Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2013-2623
telaen project telaen
Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter in index.php.
|
6.1 Medium | — | 2,8% | 3 Feb 2020 |
|
CVE-2013-2624
telaen project telaen
Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through a specially crafted URL reque...
|
5.3 Medium | — | 6,5% | 3 Feb 2020 |
|
CVE-2013-2631
tinywebgallery
TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters...
|
5.3 Medium | — | 1,8% | 3 Feb 2020 |
|
CVE-2019-18193
unisys stealth
In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4...
|
7.5 High | — | 0,28% | 3 Feb 2020 |
|
CVE-2014-8328
dynamic content elements project dynamic content elements
The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment inf...
|
5.3 Medium | — | 1,6% | 3 Feb 2020 |
|
CVE-2020-7471
djangoproject django
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications...
|
9.8 Critical | — | 65,6% | 3 Feb 2020 |
|
CVE-2020-3925
changingtec servisign
A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able t...
|
8.8 High | — | 2,8% | 3 Feb 2020 |
|
CVE-2020-3926
changingtec servisign
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on t...
|
7.5 High | — | 1,5% | 3 Feb 2020 |
|
CVE-2020-3927
changingtec servisign
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on t...
|
7.5 High | — | 1,2% | 3 Feb 2020 |
|
CVE-2020-8508
norman malware cleaner
nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mish...
|
9.8 Critical | — | 1,7% | 3 Feb 2020 |
|
CVE-2020-8514
maxum rumpus
An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invokin...
|
6.1 Medium | — | 0,81% | 2 Feb 2020 |
|
CVE-2019-20446
gnome librsvg, opensuse leap +4 lainnya
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker cons...
|
6.5 Medium | — | 2,1% | 2 Feb 2020 |
|
CVE-2020-8516
torproject tor
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easi...
|
5.3 Medium | — | 2,5% | 2 Feb 2020 |
|
CVE-2020-8515
draytek vigor2960 firmware, draytek vigor300b firmware +1 lainnya
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentica...
|
9.8 Critical | KEV | 100,0% | 1 Feb 2020 |
|
CVE-2020-8512
icewarp server
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
|
6.1 Medium | — | 14,8% | 1 Feb 2020 |
|
CVE-2014-2025
unitedplanet intrexx
Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Up...
|
9.8 Critical | — | 4,0% | 31 Jan 2020 |
|
CVE-2014-8141
unzip project unzip, redhat enterprise linux desktop +4 lainnya
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the...
|
7.8 High | — | 7,4% | 31 Jan 2020 |
|
CVE-2020-8504
arox school management software php/mysql
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
|
6.5 Medium | — | 1,1% | 31 Jan 2020 |
|
CVE-2020-8505
arox school management software php/mysql
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
|
6.5 Medium | — | 1,1% | 31 Jan 2020 |
|
CVE-2014-8322
aircrack-ng
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted lengt...
|
9.8 Critical | — | 23,9% | 31 Jan 2020 |
|
CVE-2014-8338
videowhisper webcam
Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote at...
|
6.1 Medium | — | 1,3% | 31 Jan 2020 |
|
CVE-2015-6815
qemu, fedoraproject fedora +9 lainnya
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attac...
|
3.5 Low | — | 0,98% | 31 Jan 2020 |
|
CVE-2014-3809
nokia 1830 photonic service switch-4 firmware, nokia 1830 photonic service switch-16 firmware +1 lainnya
Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attackers to injec...
|
6.1 Medium | — | 0,91% | 31 Jan 2020 |
|
CVE-2014-3868
zeuscart
Multiple SQL injection vulnerabilities in ZeusCart 4.x.
|
8.8 High | — | 2,5% | 31 Jan 2020 |
|
CVE-2014-5039
eucalyptus management console
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unsp...
|
9.6 Critical | — | 1,2% | 31 Jan 2020 |
|
CVE-2014-5236
open-xchange appsuite
Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers...
