Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-8422
zohocorp manageengine remote access plus
An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract th...
|
4.3 Medium | — | 1,4% | 31 Jan 2020 |
|
CVE-2013-5113
logmein lastpass
LastPass prior to 2.5.1 has an insecure PIN implementation.
|
6.8 Medium | — | 0,59% | 31 Jan 2020 |
|
CVE-2013-5114
logmein lastpass
LastPass prior to 2.5.1 allows secure wipe bypass.
|
6.1 Medium | — | 0,59% | 31 Jan 2020 |
|
CVE-2013-5116
evernote
Evernote prior to 5.5.1 has insecure password change
|
7.1 High | — | 0,48% | 31 Jan 2020 |
|
CVE-2020-8440
simplejobscript
controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume.
|
9.8 Critical | — | 2,8% | 31 Jan 2020 |
|
CVE-2013-5112
evernote
Evernote before 5.5.1 has insecure PIN storage
|
4.6 Medium | — | 0,55% | 31 Jan 2020 |
|
CVE-2019-19550
senior rubiweb
Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attac...
|
7.5 High | — | 1,9% | 31 Jan 2020 |
|
CVE-2013-3322
netapp oncommand system manager
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface.
|
7.2 High | — | 3,5% | 31 Jan 2020 |
|
CVE-2020-7218
hashicorp nomad
HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in...
|
7.5 High | — | 1,5% | 31 Jan 2020 |
|
CVE-2020-7219
hashicorp consul
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in...
|
7.5 High | — | 2,0% | 31 Jan 2020 |
|
CVE-2020-7914
jetbrains intellij idea
In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3.
|
7.5 High | — | 1,9% | 31 Jan 2020 |
|
CVE-2020-7955
hashicorp consul
HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosu...
|
5.3 Medium | — | 1,4% | 31 Jan 2020 |
|
CVE-2020-7956
hashicorp nomad
HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege...
|
9.8 Critical | — | 0,98% | 31 Jan 2020 |
|
CVE-2020-5526
fujixerox apeosware management suite
The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spo...
|
5.9 Medium | — | 0,50% | 31 Jan 2020 |
|
CVE-2019-18913
hp elitedesk 800 g5 dm firmware, hp elitedesk 800 g5 sff firmware +31 lainnya
A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically acce...
|
6.8 Medium | — | 0,61% | 31 Jan 2020 |
|
CVE-2020-5232
ens.domains ethereum name service
A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consent or awaren...
|
8.7 High | — | 1,2% | 31 Jan 2020 |
|
CVE-2020-8498
gistpress project gistpress
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker wi...
|
5.4 Medium | — | 1,2% | 30 Jan 2020 |
|
CVE-2019-10782
checkstyle
All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.
|
5.3 Medium | — | 1,5% | 30 Jan 2020 |
|
CVE-2020-8493
kronos web time and attendance
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Mess...
|
4.8 Medium | — | 1,5% | 30 Jan 2020 |
|
CVE-2020-8494
kronos web time and attendance
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master T...
|
8.8 High | — | 1,1% | 30 Jan 2020 |
|
CVE-2020-8495
kronos web time and attendance
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Superv...
|
7.5 High | — | 3,1% | 30 Jan 2020 |
|
CVE-2020-8496
kronos web time and attendance
In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of th...
|
4.8 Medium | — | 0,55% | 30 Jan 2020 |
|
CVE-2020-5206
apereo opencast
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remembe...
|
10.0 Critical | — | 1,3% | 30 Jan 2020 |
|
CVE-2020-5231
apereo opencast
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_A...
|
6.5 Medium | — | 0,63% | 30 Jan 2020 |
|
CVE-2020-5230
apereo opencast
Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such...
|
7.5 High | — | 1,2% | 30 Jan 2020 |
|
CVE-2020-8095
bitdefender total security 2020
A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of service on the af...
|
5.5 Medium | — | 0,47% | 30 Jan 2020 |
|
CVE-2020-5222
apereo opencast
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker ge...
|
8.8 High | — | 0,94% | 30 Jan 2020 |
|
CVE-2019-20358
trendmicro anti-threat toolkit
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, pote...
|
7.8 High | — | 4,6% | 30 Jan 2020 |
|
CVE-2013-2198
login security project login security
The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username.
|
9.8 Critical | — | 1,7% | 30 Jan 2020 |
|
CVE-2013-2294
viewgit project viewgit
Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag name to the...
|
6.1 Medium | — | 4,0% | 30 Jan 2020 |
|
CVE-2013-4187
flippy project flippy
The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with the permission to access cont...
|
6.5 Medium | — | 1,5% | 30 Jan 2020 |
|
CVE-2013-4241
hitmyserver hms testimonials
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HT...
|
6.1 Medium | — | 3,7% | 30 Jan 2020 |
|
CVE-2015-0949
dell latitude e6430 firmware, hp elitebook 850 g1 firmware
The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implem...
|
7.8 High | — | 0,39% | 30 Jan 2020 |
|
CVE-2015-8851
node-uuid project node-uuid
node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
|
7.5 High | — | 2,3% | 30 Jan 2020 |
|
CVE-2012-6133
roundup-tracker roundup
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2)...
|
6.1 Medium | — | 1,6% | 30 Jan 2020 |
|
CVE-2014-3719
exlibrisgroup aleph 500
Multiple SQL injection vulnerabilities in cgi-bin/review_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to execute...
|
9.8 Critical | — | 2,0% | 30 Jan 2020 |
|
CVE-2020-5228
apereo opencast
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated b...
|
7.5 High | — | 0,98% | 30 Jan 2020 |
|
CVE-2020-5229
apereo opencast
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username in...
|
8.1 High | — | 0,63% | 30 Jan 2020 |
|
CVE-2014-3718
exlibrisgroup aleph 500
Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers...
|
6.1 Medium | — | 0,97% | 30 Jan 2020 |
|
CVE-2020-8492
python, opensuse leap +3 lainnya
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of S...
|
6.5 Medium | — | 6,6% | 30 Jan 2020 |
|
CVE-2020-8093
bitdefender antivirus
A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable to cause thi...
|
7.8 High | — | 0,42% | 30 Jan 2020 |
|
CVE-2020-3147
cisco sg200-50 firmware, cisco sg200-50p firmware +55 lainnya
A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected...
|
7.5 High | — | 2,3% | 30 Jan 2020 |
|
CVE-2020-5233
oauth2 proxy project oauth2 proxy
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.
|
6.1 Medium | — | 1,3% | 30 Jan 2020 |
|
CVE-2020-7910
jetbrains teamcity
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
|
5.4 Medium | — | 0,52% | 30 Jan 2020 |
|
CVE-2020-7911
jetbrains teamcity
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
|
6.1 Medium | — | 0,65% | 30 Jan 2020 |
|
CVE-2020-7912
jetbrains youtrack
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
|
5.3 Medium | — | 1,5% | 30 Jan 2020 |
|
CVE-2020-7913
jetbrains youtrack
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
|
6.1 Medium | — | 1,1% | 30 Jan 2020 |
|
CVE-2020-8092
bitdefender antivirus
A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted...
|
5.5 Medium | — | 0,26% | 30 Jan 2020 |
|
CVE-2020-7904
jetbrains intellij idea
In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.
|
7.4 High | — | 1,4% | 30 Jan 2020 |
|
CVE-2020-7905
jetbrains intellij idea
Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.
|
7.5 High | — | 1,2% | 30 Jan 2020 |