Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-6849
hutchhouse marketo forms and tracking
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
|
8.8 High | — | 1,3% | 21 Jan 2020 |
|
CVE-2019-17357
cacti
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite val...
|
6.5 Medium | — | 34,2% | 21 Jan 2020 |
|
CVE-2019-19411
huawei usg9500 firmware
USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vuln...
|
3.7 Low | — | 1,2% | 21 Jan 2020 |
|
CVE-2019-19592
jamasoftware connect
Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
|
6.1 Medium | — | 0,69% | 21 Jan 2020 |
|
CVE-2014-2680
xmind
The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.
|
8.1 High | — | 1,9% | 21 Jan 2020 |
|
CVE-2016-11018
huge-it image gallery
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL inject...
|
9.8 Critical | — | 2,4% | 21 Jan 2020 |
|
CVE-2020-5202
apt-cacher-ng project apt-cacher-ng, debian linux +2 lainnya
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to...
|
5.5 Medium | — | 0,47% | 21 Jan 2020 |
|
CVE-2015-2784
papercrop project papercrop
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
|
9.8 Critical | — | 1,8% | 21 Jan 2020 |
|
CVE-2019-14902
samba, canonical ubuntu linux +2 lainnya
There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of th...
|
5.4 Medium | — | 1,4% | 21 Jan 2020 |
|
CVE-2019-14907
samba, fedoraproject fedora +8 lainnya
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string ob...
|
6.5 Medium | — | 3,2% | 21 Jan 2020 |
|
CVE-2019-18932
squid analysis report generator project squid analysis report generator, opensuse backports sle +1 lainnya
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root u...
|
7.0 High | — | 0,25% | 21 Jan 2020 |
|
CVE-2019-19344
samba, canonical ubuntu linux +5 lainnya
There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essential...
|
6.5 Medium | — | 2,8% | 21 Jan 2020 |
|
CVE-2019-19392
fordnn usersexportimport
The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as...
|
9.8 Critical | — | 1,4% | 21 Jan 2020 |
|
CVE-2020-6857
taskautomation carbonftp
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.
|
5.5 Medium | — | 0,97% | 21 Jan 2020 |
|
CVE-2020-7211
libslirp project libslirp, qemu
tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
|
7.5 High | — | 4,2% | 21 Jan 2020 |
|
CVE-2020-7213
parallels
Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a...
|
7.5 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2020-7229
simplejobscript
An issue was discovered in Simplejobscript.com SJS before 1.65. There is unauthenticated SQL injection via the search engine. The parameter is landing_location. The funct...
|
9.8 Critical | — | 1,5% | 21 Jan 2020 |
|
CVE-2019-3864
redhat quay
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF toke...
|
8.8 High | — | 0,44% | 21 Jan 2020 |
|
CVE-2019-14765
dimo-crm yellowbox crm
Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers.
|
8.8 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2019-14766
dimo-crm yellowbox crm
Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem.
|
6.5 Medium | — | 1,1% | 21 Jan 2020 |
|
CVE-2019-14767
dimo-crm yellowbox crm
In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download...
|
7.5 High | — | 1,4% | 21 Jan 2020 |
|
CVE-2019-14768
dimo-crm yellowbox crm
An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat s...
|
8.8 High | — | 4,3% | 21 Jan 2020 |
|
CVE-2011-5282
mirc
mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
|
5.3 Medium | — | 1,1% | 21 Jan 2020 |
|
CVE-2012-5190
accusoft prizm content connect
Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability
|
9.8 Critical | — | 4,7% | 21 Jan 2020 |
|
CVE-2011-4095
jara project jara
Jara 1.6 has an XSS vulnerability
|
6.1 Medium | — | 2,0% | 21 Jan 2020 |
|
CVE-2011-4322
websitebaker
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
|
7.5 High | — | 1,2% | 21 Jan 2020 |
|
CVE-2020-7470
sonoff th10 firmware, sonoff th16 firmware
Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Password).
|
4.8 Medium | — | 0,56% | 21 Jan 2020 |
|
CVE-2011-2668
mozilla firefox
Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header
|
8.8 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2011-2669
mozilla firefox
Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
|
6.5 Medium | — | 0,56% | 21 Jan 2020 |
|
CVE-2011-4094
jara project jara
Jara 1.6 has a SQL injection vulnerability.
|
9.8 Critical | — | 2,7% | 21 Jan 2020 |
|
CVE-2020-7246
qdpm
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by lever...
