Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-7906
jetbrains rider
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019....
|
7.5 High | — | 0,67% | 30 Jan 2020 |
|
CVE-2020-7908
jetbrains teamcity
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
|
4.3 Medium | — | 0,84% | 30 Jan 2020 |
|
CVE-2020-7909
jetbrains teamcity
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
|
7.5 High | — | 1,1% | 30 Jan 2020 |
|
CVE-2020-1930
apache spamassassin
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system comm...
|
8.1 High | — | 7,1% | 30 Jan 2020 |
|
CVE-2020-1931
apache spamassassin
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands...
|
8.1 High | — | 6,5% | 30 Jan 2020 |
|
CVE-2019-17273
netapp e-series santricity os controller
E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in IPv6 environme...
|
6.5 Medium | — | 0,71% | 30 Jan 2020 |
|
CVE-2019-20050
artica pandora fms
Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "tricky" name...
|
6.8 Medium | — | 3,4% | 30 Jan 2020 |
|
CVE-2013-0739
chamilo
Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.
|
6.1 Medium | — | 0,80% | 30 Jan 2020 |
|
CVE-2013-1350
veraxsystems network management system
Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities
|
9.1 Critical | — | 1,5% | 30 Jan 2020 |
|
CVE-2013-1351
veraxsystems network management system
Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password.
|
5.9 Medium | — | 2,0% | 30 Jan 2020 |
|
CVE-2013-1352
veraxsystems network management system
Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive.
|
7.5 High | — | 1,3% | 30 Jan 2020 |
|
CVE-2013-1631
veraxsystems network management system
Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action
|
5.3 Medium | — | 1,3% | 30 Jan 2020 |
|
CVE-2013-1866
opensc project opensc
OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability
|
6.1 Medium | — | 0,42% | 30 Jan 2020 |
|
CVE-2013-1867
apple tokend
Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability
|
6.1 Medium | — | 0,39% | 30 Jan 2020 |
|
CVE-2013-0725
hexagongeospatial erdas er viewer
ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities
|
7.8 High | — | 0,45% | 30 Jan 2020 |
|
CVE-2013-0738
chamilo
Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.
|
6.1 Medium | — | 0,80% | 30 Jan 2020 |
|
CVE-2013-0291
imagely nextgen gallery
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability
|
7.5 High | — | 15,6% | 30 Jan 2020 |
|
CVE-2020-8447
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of syscheck forma...
|
9.8 Critical | — | 1,9% | 30 Jan 2020 |
|
CVE-2020-8448
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (NULL pointer dereference) via c...
|
5.5 Medium | — | 0,49% | 30 Jan 2020 |
|
CVE-2020-8442
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer overflow in the rootcheck decode...
|
8.8 High | — | 2,4% | 30 Jan 2020 |
|
CVE-2020-8443
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow during the...
|
9.8 Critical | — | 2,7% | 30 Jan 2020 |
|
CVE-2020-8444
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of ossec-alert fo...
|
9.8 Critical | — | 2,5% | 30 Jan 2020 |
|
CVE-2020-8445
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages....
|
9.8 Critical | — | 2,3% | 30 Jan 2020 |
|
CVE-2020-8446
ossec
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with write access) via crafted sysch...
|
5.5 Medium | — | 0,50% | 30 Jan 2020 |
|
CVE-2020-8438
arris ruckus zoneflex r500 firmware
Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated b...
|
7.2 High | — | 1,6% | 29 Jan 2020 |
|
CVE-2013-3316
netgear wnr1000 firmware
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg".
|
9.8 Critical | — | 4,8% | 29 Jan 2020 |
|
CVE-2013-3317
netgear wnr1000 firmware
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.
|
9.8 Critical | — | 4,8% | 29 Jan 2020 |
|
CVE-2013-3320
netapp oncommand system manager
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name'...
|
6.1 Medium | — | 2,3% | 29 Jan 2020 |
|
CVE-2013-3321
netapp oncommand system manager
NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the S...
|
7.5 High | — | 2,2% | 29 Jan 2020 |
|
CVE-2019-10783
isof project isof
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
|
9.8 Critical | — | 2,6% | 29 Jan 2020 |
|
CVE-2019-20444
netty, debian linux +4 lainnya
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might...
|
9.1 Critical | — | 8,9% | 29 Jan 2020 |
|
CVE-2019-20445
netty, debian linux +5 lainnya
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
|
9.1 Critical | — | 13,5% | 29 Jan 2020 |
|
CVE-2020-8432
denx u-boot, opensuse leap
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, al...
|
9.8 Critical | — | 3,1% | 29 Jan 2020 |
|
CVE-2020-3719
magento
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could l...
|
7.5 High | — | 3,2% | 29 Jan 2020 |
|
CVE-2020-3758
magento
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploit...
|
6.1 Medium | — | 1,8% | 29 Jan 2020 |
|
CVE-2020-3710
adobe illustrator cc
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
|
7.8 High | — | 3,6% | 29 Jan 2020 |
|
CVE-2020-3711
adobe illustrator cc
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
|
7.8 High | — | 3,5% | 29 Jan 2020 |
|
CVE-2020-3712
adobe illustrator cc
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
|
7.8 High | — | 3,5% | 29 Jan 2020 |
|
CVE-2020-3713
adobe illustrator cc
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
|
7.8 High | — | 3,6% | 29 Jan 2020 |
|
CVE-2020-3714
adobe illustrator cc
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
|
7.8 High | — | 3,6% | 29 Jan 2020 |
|
CVE-2020-3715
magento
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploit...
|
6.1 Medium | — | 1,8% | 29 Jan 2020 |
|
CVE-2020-3716
magento
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful e...
|
9.8 Critical | — | 14,0% | 29 Jan 2020 |
|
CVE-2020-3717
magento
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could l...
|
5.3 Medium | — | 3,2% | 29 Jan 2020 |
|
CVE-2020-3718
magento
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could...
|
9.8 Critical | — | 7,5% | 29 Jan 2020 |
|
CVE-2013-2572
tp-link tl-sc 3130 firmware, tp-link tl-sc 3130g firmware +2 lainnya
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials for the admin...
|
7.5 High | — | 16,4% | 29 Jan 2020 |
|
CVE-2013-2573
tp-link tl-sc 3130g firmware, tp-link tl-sc 3171g firmware +1 lainnya
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. and 4171G 1.6...
|
9.8 Critical | — | 42,2% | 29 Jan 2020 |
|
CVE-2013-2574
foscam fi8620 firmware
An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could let a malicious user o...
|
7.5 High | — | 29,6% | 29 Jan 2020 |
|
CVE-2013-3215
vtiger crm
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.
|
9.8 Critical | — | 68,8% | 29 Jan 2020 |
|
CVE-2019-18634
sudo project sudo, debian linux
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default...
|
7.8 High | — | 19,3% | 29 Jan 2020 |
|
CVE-2013-2568
zavio f3105 firmware, zavio f312a firmware
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user...
|
9.8 Critical | — | 48,5% | 29 Jan 2020 |