Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-2540
oracle outside in technology
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Ea...
|
6.5 Medium | — | 1,4% | 15 Jan 2020 |
|
CVE-2020-2541
oracle outside in technology
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Ea...
|
6.5 Medium | — | 1,5% | 15 Jan 2020 |
|
CVE-2020-2542
oracle outside in technology
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Ea...
|
6.5 Medium | — | 1,5% | 15 Jan 2020 |
|
CVE-2020-2543
oracle outside in technology
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Ea...
|
7.3 High | — | 1,2% | 15 Jan 2020 |
|
CVE-2020-2544
oracle weblogic server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12....
|
4.3 Medium | — | 0,97% | 15 Jan 2020 |
|
CVE-2020-2545
oracle http server
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and...
|
5.3 Medium | — | 1,5% | 15 Jan 2020 |
|
CVE-2020-2546
oracle weblogic server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3...
|
9.8 Critical | — | 5,1% | 15 Jan 2020 |
|
CVE-2020-2547
oracle weblogic server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12....
|
4.8 Medium | — | 0,95% | 15 Jan 2020 |
|
CVE-2020-2548
oracle weblogic server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). The supported version that is affected is 10.3.6.0.0. Ea...
|
4.8 Medium | — | 0,91% | 15 Jan 2020 |
|
CVE-2020-2512
oracle database server
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Di...
|
5.9 Medium | — | 1,5% | 15 Jan 2020 |
|
CVE-2020-2515
oracle database server
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Di...
|
5.0 Medium | — | 0,79% | 15 Jan 2020 |
|
CVE-2020-2516
oracle database server
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerab...
|
2.4 Low | — | 0,78% | 15 Jan 2020 |
|
CVE-2020-2517
oracle database server
Vulnerability in the Database Gateway for ODBC component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c. D...
|
3.3 Low | — | 0,77% | 15 Jan 2020 |
|
CVE-2020-2518
oracle database server
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit...
|
7.5 High | — | 1,3% | 15 Jan 2020 |
|
CVE-2020-2519
oracle weblogic server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12....
|
4.3 Medium | — | 1,2% | 15 Jan 2020 |
|
CVE-2020-2527
oracle database server
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerab...
|
4.1 Medium | — | 0,98% | 15 Jan 2020 |
|
CVE-2020-2530
oracle http server
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and...
|
6.1 Medium | — | 1,1% | 15 Jan 2020 |
|
CVE-2020-2531
oracle business intelligence
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: BI Platform Security). Supported versions that are af...
|
3.1 Low | — | 1,1% | 15 Jan 2020 |
|
CVE-2020-2533
oracle reports developer
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Supported versions that are affected are 12.2....
|
6.1 Medium | — | 1,0% | 15 Jan 2020 |
|
CVE-2020-2534
oracle reports developer
Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). Supported versions that are affected are 12.2....
|
6.1 Medium | — | 1,00% | 15 Jan 2020 |
|
CVE-2020-2535
oracle business intelligence
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). Supported versions that are affect...
|
4.7 Medium | — | 1,4% | 15 Jan 2020 |
|
CVE-2020-2510
oracle database server
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to expl...
|
7.5 High | — | 2,1% | 15 Jan 2020 |
|
CVE-2020-2511
oracle database server
Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerab...
|
7.7 High | — | 1,3% | 15 Jan 2020 |
|
CVE-2019-16468
adobe experience manager
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an user interface injection vulnerability. Successful exploitation could lead to sensitive informa...
|
7.5 High | — | 2,6% | 15 Jan 2020 |
|
CVE-2019-16469
adobe experience manager
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive in...
|
7.5 High | — | 17,2% | 15 Jan 2020 |
|
CVE-2019-9493
mycarcontrols mycar controls
The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able to send comm...
|
9.8 Critical | — | 3,6% | 15 Jan 2020 |
|
CVE-2019-9510
microsoft windows 10, microsoft windows server 2019
A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions witho...
|
7.8 High | — | 1,3% | 15 Jan 2020 |
|
CVE-2005-4891
simplemachines simple machine forum
Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.
|
9.8 Critical | — | 1,7% | 15 Jan 2020 |
|
CVE-2007-4773
systrace project systrace
Systrace before 1.6.0 has insufficient escape policy enforcement.
|
9.8 Critical | — | 1,7% | 15 Jan 2020 |
|
CVE-2007-4774
linux kernel
The Linux kernel before 2.4.36-rc1 has a race condition. It was possible to bypass systrace policies by flooding the ptraced process with SIGCONT signals, which can can w...
|
5.9 Medium | — | 1,7% | 15 Jan 2020 |
|
CVE-2017-3211
yopify
Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without user authori...
|
5.3 Medium | — | 0,83% | 15 Jan 2020 |
|
CVE-2015-5230
powerdns authoritative, debian linux
The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via cra...
|
7.5 High | — | 9,0% | 15 Jan 2020 |
|
CVE-2015-5952
thomsonreuters fatca
Directory traversal vulnerability in Thomson Reuters for FATCA before 5.2 allows remote attackers to execute arbitrary files via the item parameter.
|
9.8 Critical | — | 3,4% | 15 Jan 2020 |
|
CVE-2015-6497
magento
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, w...
|
8.8 High | — | 7,4% | 15 Jan 2020 |
|
CVE-2019-16466
adobe experience manager
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive in...
|
6.1 Medium | — | 1,5% | 15 Jan 2020 |
|
CVE-2019-16467
adobe experience manager
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive in...
|
6.1 Medium | — | 1,5% | 15 Jan 2020 |
|
CVE-2020-2098
jenkins sounds
A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkin...
|
8.8 High | — | 1,0% | 15 Jan 2020 |
|
CVE-2020-2090
jenkins amazon ec2
A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AWS region us...
|
8.8 High | — | 0,83% | 15 Jan 2020 |
|
CVE-2020-2091
jenkins amazon ec2
A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL within the...
|
8.1 High | — | 1,1% | 15 Jan 2020 |
|
CVE-2020-2092
jenkins robot framework
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have...
|
8.8 High | — | 1,4% | 15 Jan 2020 |
|
CVE-2020-2093
jenkins health advisor by cloudbees
A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attack...
|
8.8 High | — | 0,84% | 15 Jan 2020 |
|
CVE-2020-2094
jenkins health advisor by cloudbees
A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacke...
|
4.3 Medium | — | 0,82% | 15 Jan 2020 |
|
CVE-2020-2095
jenkins redgate sql change automation
Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by u...
|
4.3 Medium | — | 0,86% | 15 Jan 2020 |
|
CVE-2020-2096
jenkins gitlab hook
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
|
6.1 Medium | — | 92,8% | 15 Jan 2020 |
|
CVE-2020-2097
jenkins sounds
Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitr...
|
8.8 High | — | 1,2% | 15 Jan 2020 |
|
CVE-2019-18412
jetbrains idetalk
JetBrains IDETalk plugin before version 193.4099.10 allows XXE
|
7.5 High | — | 1,0% | 15 Jan 2020 |
|
CVE-2015-5466
sis xgi vga display manager
Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privileges via a cra...
|
7.8 High | — | 1,1% | 15 Jan 2020 |
|
CVE-2015-5484
plotly
Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a po...
|
5.4 Medium | — | 1,4% | 15 Jan 2020 |
|
CVE-2015-7874
portapps kitty portable
Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.
|
9.8 Critical | — | 13,9% | 15 Jan 2020 |
|
CVE-2015-7556
delegate
DeleGate 9.9.13 allows local users to gain privileges as demonstrated by the dgcpnod setuid program.
|
7.8 High | — | 1,3% | 15 Jan 2020 |