Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-19836
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write t...
|
9.8 Critical | — | 3,6% | 22 Jan 2020 |
|
CVE-2019-19843
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request invo...
|
9.8 Critical | — | 1,8% | 22 Jan 2020 |
|
CVE-2019-16792
agendaless waitress, oracle communications cloud native core network function cloud native environment +1 lainnya
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to b...
|
7.5 High | — | 2,0% | 22 Jan 2020 |
|
CVE-2012-4919
gallery project gallery
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
|
9.8 Critical | — | 2,9% | 22 Jan 2020 |
|
CVE-2016-4761
webkitgtk+, canonical ubuntu linux
WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS
|
8.8 High | — | 1,4% | 22 Jan 2020 |
|
CVE-2019-5647
rapid7 appspider
The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior cou...
|
7.1 High | — | 0,34% | 22 Jan 2020 |
|
CVE-2011-3612
usebb
Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
|
8.8 High | — | 0,88% | 22 Jan 2020 |
|
CVE-2011-3613
vanillaforums vanilla
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
|
7.5 High | — | 1,7% | 22 Jan 2020 |
|
CVE-2011-3614
vanillaforums vanilla
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
|
9.8 Critical | — | 2,0% | 22 Jan 2020 |
|
CVE-2011-3621
fluxbb
A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.
|
9.8 Critical | — | 1,2% | 22 Jan 2020 |
|
CVE-2019-6146
forcepoint web security
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR...
|
6.1 Medium | — | 3,0% | 22 Jan 2020 |
|
CVE-2020-7109
elementor website builder
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
|
9.8 Critical | — | 1,7% | 22 Jan 2020 |
|
CVE-2011-3611
usebb
A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.
|
7.2 High | — | 2,6% | 22 Jan 2020 |
|
CVE-2011-3595
joomla!
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
|
5.4 Medium | — | 0,81% | 22 Jan 2020 |
|
CVE-2011-3610
s9y serendipity event freetag
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.sw...
|
6.1 Medium | — | 1,2% | 22 Jan 2020 |
|
CVE-2020-6959
honeywell maxpro nvr xe firmware, honeywell maxpro nvr se firmware +4 lainnya
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPR...
|
9.8 Critical | — | 2,2% | 22 Jan 2020 |
|
CVE-2020-6960
honeywell maxpro nvr xe firmware, honeywell maxpro nvr se firmware +4 lainnya
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPR...
|
9.8 Critical | — | 1,1% | 22 Jan 2020 |
|
CVE-2020-7228
codepeople calculated fields form
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an...
|
5.4 Medium | — | 0,99% | 22 Jan 2020 |
|
CVE-2011-3582
anelectron advanced electron forums
A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the...
|
8.8 High | — | 0,51% | 22 Jan 2020 |
|
CVE-2018-16270
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetoot...
|
7.5 High | — | 1,2% | 22 Jan 2020 |
|
CVE-2018-16271
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to imp...
|
6.5 Medium | — | 0,81% | 22 Jan 2020 |
|
CVE-2018-16272
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security...
|
9.8 Critical | — | 1,6% | 22 Jan 2020 |
|
CVE-2019-10780
bibtex-ruby project bibtex-ruby
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
|
9.8 Critical | — | 2,8% | 22 Jan 2020 |
|
CVE-2019-10781
schema-inspector project schema-inspector
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
|
9.8 Critical | — | 1,4% | 22 Jan 2020 |
|
CVE-2019-6858
schneider-electric msx configurator
A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalation when inje...
|
7.8 High | — | 0,36% | 22 Jan 2020 |
|
CVE-2018-16262
linux tizen
The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such action...
|
8.8 High | — | 0,78% | 22 Jan 2020 |
|
CVE-2018-16263
linux tizen
The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affect...
|
8.8 High | — | 0,78% | 22 Jan 2020 |
|
CVE-2018-16264
linux tizen
The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus security policy co...
|
6.5 Medium | — | 0,58% | 22 Jan 2020 |
|
CVE-2018-16265
linux tizen
The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to improper D-Bus s...
|
6.5 Medium | — | 0,59% | 22 Jan 2020 |
|
CVE-2018-16266
linux tizen
The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This a...
|
8.1 High | — | 0,71% | 22 Jan 2020 |
|
CVE-2018-16267
linux tizen
The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Suc...
|
8.1 High | — | 0,68% | 22 Jan 2020 |
|
CVE-2018-16268
linux tizen
The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configur...
|
4.3 Medium | — | 0,52% | 22 Jan 2020 |
|
CVE-2018-16269
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security...
|
7.5 High | — | 1,4% | 22 Jan 2020 |
|
CVE-2011-4943
impresspages cms
ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)
|
9.8 Critical | — | 1,8% | 22 Jan 2020 |
|
CVE-2019-12490
simplemachines simple machines forum
An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _blank for external links.
|
6.5 Medium | — | 1,3% | 22 Jan 2020 |
|
CVE-2019-16791
postfix-mta-sts-resolver project postfix-mta-sts-resolver
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.
|
5.9 Medium | — | 0,86% | 22 Jan 2020 |
|
CVE-2018-17981
lifesize express 220 firmware, lifesize room 220i firmware
Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
|
6.1 Medium | — | 0,78% | 22 Jan 2020 |
|
CVE-2019-19413
huawei dbs3900 tdd lte firmware, huawei dp300 firmware +5 lainnya
There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerabilit...
|
7.5 High | — | 0,96% | 21 Jan 2020 |
|
CVE-2019-19414
huawei dbs3900 tdd lte firmware, huawei dp300 firmware +5 lainnya
There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerabilit...
|
7.5 High | — | 0,96% | 21 Jan 2020 |
|
CVE-2019-20387
opensuse libsolv, debian linux
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
|
7.5 High | — | 2,3% | 21 Jan 2020 |
|
CVE-2019-20388
xmlsoft libxml2, debian linux +22 lainnya
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
|
7.5 High | — | 3,2% | 21 Jan 2020 |
|
CVE-2020-1788
huawei honor v30 firmware
Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the...
|
5.5 Medium | — | 0,59% | 21 Jan 2020 |
|
CVE-2020-7595
xmlsoft libxml2, fedoraproject fedora +22 lainnya
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
|
7.5 High | — | 7,8% | 21 Jan 2020 |
|
CVE-2020-7594
multitech conduit mtcdt-lvw2-246a firmware
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options...
|
7.2 High | — | 2,5% | 21 Jan 2020 |
|
CVE-2019-19886
owasp modsecurity, fedoraproject fedora
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or un...
|
7.5 High | — | 2,5% | 21 Jan 2020 |
|
CVE-2019-18426
whatsapp
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file r...
|
8.2 High | KEV | 67,9% | 21 Jan 2020 |
|
CVE-2020-7040
storebackup, debian linux +3 lainnya
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local us...
|
8.1 High | — | 2,9% | 21 Jan 2020 |
|
CVE-2020-6638
grin
Grin through 2.1.1 has Insufficient Validation.
|
7.5 High | — | 1,3% | 21 Jan 2020 |
|
CVE-2019-17584
meinbergglobal syncbox/ptpv2 firmware
The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions up to v5.34o, v5.34s, v5.32* o...
|
7.5 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2020-1840
huawei mate 20 firmware
HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high privilege can...
|
6.0 Medium | — | 0,22% | 21 Jan 2020 |