Katalog CVE (hal. 5135)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.870 (Critical 35.834 · High 103.117 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 256.701–256.750 dari 257.870 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2015-8549 pyamf XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Fo...	7.1 High	—	1,8%	15 Jan 2020
CVE-2011-4336 tikiwiki cms/groupware Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php.	6.1 Medium	—	7,7%	15 Jan 2020
CVE-2011-4907 joomla! Joomla! 1.5x through 1.5.12: Missing JEXEC Check	5.3 Medium	—	0,88%	15 Jan 2020
CVE-2012-0070 spamdyke spamdyke prior to 4.2.1: STARTTLS reveals plaintext	7.5 High	—	0,94%	15 Jan 2020
CVE-2012-1316 cisco ironport web security appliance Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks	5.9 Medium	—	0,58%	15 Jan 2020
CVE-2012-1326 cisco ironport web security appliance Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks	7.4 High	—	0,66%	15 Jan 2020
CVE-2012-1562 joomla! Joomla! core before 2.5.3 allows unauthorized password change.	7.5 High	—	0,89%	15 Jan 2020
CVE-2012-1563 joomla! Joomla! before 2.5.3 allows Admin Account Creation.	7.5 High	—	8,9%	15 Jan 2020
CVE-2012-0334 cisco ironport web security appliance Cisco IronPort Web Security Appliance AsyncOS software prior to 7.5 has a SSL Certificate Caching vulnerability which could allow man-in-the-middle attacks	6.4 Medium	—	0,26%	15 Jan 2020
CVE-2012-0945 whoopsie-daisy project whoopsie-daisy whoopsie-daisy before 0.1.26: Root user can remove arbitrary files	4.9 Medium	—	0,71%	15 Jan 2020
CVE-2020-1602 juniper junos When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vul...	8.8 High	—	0,79%	15 Jan 2020
CVE-2020-1603 juniper junos Specific IPv6 packets sent by clients processed by the Routing Engine (RE) are improperly handled. These IPv6 packets are designed to be blocked by the RE from egressing...	8.6 High	—	1,4%	15 Jan 2020
CVE-2020-1604 juniper junos On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. T...	5.3 Medium	—	0,85%	15 Jan 2020
CVE-2020-1605 juniper junos When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vul...	8.8 High	—	0,84%	15 Jan 2020
CVE-2020-1606 juniper junos A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and delete fil...	8.1 High	—	0,93%	15 Jan 2020
CVE-2020-1607 juniper junos Insufficient Cross-Site Scripting (XSS) protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-Web session a...	6.1 Medium	—	0,88%	15 Jan 2020
CVE-2020-1608 juniper junos Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for Broadband Edge (BBE) service may trigger a kernel crash (vmco...	7.5 High	—	1,3%	15 Jan 2020
CVE-2020-1609 juniper junos When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vul...	8.8 High	—	0,94%	15 Jan 2020
CVE-2020-1611 juniper junos space A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. T...	6.5 Medium	—	1,7%	15 Jan 2020
CVE-2020-1600 juniper junos In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Net...	6.5 Medium	—	1,2%	15 Jan 2020
CVE-2020-1601 juniper junos Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computatio...	7.5 High	—	1,1%	15 Jan 2020
CVE-2020-7058 cacti data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the vendor has...	8.8 High	—	2,3%	15 Jan 2020
CVE-2020-5501 phpbb phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.	4.3 Medium	—	0,38%	15 Jan 2020
CVE-2020-5502 phpbb phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.	6.5 Medium	—	0,43%	15 Jan 2020
CVE-2020-0644 microsoft windows 10, microsoft windows 8.1 +4 lainnya An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation of Privilege Vulnerability'. Thi...	7.8 High	—	0,87%	14 Jan 2020
CVE-2020-0646 microsoft .net framework A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulne...	9.8 Critical	KEV	99,2%	14 Jan 2020
CVE-2020-0647 microsoft office online server A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vulnerability'...	5.4 Medium	—	0,92%	14 Jan 2020
CVE-2020-0650 microsoft excel, microsoft office 365 proplus A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Ex...	7.8 High	—	17,3%	14 Jan 2020
CVE-2020-0651 microsoft excel, microsoft office 365 proplus A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Ex...	7.8 High	—	17,3%	14 Jan 2020
CVE-2020-0652 microsoft excel, microsoft office 365 proplus A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Memory Corru...	7.8 High	—	17,1%	14 Jan 2020
CVE-2020-0653 microsoft office 365 proplus A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Ex...	7.8 High	—	20,5%	14 Jan 2020
CVE-2020-0654 microsoft onedrive A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or fingerprint requirements of th...	9.1 Critical	—	3,5%	14 Jan 2020
CVE-2020-0656 microsoft dynamics 365 A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics s...	5.4 Medium	—	1,5%	14 Jan 2020
CVE-2020-0631 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,76%	14 Jan 2020
CVE-2020-0632 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,75%	14 Jan 2020
CVE-2020-0633 microsoft windows 10, microsoft windows server 2016 +1 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0634 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File Sy...	7.8 High	—	1,2%	14 Jan 2020
CVE-2020-0635 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Privilege Vuln...	7.8 High	—	1,1%	14 Jan 2020
CVE-2020-0636 microsoft windows 10, microsoft windows server 2016 An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for Linux Elevation of Privilege Vuln...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0637 microsoft windows server 2008, microsoft windows server 2012 +2 lainnya An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote Desktop Web Access Information Disclo...	6.5 Medium	—	5,0%	14 Jan 2020
CVE-2020-0638 microsoft windows 10 1709, microsoft windows 10 1803 +7 lainnya An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gai...	7.8 High	KEV · ransomware	2,4%	14 Jan 2020
CVE-2020-0639 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory, aka 'Windows Common...	5.5 Medium	—	1,3%	14 Jan 2020
CVE-2020-0640 microsoft internet explorer A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.	7.5 High	—	8,6%	14 Jan 2020
CVE-2020-0641 microsoft windows 10, microsoft windows 8.1 +4 lainnya An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the vulnerability, an attacker would f...	7.8 High	—	0,92%	14 Jan 2020
CVE-2020-0642 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	—	1,5%	14 Jan 2020
CVE-2020-0643 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory, allowing an attacker to retrie...	5.5 Medium	—	1,3%	14 Jan 2020
CVE-2020-0614 microsoft windows 10, microsoft windows 8.1 +4 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0615 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory, aka 'Windows Common...	5.5 Medium	—	1,7%	14 Jan 2020
CVE-2020-0616 microsoft windows 10, microsoft windows server 2016 +1 lainnya A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'.	5.5 Medium	—	1,7%	14 Jan 2020
CVE-2020-0617 microsoft windows 10, microsoft windows server 2016 +1 lainnya A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privileged user on a guest operating...	6.0 Medium	—	1,3%	14 Jan 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.