|
8.8 High | — | 83,2% | 21 Jan 2020 |
|
CVE-2019-2267
qualcomm mdm9205 firmware, qualcomm qcs404 firmware +9 lainnya
Locked regions may be modified through other interfaces in secure boot loader image due to improper access control. in Snapdragon Auto, Snapdragon Compute, Snapdragon Con...
|
7.8 High | — | 0,22% | 21 Jan 2020 |
|
CVE-2019-10611
qualcomm apq8009 firmware, qualcomm apq8017 firmware +38 lainnya
Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr...
|
9.8 Critical | — | 0,90% | 21 Jan 2020 |
|
CVE-2019-14003
qualcomm apq8009 firmware, qualcomm apq8017 firmware +44 lainnya
Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon Auto, Snapdragon Compute, Snapdr...
|
7.5 High | — | 0,81% | 21 Jan 2020 |
|
CVE-2019-14004
qualcomm apq8009 firmware, qualcomm apq8017 firmware +44 lainnya
Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer...
|
9.8 Critical | — | 0,90% | 21 Jan 2020 |
|
CVE-2019-14005
qualcomm apq8009 firmware, qualcomm apq8017 firmware +41 lainnya
Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S...
|
9.8 Critical | — | 0,95% | 21 Jan 2020 |
|
CVE-2019-14006
qualcomm apq8009 firmware, qualcomm apq8017 firmware +42 lainnya
Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap...
|
9.8 Critical | — | 0,95% | 21 Jan 2020 |
|
CVE-2019-14008
qualcomm mdm9150 firmware, qualcomm mdm9607 firmware +6 lainnya
Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in Snapdragon Auto, Snapdragon Consu...
|
7.5 High | — | 0,81% | 21 Jan 2020 |
|
CVE-2019-14010
qualcomm mdm9607 firmware, qualcomm nicobar firmware +9 lainnya
The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical ad...
|
7.5 High | — | 0,66% | 21 Jan 2020 |
|
CVE-2019-14013
qualcomm apq8009 firmware, qualcomm apq8017 firmware +45 lainnya
While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read into the table in Snapdragon Auto, Snapdra...
|
9.8 Critical | — | 0,91% | 21 Jan 2020 |
|
CVE-2019-14014
qualcomm nicobar firmware, qualcomm sdm670 firmware +6 lainnya
Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer IOT, Snapdragon Industrial IO...
|
9.8 Critical | — | 0,90% | 21 Jan 2020 |
|
CVE-2019-14016
qualcomm apq8009 firmware, qualcomm apq8017 firmware +39 lainnya
Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon I...
|
9.8 Critical | — | 0,91% | 21 Jan 2020 |
|
CVE-2019-14017
qualcomm apq8009 firmware, qualcomm apq8017 firmware +44 lainnya
Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdragon Auto, Snapdragon Compute, Snapdragon...
|
9.8 Critical | — | 0,90% | 21 Jan 2020 |
|
CVE-2019-14023
qualcomm mdm9607 firmware, qualcomm nicobar firmware +8 lainnya
String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminated before string copy in Snapdra...
|
7.8 High | — | 0,20% | 21 Jan 2020 |
|
CVE-2019-14024
qualcomm msm8917 firmware, qualcomm msm8953 firmware +15 lainnya
Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM21...
|
7.8 High | — | 0,20% | 21 Jan 2020 |
|
CVE-2019-14034
qualcomm apq8009 firmware, qualcomm apq8053 firmware +25 lainnya
Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,...
|
7.8 High | — | 0,20% | 21 Jan 2020 |
|
CVE-2019-14036
qualcomm apq8064 firmware, qualcomm apq8096au firmware +8 lainnya
Possible buffer overflow issue in error processing due to improper validation of array index value in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapd...
|
7.8 High | — | 0,20% | 21 Jan 2020 |
|
CVE-2019-10532
qualcomm apq8009 firmware, qualcomm apq8017 firmware +39 lainnya
Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consume...
|
9.8 Critical | — | 1,1% | 21 Jan 2020 |
|
CVE-2019-10548
qualcomm apq8009 firmware, qualcomm apq8053 firmware +32 lainnya
While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same time in Snapdragon Auto, Snapdragon Com...
|
7.8 High | — | 0,20% | 21 Jan 2020 |
|
CVE-2019-10558
qualcomm apq8009 firmware, qualcomm apq8017 firmware +39 lainnya
While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DSP in Snapdragon Auto, Snapdragon Compute...
|
7.8 High | — | 0,20% | 21 Jan 2020 |