Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-18222
arm mbed crypto, arm mbed tls +2 lainnya
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which al...
|
4.7 Medium | — | 0,34% | 23 Jan 2020 |
|
CVE-2007-6758
sencha ext js
Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.
|
7.5 High | — | 1,3% | 23 Jan 2020 |
|
CVE-2019-3691
opensuse munge
A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privi...
|
7.8 High | — | 0,52% | 23 Jan 2020 |
|
CVE-2020-6843
zohocorp manageengine servicedesk plus
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
|
4.8 Medium | — | 2,4% | 23 Jan 2020 |
|
CVE-2020-7931
jfrog artifactory
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are avai...
|
8.8 High | — | 5,5% | 23 Jan 2020 |
|
CVE-2019-17201
fasttracksoftware admin by request
FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a u...
|
7.8 High | — | 0,31% | 23 Jan 2020 |
|
CVE-2019-17202
fasttracksoftware admin by request
FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a use...
|
7.8 High | — | 0,26% | 23 Jan 2020 |
|
CVE-2019-18899
apt-cacher-ng project apt-cacher-ng, opensuse backports
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influen...
|
5.5 Medium | — | 0,26% | 23 Jan 2020 |
|
CVE-2019-19838
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends t...
|
9.8 Critical | — | 24,4% | 23 Jan 2020 |
|
CVE-2019-19839
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to adm...
|
9.8 Critical | — | 3,3% | 23 Jan 2020 |
|
CVE-2013-6792
google android
Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
|
9.8 Critical | — | 3,0% | 23 Jan 2020 |
|
CVE-2014-7238
formget contact form integrated with google maps
The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS
|
6.1 Medium | — | 1,1% | 23 Jan 2020 |
|
CVE-2016-1000237
apostrophecms sanitize-html
sanitize-html before 1.4.3 has XSS.
|
6.1 Medium | — | 0,84% | 23 Jan 2020 |
|
CVE-2013-6358
prestashop
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.
|
8.8 High | — | 3,7% | 23 Jan 2020 |
|
CVE-2013-6772
splunk
Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking
|
4.3 Medium | — | 0,68% | 23 Jan 2020 |
|
CVE-2013-6773
splunk
Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges
|
7.8 High | — | 0,27% | 23 Jan 2020 |
|
CVE-2013-6785
supermicro intelligent platform management interface
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name paramet...
|
4.3 Medium | — | 4,4% | 23 Jan 2020 |
|
CVE-2012-4900
corel wordperfect office x6
Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference
|
5.5 Medium | — | 2,1% | 23 Jan 2020 |
|
CVE-2012-4981
toshiba configfree
Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability
|
8.8 High | — | 3,4% | 23 Jan 2020 |
|
CVE-2012-5698
babygekko
BabyGekko before 1.2.4 has SQL injection.
|
8.8 High | — | 1,8% | 23 Jan 2020 |
|
CVE-2012-5699
babygekko
BabyGekko before 1.2.4 allows PHP file inclusion.
|
9.8 Critical | — | 4,9% | 23 Jan 2020 |
|
CVE-2012-5867
ht editor project ht editor
HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability
|
9.8 Critical | — | 2,2% | 23 Jan 2020 |
|
CVE-2013-4175
mysecureshell project mysecureshell
MySecureShell 1.31 has a Local Denial of Service Vulnerability
|
5.5 Medium | — | 0,44% | 23 Jan 2020 |
|
CVE-2013-4176
mysecureshell project mysecureshell
mysecureshell 1.31: Local Information Disclosure Vulnerability
|
5.5 Medium | — | 0,43% | 23 Jan 2020 |
|
CVE-2012-2087
ispconfig
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
|
9.8 Critical | — | 2,7% | 23 Jan 2020 |
|
CVE-2012-4863
ibm websphere mq
IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
|
6.5 Medium | — | 1,2% | 23 Jan 2020 |
|
CVE-2008-7314
mirc
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
|
7.5 High | — | 1,3% | 23 Jan 2020 |
|
CVE-2019-18898
suse trousers, opensuse leap
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate pri...
|
7.8 High | — | 0,48% | 23 Jan 2020 |
|
CVE-2019-19837
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
|
5.3 Medium | — | 2,0% | 23 Jan 2020 |
|
CVE-2020-7210
umbraco cms
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
|
4.3 Medium | — | 1,0% | 23 Jan 2020 |
|
CVE-2019-19835
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdsta...
|
7.5 High | — | 1,8% | 23 Jan 2020 |
|
CVE-2020-5216
twitter secure headers
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed i...
|
5.8 Medium | — | 1,2% | 23 Jan 2020 |
|
CVE-2020-5217
twitter secure headers
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed i...
|
5.8 Medium | — | 1,8% | 23 Jan 2020 |
|
CVE-2020-5223
privatebin
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can...
|
4.4 Medium | — | 0,66% | 23 Jan 2020 |
|
CVE-2019-20399
parity libsecp256k1
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel...
|
5.9 Medium | — | 0,88% | 23 Jan 2020 |
|
CVE-2020-7915
eaton 5p 850 firmware
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
|
4.8 Medium | — | 0,65% | 22 Jan 2020 |
|
CVE-2019-20391
cesnet libyang
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications...
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20392
cesnet libyang
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, an...
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20393
cesnet libyang
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yan...
|
8.8 High | — | 2,8% | 22 Jan 2020 |
|
CVE-2019-20394
cesnet libyang
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to p...
|
8.8 High | — | 2,8% | 22 Jan 2020 |
|
CVE-2019-20395
cesnet libyang
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untruste...
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20396
cesnet libyang
A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20397
cesnet libyang
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untruste...
|
8.8 High | — | 2,5% | 22 Jan 2020 |
|
CVE-2019-20398
cesnet libyang
A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup()....
|
6.5 Medium | — | 1,8% | 22 Jan 2020 |
|
CVE-2019-19840
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP reque...
|
9.8 Critical | — | 4,1% | 22 Jan 2020 |
|
CVE-2019-19841
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admi...
|
9.8 Critical | — | 3,3% | 22 Jan 2020 |
|
CVE-2019-19842
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to ad...
|
9.8 Critical | — | 5,0% | 22 Jan 2020 |
|
CVE-2011-3622
phorum
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
|
6.1 Medium | — | 0,66% | 22 Jan 2020 |
|
CVE-2020-5221
troglobit uftpd
In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbit...
|
7.2 High | — | 1,2% | 22 Jan 2020 |
|
CVE-2019-19834
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with...
|
7.2 High | — | 2,2% | 22 Jan 2020 |