Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2010-5304
libvncserver project libvncserver, fedoraproject fedora
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the V...
|
7.5 High | — | 3,1% | 5 Feb 2020 |
|
CVE-2011-0220
apple bonjour
Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet.
|
5.5 Medium | — | 0,26% | 5 Feb 2020 |
|
CVE-2015-5626
yokogawa centum cs 1000 firmware, yokogawa centum cs 3000 firmware +19 lainnya
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5....
|
9.8 Critical | — | 4,2% | 5 Feb 2020 |
|
CVE-2015-5627
yokogawa centum cs 1000 firmware, yokogawa centum cs 3000 firmware +19 lainnya
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5....
|
9.8 Critical | — | 4,2% | 5 Feb 2020 |
|
CVE-2015-5628
yokogawa centum cs 1000 firmware, yokogawa centum cs 3000 firmware +19 lainnya
Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5....
|
9.8 Critical | — | 6,7% | 5 Feb 2020 |
|
CVE-2010-4662
pmwiki
PmWiki before 2.2.21 has XSS.
|
6.1 Medium | — | 0,85% | 5 Feb 2020 |
|
CVE-2010-4815
coppermine-gallery coppermine gallery
Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.
|
9.8 Critical | — | 2,3% | 5 Feb 2020 |
|
CVE-2020-3120
cisco firepower extensible operating system, cisco fxos +3 lainnya
A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, ad...
|
6.5 Medium | — | 1,6% | 5 Feb 2020 |
|
CVE-2020-3123
clamav, canonical ubuntu linux
A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker...
|
7.5 High | — | 2,6% | 5 Feb 2020 |
|
CVE-2020-3149
cisco identity services engine
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored c...
|
4.8 Medium | — | 0,62% | 5 Feb 2020 |
|
CVE-2020-3110
cisco video surveillance 8400 ip camera firmware, cisco video surveillance 8030 ip camera firmware +6 lainnya
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker t...
|
8.8 High | — | 5,7% | 5 Feb 2020 |
|
CVE-2020-3111
cisco ip conference phone 7832 firmware, cisco ip conference phone 7832 with multiplatform firmware +31 lainnya
A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root...
|
8.8 High | — | 3,1% | 5 Feb 2020 |
|
CVE-2020-3118
cisco ios xr
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or ca...
|
8.8 High | KEV | 11,7% | 5 Feb 2020 |
|
CVE-2020-3119
cisco nx-os, cisco ucs manager
A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cau...
|
8.8 High | — | 4,8% | 5 Feb 2020 |
|
CVE-2013-2675
brother mfc-9970cdw firmware
Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive informat...
|
6.5 Medium | — | 2,2% | 5 Feb 2020 |
|
CVE-2019-15253
cisco catalyst center
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored...
|
4.8 Medium | — | 3,1% | 5 Feb 2020 |
|
CVE-2015-0102
ibm workflow
IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by int...
|
8.1 High | — | 1,7% | 5 Feb 2020 |
|
CVE-2019-15126
apple ipados, apple iphone os +7 lainnya
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN de...
|
3.1 Low | — | 7,3% | 5 Feb 2020 |
|
CVE-2019-11516
google android
An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry Responses (EIRs) are improperly han...
|
8.1 High | — | 0,86% | 5 Feb 2020 |
|
CVE-2019-12180
smartbear readyapi, smartbear soapui
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed....
|
7.8 High | — | 4,8% | 5 Feb 2020 |
|
CVE-2020-6833
gitlab
An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling.
|
7.5 High | — | 1,2% | 5 Feb 2020 |
|
CVE-2020-6754
dotcms
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/R...
|
9.8 Critical | — | 94,8% | 5 Feb 2020 |
|
CVE-2020-7971
gitlab
GitLab EE 11.0 and later through 12.7.2 allows XSS.