|
7.5 High | — | 3,8% | 31 Jan 2020 |
|
CVE-2014-8126
wisc htcondor
The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.
|
8.8 High | — | 3,1% | 31 Jan 2020 |
|
CVE-2014-8139
unzip project unzip, redhat enterprise linux desktop +5 lainnya
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t...
|
7.8 High | — | 7,4% | 31 Jan 2020 |
|
CVE-2014-8140
unzip project unzip, redhat enterprise linux desktop +5 lainnya
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the...
|
7.8 High | — | 7,4% | 31 Jan 2020 |
|
CVE-2014-8321
aircrack-ng
Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges vi...
|
7.8 High | — | 0,81% | 31 Jan 2020 |
|
CVE-2013-3565
videolan vlc media player, opensuse
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script...
|
6.1 Medium | — | 1,6% | 31 Jan 2020 |
|
CVE-2014-3119
web2project
Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string paramet...
|
8.8 High | — | 1,7% | 31 Jan 2020 |
|
CVE-2019-3016
linux kernel
In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is l...
|
4.7 Medium | — | 0,62% | 31 Jan 2020 |
|
CVE-2020-8503
biscom secure file transfer
Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated sender becaus...
|
6.5 Medium | — | 0,73% | 31 Jan 2020 |
|
CVE-2016-2031
arubanetworks airwave, arubanetworks aruba instant +2 lainnya
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters,...
|
9.8 Critical | — | 5,1% | 31 Jan 2020 |
|
CVE-2016-2032
arubanetworks airwave, arubanetworks aruba instant +1 lainnya
A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ, which coul...
|
7.5 High | — | 2,7% | 31 Jan 2020 |
|
CVE-2019-12998
elementsproject c-lightning
c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "It can be used for testing, but it should...
|
7.5 High | — | 1,8% | 31 Jan 2020 |
|
CVE-2019-12999
lightning network daemon
Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
|
7.5 High | — | 2,2% | 31 Jan 2020 |
|
CVE-2019-13000
acinq eclair
Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "it is beta-quality software and don't put too mu...
|
7.5 High | — | 2,2% | 31 Jan 2020 |
|
CVE-2013-3488
mpc-hc
Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858 allows remote attackers to execute arbitrary code via a crafted MPEG-2 Transp...
|
7.8 High | — | 2,5% | 31 Jan 2020 |
|
CVE-2013-3489
mpc-hc
Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary code via a crafted RealMedia .rm file
|
7.8 High | — | 2,5% | 31 Jan 2020 |
|
CVE-2011-4115
cpan parallel
Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.
|
7.5 High | — | 1,7% | 31 Jan 2020 |
|
CVE-2011-4116
cpan file
_is_safe in the File::Temp module for Perl does not properly handle symlinks.
|
3.3 Low | — | 0,52% | 31 Jan 2020 |
|
CVE-2011-4117
cpan batch
The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.
|
7.5 High | — | 1,3% | 31 Jan 2020 |
|
CVE-2014-2843
infoware mapsuite
Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or...
|
6.1 Medium | — | 1,0% | 31 Jan 2020 |
|
CVE-2020-5234
messagepack
MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. R...
|
6.5 Medium | — | 1,6% | 31 Jan 2020 |
|
CVE-2011-4088
redhat automatic bug reporting tool, fedoraproject fedora +3 lainnya
ABRT might allow attackers to obtain sensitive information from crash reports.
|
7.5 High | — | 1,6% | 31 Jan 2020 |
|
CVE-2019-4720
ibm websphere application server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could explo...
|
7.5 High | — | 1,8% | 31 Jan 2020 |
|
CVE-2014-4859
tianocore edk2
Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to...
|
6.8 Medium | — | 0,59% | 31 Jan 2020 |
|
CVE-2014-4860
tianocore edk2
Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate atta...
|
6.8 Medium | — | 0,50% | 31 Jan 2020 |