Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2013-2569
zavio f3105 firmware, zavio f312a firmware
A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a malicious user...
|
7.5 High | — | 31,0% | 29 Jan 2020 |
|
CVE-2013-2570
zavio f3105 firmware, zavio f312a firmware
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/p...
|
9.8 Critical | — | 26,6% | 29 Jan 2020 |
|
CVE-2020-8416
iktm bearftp
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.
|
7.5 High | — | 14,2% | 29 Jan 2020 |
|
CVE-2013-2567
zavio f3105 firmware, zavio f312a firmware
An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which lets a rem...
|
7.5 High | — | 14,6% | 29 Jan 2020 |
|
CVE-2020-2099
jenkins
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with k...
|
8.6 High | — | 1,0% | 29 Jan 2020 |
|
CVE-2020-2100
jenkins
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.
|
5.8 Medium | — | 3,4% | 29 Jan 2020 |
|
CVE-2020-2101
jenkins
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an att...
|
5.3 Medium | — | 1,4% | 29 Jan 2020 |
|
CVE-2020-2102
jenkins
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
|
5.3 Medium | — | 1,4% | 29 Jan 2020 |
|
CVE-2020-2103
jenkins
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
|
5.4 Medium | — | 7,0% | 29 Jan 2020 |
|
CVE-2020-2104
jenkins
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.
|
4.3 Medium | — | 1,1% | 29 Jan 2020 |
|
CVE-2020-2105
jenkins
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
|
5.4 Medium | — | 1,8% | 29 Jan 2020 |
|
CVE-2020-2106
jenkins code coverage api
Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitab...
|
5.4 Medium | — | 0,74% | 29 Jan 2020 |
|
CVE-2020-2107
jenkins fortify
Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with...
|
4.3 Medium | — | 0,65% | 29 Jan 2020 |
|
CVE-2020-2108
jenkins websphere deployer
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissio...
|
7.6 High | — | 0,90% | 29 Jan 2020 |
|
CVE-2020-7247
openbsd opensmtpd, debian linux +2 lainnya
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted S...
|
9.8 Critical | KEV | 99,0% | 29 Jan 2020 |
|
CVE-2019-7654
wowza streaming engine
Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwant...
|
6.5 Medium | — | 0,85% | 29 Jan 2020 |
|
CVE-2019-7655
wowza streaming engine
Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edi...
|
5.4 Medium | — | 0,95% | 29 Jan 2020 |
|
CVE-2019-7656
wowza streaming engine
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too...
|
7.8 High | — | 0,45% | 29 Jan 2020 |
|
CVE-2020-7965
webargs project webargs
flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, i...
|
8.8 High | — | 0,61% | 29 Jan 2020 |
|
CVE-2012-4383
contao
contao prior to 2.11.4 has a sql injection vulnerability
|
8.8 High | — | 0,92% | 29 Jan 2020 |
|
CVE-2012-5776
dokeos
Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.
|
5.4 Medium | — | 0,53% | 29 Jan 2020 |
|
CVE-2013-0161
havalite
Havalite CMS 1.1.7 has a stored XSS vulnerability
|
5.4 Medium | — | 0,97% | 29 Jan 2020 |
|
CVE-2019-20215
dlink dir-859 firmware
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin, b...
|
9.8 Critical | — | 75,1% | 29 Jan 2020 |
|
CVE-2019-20216
dlink dir-859 firmware
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin,...
|
9.8 Critical | — | 3,7% | 29 Jan 2020 |
|
CVE-2019-20217
dlink dir-859 firmware
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htdocs/cgibin,...
|
9.8 Critical | — | 3,6% | 29 Jan 2020 |
|
CVE-2020-8428
linux kernel
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensi...
|
7.1 High | — | 0,68% | 29 Jan 2020 |
|
CVE-2020-8424
cups easy project cups easy
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php.
|
8.8 High | — | 1,5% | 28 Jan 2020 |
|
CVE-2020-8425
cups easy (purchase & inventory) project cups easy (purchase & inventory)
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
|
6.5 Medium | — | 1,2% | 28 Jan 2020 |
|
CVE-2020-8426
elementor website builder
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authe...
|
5.4 Medium | — | 1,3% | 28 Jan 2020 |
|
CVE-2020-5227
feedgen project feedgen
Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fie...
|
7.5 High | — | 2,2% | 28 Jan 2020 |
|
CVE-2020-5215
google tensorflow
In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this...
|
7.5 High | — | 0,59% | 28 Jan 2020 |
|
CVE-2013-1602
dlink dcs-3411 firmware, dlink dcs-3430 firmware +15 lainnya
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-...
|
7.5 High | — | 15,1% | 28 Jan 2020 |
|
CVE-2013-1603
dlink dcs-3411 firmware, dlink dcs-3430 firmware +15 lainnya
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-563...
|
5.3 Medium | — | 16,1% | 28 Jan 2020 |
|
CVE-2020-8420
joomla!
An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.
|
8.8 High | — | 0,74% | 28 Jan 2020 |
|
CVE-2020-8421
joomla!
An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
|
6.1 Medium | — | 1,0% | 28 Jan 2020 |
|
CVE-2020-8417
codesnippets code snippets
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
|
8.8 High | — | 11,9% | 28 Jan 2020 |
|
CVE-2020-8419
joomla!
An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.
|
8.8 High | — | 0,45% | 28 Jan 2020 |
|
CVE-2013-1600
dlink dcs-2102 firmware, dlink dcs-2121 firmware
An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-2121 1.06_...
|
5.3 Medium | — | 18,5% | 28 Jan 2020 |
|
CVE-2013-1601
dlink dcs-3411 firmware, dlink dcs-3430 firmware +15 lainnya
An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video stream in D-LINK An Information Dis...
|
5.3 Medium | — | 12,4% | 28 Jan 2020 |
|
CVE-2013-3071
netgear wndr4700 firmware
NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass.
|
9.8 Critical | — | 2,2% | 28 Jan 2020 |
|
CVE-2013-3074
netgear wndr4700 firmware
NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash).
|
7.5 High | — | 1,7% | 28 Jan 2020 |
|
CVE-2013-3093
asus rt-n56u firmware, asus rt-n10u firmware +5 lainnya
ASUS RT-N56U devices allow CSRF.
|
8.8 High | — | 0,74% | 28 Jan 2020 |
|
CVE-2013-3212
vtiger crm
vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code.
|
8.1 High | — | 7,5% | 28 Jan 2020 |
|
CVE-2013-3214
vtiger crm
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
|
9.8 Critical | — | 84,5% | 28 Jan 2020 |
|
CVE-2015-5483
private only project private only
Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administr...
|
8.8 High | — | 1,6% | 28 Jan 2020 |
|
CVE-2014-8490
tennisconnect components
Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML via the pid parameter to index.c...
|
6.1 Medium | — | 0,80% | 28 Jan 2020 |
|
CVE-2013-1599
dlink dcs-3411 firmware, dlink dcs-3430 firmware +15 lainnya
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.0...
|
9.8 Critical | — | 40,4% | 28 Jan 2020 |
|
CVE-2013-2714
podpress project podpress
Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.
|
6.1 Medium | — | 2,7% | 28 Jan 2020 |
|
CVE-2013-2748
belkin wemo switch firmware
Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.
|
9.8 Critical | — | 13,1% | 28 Jan 2020 |
|
CVE-2013-2764
united-security-providers secure entry server
Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct phishing attacks due to HSP_AbsoluteRedirects bein...
|
6.1 Medium | — | 0,92% | 28 Jan 2020 |