2020
CVE-2019-10789 curling project curling All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.	9.8 Critical	—	4,9%	6 Feb 2020
CVE-2019-15711 fortinet forticlient A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecti...	7.8 High	—	0,52%	6 Feb 2020
CVE-2019-16152 fortinet forticlient A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root pr...	6.5 Medium	—	1,4%	6 Feb 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.