Katalog CVE (hal. 5129)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.870 (Critical 35.834 · High 103.117 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 256.401–256.450 dari 257.870 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-10956 geutebrueck g-code eec-2400 firmware, geutebrueck g-cam ebc-2110 firmware +9 lainnya Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated user, using a spec...	7.2 High	—	2,7%	17 Jan 2020
CVE-2019-10957 geutebrueck g-code eec-2400 firmware, geutebrueck g-cam ebc-2110 firmware +9 lainnya Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with acce...	4.8 Medium	—	0,94%	17 Jan 2020
CVE-2019-10958 geutebrueck g-code eec-2400 firmware, geutebrueck g-cam ebc-2110 firmware +9 lainnya Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with acce...	7.2 High	—	3,3%	17 Jan 2020
CVE-2019-15854 maarch rm An issue was discovered in Maarch RM before 2.5. A privilege escalation vulnerability allows an authenticated user with lowest privileges to give herself highest administ...	8.8 High	—	1,3%	17 Jan 2020
CVE-2019-15855 maarch rm An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted POST reque...	9.1 Critical	—	1,5%	17 Jan 2020
CVE-2019-20003 dicube easescreen crystal Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends an...	6.1 Medium	—	0,70%	17 Jan 2020
CVE-2019-3686 suse openqa openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27b was vulnerable to XSS in the distri and version parameter. This was reported through the bug bounty program...	6.1 Medium	—	0,62%	17 Jan 2020
CVE-2019-3683 suse openstack cloud, suse keystone-json-assignment +1 lainnya The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-...	8.8 High	—	0,94%	17 Jan 2020
CVE-2019-3682 suse caas platform The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.	7.8 High	—	0,31%	17 Jan 2020
CVE-2019-19801 gallagher command centre In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2...	5.5 Medium	—	0,28%	17 Jan 2020
CVE-2019-19802 gallagher command centre In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70...	6.5 Medium	—	0,75%	17 Jan 2020
CVE-2019-17361 saltstack salt, debian linux +2 lainnya In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with netw...	9.8 Critical	—	15,2%	17 Jan 2020
CVE-2019-19142 intelbras wrn 240 firmware Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.	7.5 High	—	7,8%	17 Jan 2020
CVE-2019-15742 plantronics hub A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit this issue to gain...	7.8 High	—	5,0%	17 Jan 2020
CVE-2020-5398 vmware spring framework, oracle application testing suite +29 lainnya In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file d...	7.5 High	—	88,8%	17 Jan 2020
CVE-2020-7039 libslirp project libslirp, qemu +2 lainnya tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer over...	5.6 Medium	—	3,6%	16 Jan 2020
CVE-2019-3997 simplisafe ss3 firmware Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair a rogue keypad to an armed sy...	4.6 Medium	—	0,39%	16 Jan 2020
CVE-2019-5126 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previ...	8.8 High	—	3,5%	16 Jan 2020
CVE-2019-5130 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can...	8.8 High	—	2,3%	16 Jan 2020
CVE-2019-5131 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document ca...	8.8 High	—	2,4%	16 Jan 2020
CVE-2019-5145 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previ...	8.8 High	—	3,1%	16 Jan 2020
CVE-2019-9500 broadcom brcmfmac driver, linux kernel The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functio...	8.3 High	—	3,9%	16 Jan 2020
CVE-2019-9503 broadcom brcmfmac driver, redhat enterprise linux The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a f...	8.3 High	—	3,3%	16 Jan 2020
CVE-2020-7047 webfactoryltd wp database reset The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin...	8.8 High	—	2,5%	16 Jan 2020
CVE-2020-7048 webfactoryltd wp database reset The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set...	9.1 Critical	—	22,9%	16 Jan 2020
CVE-2019-11998 hpe superdome flex server firmware HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could allow an Admi...	5.5 Medium	—	0,76%	16 Jan 2020
CVE-2019-11997 hp enhanced internet usage manager A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9.0. The vulnerability could be used for unauthorize...	6.1 Medium	—	1,0%	16 Jan 2020
CVE-2019-12423 apache cxf, oracle commerce guided search +6 lainnya Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of...	7.5 High	—	6,1%	16 Jan 2020
CVE-2019-13524 emerson rx3i cpe100 firmware, emerson rx3i cpe115 firmware +7 lainnya GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker...	7.5 High	—	1,5%	16 Jan 2020
CVE-2019-17573 apache cxf, oracle commerce guided search +5 lainnya By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site S...	6.1 Medium	—	7,1%	16 Jan 2020
CVE-2010-3048 cisco unified personal communicator Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memory allocation is successful, cau...	7.5 High	—	1,3%	16 Jan 2020
CVE-2019-19278 siemens sinamics perfect harmony gh180 firmware A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 (HMIs...	6.8 Medium	—	0,32%	16 Jan 2020
CVE-2019-18282 linux kernel, debian linux +12 lainnya The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowl...	5.3 Medium	—	2,6%	16 Jan 2020
CVE-2019-13933 siemens scalance x-200rna firmware, siemens scalance x204rna firmware +5 lainnya A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA EEC (PRP/H...	8.6 High	—	1,4%	16 Jan 2020
CVE-2019-13939 siemens capital vstar, siemens nucleus net +24 lainnya A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethern...	7.1 High	—	0,72%	16 Jan 2020
CVE-2019-10940 siemens sinema server A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid session, with...	9.9 Critical	—	1,2%	16 Jan 2020
CVE-2019-10934 siemens totally integrated automation portal A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All versions < V16 Update 6), TIA Po...	7.8 High	—	0,43%	16 Jan 2020
CVE-2019-20327 centreon Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid ex...	7.8 High	—	0,36%	16 Jan 2020
CVE-2020-7108 learndash The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.	5.4 Medium	—	3,5%	16 Jan 2020
CVE-2020-7107 etoilewebdesign ultimate faq The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.	6.1 Medium	—	2,2%	16 Jan 2020
CVE-2020-7044 wireshark, fedoraproject fedora +3 lainnya In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one errors.	7.5 High	—	3,2%	16 Jan 2020
CVE-2020-7045 wireshark, debian linux In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by validating opcodes.	6.5 Medium	—	1,5%	16 Jan 2020
CVE-2020-7105 redislabs hiredis, debian linux +1 lainnya async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.	7.5 High	—	2,7%	16 Jan 2020
CVE-2020-7106 cacti, debian linux +5 lainnya Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, a...	6.1 Medium	—	2,2%	16 Jan 2020
CVE-2019-19854 serpico project serpico An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin head...	8.8 High	—	0,48%	15 Jan 2020
CVE-2019-19855 serpico project serpico An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows stored XSS via the auth_type parameter.	4.8 Medium	—	0,71%	15 Jan 2020
CVE-2019-19856 serpico project serpico An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via the type para...	4.8 Medium	—	0,71%	15 Jan 2020
CVE-2019-19857 serpico project serpico An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current password, by...	6.5 Medium	—	0,86%	15 Jan 2020
CVE-2019-19858 serpico project serpico An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows stored XSS via the author parameter.	4.8 Medium	—	0,59%	15 Jan 2020
CVE-2019-19859 serpico project serpico An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if...	5.3 Medium	—	0,80%	15 Jan 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.