Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-4551
ibm security directory server
IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas....
|
5.3 Medium | — | 1,3% | 4 Feb 2020 |
|
CVE-2019-4562
ibm security directory server
IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if unauthorized parties have access to the URLs via serv...
|
5.3 Medium | — | 0,98% | 4 Feb 2020 |
|
CVE-2019-4674
ibm security identity manager
IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing...
|
4.9 Medium | — | 1,9% | 4 Feb 2020 |
|
CVE-2019-19273
google android, samsung exynos 8895
On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor EL2 implementation) allows arbitrary memory write op...
|
7.8 High | — | 0,22% | 4 Feb 2020 |
|
CVE-2019-19968
pandorafms pandora fms
PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject d...
|
5.4 Medium | — | 0,80% | 4 Feb 2020 |
|
CVE-2019-9674
python, canonical ubuntu linux +1 lainnya
Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
|
7.5 High | — | 5,6% | 4 Feb 2020 |
|
CVE-2013-2676
brother mfc-9970cdw firmware
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and other sensitive...
|
7.5 High | — | 2,4% | 4 Feb 2020 |
|
CVE-2013-2678
cisco linksys e4200 firmware
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitr...
|
8.1 High | — | 16,9% | 4 Feb 2020 |
|
CVE-2013-7054
dlink dir-100 firmware
D-Link DIR-100 4.03B07: cli.cgi XSS
|
6.1 Medium | — | 3,5% | 4 Feb 2020 |
|
CVE-2013-7055
dlink dir-100 firmware
D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
|
9.8 Critical | — | 7,0% | 4 Feb 2020 |
|
CVE-2013-7051
dlink dir-100 firmware
D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
|
8.8 High | — | 15,6% | 4 Feb 2020 |
|
CVE-2013-7052
dlink dir-100 firmware
D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
|
9.8 Critical | — | 24,7% | 4 Feb 2020 |
|
CVE-2013-7053
dlink dir-100 firmware
D-Link DIR-100 4.03B07: cli.cgi CSRF
|
8.8 High | — | 3,4% | 4 Feb 2020 |
|
CVE-2012-5618
ushahidi
Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.
|
9.8 Critical | — | 1,2% | 4 Feb 2020 |
|
CVE-2012-5686
zpanelcp zpanel
ZPanel 10.0.1 has insufficient entropy for its password reset process.
|
9.8 Critical | — | 4,8% | 4 Feb 2020 |
|
CVE-2013-1422
webcalendar project webcalendar
webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
|
5.3 Medium | — | 1,6% | 4 Feb 2020 |
|
CVE-2011-4912
joomla!
Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
|
5.3 Medium | — | 0,77% | 4 Feb 2020 |
|
CVE-2011-4937
joomla!
Joomla! 1.7.1 has core information disclosure due to inadequate error checking.
|
7.5 High | — | 1,6% | 4 Feb 2020 |
|
CVE-2011-3629
joomla!
Joomla! core 1.7.1 allows information disclosure due to weak encryption
|
7.5 High | — | 1,1% | 4 Feb 2020 |
|
CVE-2020-3939
sysjust syuan-gu-da-shin
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the vulnerabil...
|
6.1 Medium | — | 0,70% | 4 Feb 2020 |
|
CVE-2020-3937
sysjust syuan-gu-da-shin
SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database.
|
7.5 High | — | 1,4% | 4 Feb 2020 |
|
CVE-2020-3938
sysjust syuan-gu-da-shin
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system f...
|
7.5 High | — | 1,5% | 4 Feb 2020 |
|
CVE-2020-5235
nanopb project nanopb
There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC, the message to be...
|
9.8 Critical | — | 1,7% | 4 Feb 2020 |
|
CVE-2020-5236
agendaless waitress
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is recei...