|
6.1 Medium | — | 0,69% | 5 Feb 2020 |
|
CVE-2020-7972
gitlab
GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
|
7.5 High | — | 0,90% | 5 Feb 2020 |
|
CVE-2020-7973
gitlab
GitLab through 12.7.2 allows XSS.
|
6.1 Medium | — | 0,88% | 5 Feb 2020 |
|
CVE-2020-7974
gitlab
GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
|
5.3 Medium | — | 0,93% | 5 Feb 2020 |
|
CVE-2020-7976
gitlab
GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
|
5.3 Medium | — | 0,93% | 5 Feb 2020 |
|
CVE-2020-7977
gitlab
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
|
5.3 Medium | — | 0,75% | 5 Feb 2020 |
|
CVE-2020-7978
gitlab
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
|
7.5 High | — | 1,1% | 5 Feb 2020 |
|
CVE-2020-8506
corusent global tv
The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.
|
5.3 Medium | — | 1,1% | 5 Feb 2020 |
|
CVE-2020-8507
rogersmedia citytv video
The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.
|
7.5 High | — | 1,4% | 5 Feb 2020 |
|
CVE-2020-6969
automationdirect c-more ea9-rhi firmware, automationdirect c-more ea9-t6cl-r firmware +9 lainnya
It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panel...
|
9.8 Critical | — | 2,4% | 5 Feb 2020 |
|
CVE-2020-7966
gitlab
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
|
7.5 High | — | 1,6% | 5 Feb 2020 |
|
CVE-2020-7967
gitlab
GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
|
4.3 Medium | — | 0,66% | 5 Feb 2020 |
|
CVE-2020-7968
gitlab
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
|
7.5 High | — | 1,1% | 5 Feb 2020 |
|
CVE-2020-7969
gitlab
GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
|
7.5 High | — | 1,2% | 5 Feb 2020 |
|
CVE-2020-6174
linuxfoundation the update framework
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
|
9.8 Critical | — | 0,99% | 5 Feb 2020 |
|
CVE-2019-4613
ibm planning analytics
IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user...
|
8.8 High | — | 0,53% | 5 Feb 2020 |
|
CVE-2019-4616
ibm cloud automation manager
IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sendi...
|
3.5 Low | — | 0,31% | 5 Feb 2020 |
|
CVE-2019-4670
ibm websphere application server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. IBM X-Force...
|
6.5 Medium | — | 1,8% | 5 Feb 2020 |
|
CVE-2019-16203
broadcom fabric operating system
Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line option whe...
|
7.5 High | — | 1,4% | 5 Feb 2020 |
|
CVE-2019-16204
broadcom fabric operating system
Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the switch and...
|
7.5 High | — | 1,5% | 5 Feb 2020 |
|
CVE-2013-0507
ibm infosphere information server
IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability
|
8.1 High | — | 1,2% | 5 Feb 2020 |
|
CVE-2020-7979
gitlab
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
|
5.3 Medium | — | 0,86% | 5 Feb 2020 |
|
CVE-2020-8114
gitlab
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
|
9.8 Critical | — | 1,4% | 5 Feb 2020 |
|
CVE-2020-7216
opensuse wicked, opensuse leap
An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets without a mess...
|
7.5 High | — | 1,1% | 5 Feb 2020 |
|
CVE-2020-8631
canonical cloud-init, opensuse leap +1 lainnya
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py...
|
5.5 Medium | — | 0,43% | 5 Feb 2020 |
|
CVE-2020-8632
canonical cloud-init, opensuse leap +1 lainnya
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passw...
|
5.5 Medium | — | 0,38% | 5 Feb 2020 |
|
CVE-2020-5208
ipmitool project ipmitool, debian linux +2 lainnya
It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows...
|
8.8 High | — | 3,3% | 5 Feb 2020 |
|
CVE-2020-5237
1up oneupuploaderbundle
Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the files...
|
8.8 High | — | 3,9% | 5 Feb 2020 |