Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-10786
network-manager project network-manager
network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.
|
9.8 Critical | — | 2,1% | 4 Feb 2020 |
|
CVE-2019-10787
dnt im-resize
im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user wi...
|
9.8 Critical | — | 3,8% | 4 Feb 2020 |
|
CVE-2019-10788
dnt im-metadata
im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metada...
|
9.8 Critical | — | 2,4% | 4 Feb 2020 |
|
CVE-2019-12528
squid-cache squid, fedoraproject fedora +3 lainnya
An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associat...
|
7.5 High | — | 10,5% | 4 Feb 2020 |
|
CVE-2015-2802
hp asset manager, hp asset manager cloudsystem chargeback +1 lainnya
An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.32, 9.40 through 9.41, 9.50, a...
|
7.5 High | — | 6,4% | 4 Feb 2020 |
|
CVE-2020-8449
squid-cache squid, debian linux +3 lainnya
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources proh...
|
7.5 High | — | 8,3% | 4 Feb 2020 |
|
CVE-2020-8450
squid-cache squid, canonical ubuntu linux +3 lainnya
An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse prox...
|
7.3 High | — | 71,8% | 4 Feb 2020 |
|
CVE-2020-8517
squid-cache squid, opensuse leap +1 lainnya
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outsid...
|
7.5 High | — | 6,8% | 4 Feb 2020 |
|
CVE-2020-8615
themeum tutor lms
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious act...
|
6.5 Medium | — | 8,8% | 4 Feb 2020 |
|
CVE-2020-8120
nextcloud server
A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.
|
6.1 Medium | — | 0,92% | 4 Feb 2020 |
|
CVE-2020-8121
nextcloud server
A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.
|
8.1 High | — | 1,0% | 4 Feb 2020 |
|
CVE-2020-8122
nextcloud server
A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.
|
4.3 Medium | — | 0,68% | 4 Feb 2020 |
|
CVE-2020-8123
strapi
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the applicat...
|
4.9 Medium | — | 1,1% | 4 Feb 2020 |
|
CVE-2020-8124
url-parse project url-parse
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
|
5.3 Medium | — | 1,7% | 4 Feb 2020 |
|
CVE-2020-8125
klona project klona
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service...
|
9.8 Critical | — | 4,1% | 4 Feb 2020 |
|
CVE-2020-8115
revive-adserver revive adserver
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no...
|
6.1 Medium | — | 7,1% | 4 Feb 2020 |
|
CVE-2020-8116
dot-prop project dot-prop
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript...
|
7.3 High | — | 3,1% | 4 Feb 2020 |
|
CVE-2020-8117
nextcloud server
Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.
|
4.3 Medium | — | 0,71% | 4 Feb 2020 |
|
CVE-2020-8118
nextcloud server, opensuse backports sle +1 lainnya
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar applica...
|
5.0 Medium | — | 1,3% | 4 Feb 2020 |
|
CVE-2020-8119
nextcloud server
Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.
|
4.3 Medium | — | 0,92% | 4 Feb 2020 |
|
CVE-2020-6060
minisnmpd project minisnmpd
A stack buffer overflow vulnerability exists in the way MiniSNMPD version 1.4 handles multiple connections. A specially timed sequence of SNMP connections can trigger a s...
|
7.5 High | — | 2,2% | 4 Feb 2020 |
|
CVE-2020-6058
minisnmpd project minisnmpd
An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trigger an out-...
|
9.1 Critical | — | 2,4% | 4 Feb 2020 |
|
CVE-2020-6059
minisnmpd project minisnmpd
An exploitable out of bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trigger an out...
|
8.2 High | — | 2,6% | 4 Feb 2020 |
|
CVE-2019-15615
nextcloud
A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.
|
6.1 Medium | — | 0,37% | 4 Feb 2020 |
|
CVE-2019-15616
nextcloud server
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
|
4.3 Medium | — | 0,77% | 4 Feb 2020 |
|
CVE-2019-15617
nextcloud server
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
|
5.4 Medium | — | 0,61% | 4 Feb 2020 |
|
CVE-2019-15618
nextcloud server
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
|
4.8 Medium | — | 0,73% | 4 Feb 2020 |
|
CVE-2019-15619
nextcloud deck, nextcloud server +1 lainnya
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when lin...
|
4.8 Medium | — | 0,84% | 4 Feb 2020 |
|
CVE-2019-15620
nextcloud talk
Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature...
|
2.7 Low | — | 0,77% | 4 Feb 2020 |
|
CVE-2019-15621
nextcloud server
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they rece...
|
6.5 Medium | — | 1,1% | 4 Feb 2020 |
|
CVE-2019-15622
nextcloud
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
|
2.4 Low | — | 0,51% | 4 Feb 2020 |
|
CVE-2019-15623
nextcloud server, opensuse backports sle +1 lainnya
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when...
|
5.3 Medium | — | 1,9% | 4 Feb 2020 |
|
CVE-2019-15624
nextcloud server, opensuse backports +1 lainnya
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.
|
4.9 Medium | — | 1,5% | 4 Feb 2020 |
|
CVE-2019-15610
nextcloud circles
Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
|
4.3 Medium | — | 0,83% | 4 Feb 2020 |
|
CVE-2019-15611
nextcloud
Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or...
|
4.9 Medium | — | 1,1% | 4 Feb 2020 |
|
CVE-2019-15612
nextcloud server
A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.
|
5.9 Medium | — | 0,32% | 4 Feb 2020 |
|
CVE-2019-15613
nextcloud server, opensuse backports
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
|
8.0 High | — | 1,1% | 4 Feb 2020 |
|
CVE-2019-15614
nextcloud
Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
|
5.4 Medium | — | 0,78% | 4 Feb 2020 |
|
CVE-2015-3611
fortinet fortimanager
A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user r...
|
8.8 High | — | 5,6% | 4 Feb 2020 |
|
CVE-2015-3612
fortinet fortimanager
A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update servic...
|
5.4 Medium | — | 0,79% | 4 Feb 2020 |
|
CVE-2015-3613
fortinet fortimanager
A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
|
9.8 Critical | — | 2,2% | 4 Feb 2020 |
|
CVE-2019-10784
phppgadmin project phppgadmin
phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does...
|
9.6 Critical | — | 3,6% | 4 Feb 2020 |
|
CVE-2019-4675
ibm security identity manager
IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound c...
|
9.8 Critical | — | 1,3% | 4 Feb 2020 |
|
CVE-2020-4163
ibm websphere application server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which w...
|
7.2 High | — | 1,6% | 4 Feb 2020 |
|
CVE-2020-7221
mariadb
mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demo...
|
7.8 High | — | 0,67% | 4 Feb 2020 |
|
CVE-2019-4451
ibm security identity manager
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering...
|
5.4 Medium | — | 0,56% | 4 Feb 2020 |
|
CVE-2019-4540
ibm security directory server
IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force I...
|
7.5 High | — | 0,79% | 4 Feb 2020 |
|
CVE-2019-4541
ibm security directory server
IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to...
|
7.2 High | — | 1,3% | 4 Feb 2020 |
|
CVE-2019-4548
ibm security directory server
IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a rem...
|
6.1 Medium | — | 0,90% | 4 Feb 2020 |
|
CVE-2019-4550
ibm security directory server
IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 165952.
|
5.3 Medium | — | 1,1% | 4 Feb 2020 |