|
6.5 Medium | — | 2,4% | 4 Feb 2020 |
|
CVE-2020-8597
point-to-point protocol project point-to-point protocol, wago pfc firmware +2 lainnya
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
|
9.8 Critical | — | 19,9% | 3 Feb 2020 |
|
CVE-2020-8591
eginnovations eg manager
eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request.
|
9.8 Critical | — | 1,4% | 3 Feb 2020 |
|
CVE-2020-8592
eginnovations eg manager
eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature).
|
9.8 Critical | — | 1,4% | 3 Feb 2020 |
|
CVE-2019-9501
synology router manager, broadcom bcm4339 firmware
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap buffer over...
|
8.8 High | — | 3,1% | 3 Feb 2020 |
|
CVE-2019-9502
synology router manager, broadcom bcm4339 firmware
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is tri...
|
8.8 High | — | 2,6% | 3 Feb 2020 |
|
CVE-2019-20174
auth0 lock
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
|
6.1 Medium | — | 0,72% | 3 Feb 2020 |
|
CVE-2019-18567
hp bromium
Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service.
|
6.3 Medium | — | 0,47% | 3 Feb 2020 |
|
CVE-2013-2674
brother mfc-9970cdw firmware
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from referrer logs...
|
7.5 High | — | 2,6% | 3 Feb 2020 |
|
CVE-2016-4676
apple safari, apple mac os x
A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive...
|
7.5 High | — | 2,0% | 3 Feb 2020 |
|
CVE-2013-2673
brother mfc-9970cdw firmware
Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access.
|
6.8 Medium | — | 0,51% | 3 Feb 2020 |
|
CVE-2020-8549
wpchill strong testimonials
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
|
6.1 Medium | — | 1,9% | 3 Feb 2020 |
|
CVE-2020-8548
masscode
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).
|
6.1 Medium | — | 1,4% | 3 Feb 2020 |
|
CVE-2020-5182
cmsjunkie j-businessdirectory
The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user....
|
6.5 Medium | — | 1,0% | 3 Feb 2020 |
|
CVE-2020-4224
ibm storediq
IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being encrypted when it contained symbo...
|
5.5 Medium | — | 0,19% | 3 Feb 2020 |
|
CVE-2019-4732
ibm sdk, ibm websphere application server
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to ex...
|
6.5 Medium | — | 0,54% | 3 Feb 2020 |
|
CVE-2013-2672
brother mfc-9970cdw firmware
Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.
|
7.5 High | — | 1,7% | 3 Feb 2020 |
|
CVE-2019-16893
tp-link tp-sg105e firmware
The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot.cgi request.
|
7.5 High | — | 37,8% | 3 Feb 2020 |
|
CVE-2013-2646
tp-link tl-wr1043nd firmware
TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability.
|
7.5 High | — | 1,3% | 3 Feb 2020 |
|
CVE-2020-8547
phplist
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by ex...
|
9.8 Critical | — | 5,9% | 3 Feb 2020 |
|
CVE-2020-8545
circl ail framework
Global.py in AIL framework 2.8 allows path traversal.
|
7.5 High | — | 1,3% | 3 Feb 2020 |
|
CVE-2019-11251
kubernetes
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a...
|
5.7 Medium | — | 2,6% | 3 Feb 2020 |
|
CVE-2019-19119
paessler prtg network monitor
An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, a non-administrative user on t...
|
5.5 Medium | — | 0,27% | 3 Feb 2020 |
|
CVE-2020-8510
phpabook project phpabook
An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as an...
|
9.8 Critical | — | 1,2% | 3 Feb 2020 |
|
CVE-2020-7993
prototypejs prototype
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
|
4.3 Medium | — | 0,75% | 3 Feb 2020 |
|
CVE-2013-2621
telaen project telaen
Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
|
6.1 Medium | — | 10,7% | 3 Feb 2020 |
|
CVE-2013-2622
uebimiau
Cross-site Scripting (XSS) in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selected_theme" parameter in error.php.
|
6.1 Medium | — | 0,97% | 3 Feb 2020 |