Katalog CVE (hal. 5136)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.870 (Critical 35.834 · High 103.117 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 256.751–256.800 dari 257.870 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-0620 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Microsoft Cryptographic Services Elevation of Privileg...	7.8 High	—	0,75%	14 Jan 2020
CVE-2020-0621 microsoft windows 10, microsoft windows server 2016 +1 lainnya A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Security Feature Bypass Vulnerabil...	4.4 Medium	—	0,97%	14 Jan 2020
CVE-2020-0622 microsoft windows 10, microsoft windows server 2016 An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Component Infor...	5.5 Medium	—	1,3%	14 Jan 2020
CVE-2020-0623 microsoft windows 10, microsoft windows 7 +5 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0624 microsoft windows 10, microsoft windows server 2016 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	—	1,9%	14 Jan 2020
CVE-2020-0625 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0626 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,75%	14 Jan 2020
CVE-2020-0627 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0628 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,81%	14 Jan 2020
CVE-2020-0629 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,75%	14 Jan 2020
CVE-2020-0630 microsoft windows 10, microsoft windows 7 +6 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,75%	14 Jan 2020
CVE-2020-0601 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerab...	8.1 High	KEV	89,4%	14 Jan 2020
CVE-2020-0602 microsoft asp.net core, redhat enterprise linux +1 lainnya A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.	7.5 High	—	7,6%	14 Jan 2020
CVE-2020-0603 microsoft asp.net core, redhat enterprise linux +1 lainnya A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulne...	8.8 High	—	21,0%	14 Jan 2020
CVE-2020-0605 microsoft .net framework, microsoft .net core A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vuln...	8.8 High	—	17,8%	14 Jan 2020
CVE-2020-0606 microsoft .net framework, microsoft .net core A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vuln...	8.8 High	—	17,2%	14 Jan 2020
CVE-2020-0607 microsoft windows 10, microsoft windows 7 +5 lainnya An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disc...	5.5 Medium	—	5,9%	14 Jan 2020
CVE-2020-0608 microsoft windows 10, microsoft windows 7 +6 lainnya An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.	5.5 Medium	—	1,3%	14 Jan 2020
CVE-2020-0609 microsoft windows server 2012, microsoft windows server 2016 +1 lainnya A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and s...	9.8 Critical	—	77,7%	14 Jan 2020
CVE-2020-0610 microsoft windows server 2012, microsoft windows server 2016 +1 lainnya A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and s...	9.8 Critical	—	67,6%	14 Jan 2020
CVE-2020-0611 microsoft windows 10, microsoft windows 7 +6 lainnya A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execu...	7.5 High	—	6,7%	14 Jan 2020
CVE-2020-0612 microsoft windows server 2016, microsoft windows server 2019 A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends specially craft...	7.5 High	—	4,6%	14 Jan 2020
CVE-2020-0613 microsoft windows 10, microsoft windows 8.1 +4 lainnya An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vu...	7.8 High	—	0,85%	14 Jan 2020
CVE-2020-7057 hikvision ds-7204hghi-f1 firmware Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on wh...	5.3 Medium	—	1,1%	14 Jan 2020
CVE-2011-2714 drupal data, drupal A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before...	6.1 Medium	—	1,2%	14 Jan 2020
CVE-2011-2715 drupal data, drupal An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.	9.8 Critical	—	1,1%	14 Jan 2020
CVE-2011-3183 concretecms concrete cms A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.	6.1 Medium	—	0,69%	14 Jan 2020
CVE-2011-3202 jcow cms A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.	6.1 Medium	—	0,80%	14 Jan 2020
CVE-2018-1002104 kubernetes nginx ingress controller Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.	5.3 Medium	—	1,1%	14 Jan 2020
CVE-2016-6592 symantec norton download manager A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on the target...	7.8 High	—	0,96%	14 Jan 2020
CVE-2020-7053 linux kernel In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close funct...	7.8 High	—	0,62%	14 Jan 2020
CVE-2020-7054 mz-automation libiec61850 MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing the MMS_BIT_STRING data type.	8.8 High	—	1,1%	14 Jan 2020
CVE-2011-2706 snewscms snews A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.	6.1 Medium	—	0,70%	14 Jan 2020
CVE-2011-2933 websitebaker An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php...	7.2 High	—	1,1%	14 Jan 2020
CVE-2011-2934 websitebaker A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive tra...	8.8 High	—	0,50%	14 Jan 2020
CVE-2011-3203 jcow cms A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.	9.8 Critical	—	2,4%	14 Jan 2020
CVE-2019-16784 pyinstaller In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "one...	7.8 High	—	0,70%	14 Jan 2020
CVE-2019-13722 google chrome Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	6.5 Medium	—	1,0%	14 Jan 2020
CVE-2019-3981 mikrotik routeros, mikrotik winbox MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's u...	3.7 Low	—	1,1%	14 Jan 2020
CVE-2020-5180 sparklabs viscosity Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of t...	7.8 High	—	0,40%	14 Jan 2020
CVE-2020-5505 vaaip freelancy Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to the /api/file...	9.8 Critical	—	44,3%	14 Jan 2020
CVE-2020-5509 phpgurukul car rental portal PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.	7.2 High	—	5,8%	14 Jan 2020
CVE-2020-6173 linuxfoundation the update framework TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.	5.3 Medium	—	1,8%	14 Jan 2020
CVE-2019-13537 aveva iec870ip firmware The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a se...	7.5 High	—	1,3%	14 Jan 2020
CVE-2020-6306 sap leasing Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17).	2.7 Low	—	0,60%	14 Jan 2020
CVE-2020-6307 sap basis Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks lead...	4.3 Medium	—	0,72%	14 Jan 2020
CVE-2020-6303 sap disclosure management SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.	5.4 Medium	—	0,54%	14 Jan 2020
CVE-2020-6304 sap netweaver internet communication manager (kernel), sap netweaver internet communication manager (krnl32nuc) +3 lainnya Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21,...	7.5 High	—	1,5%	14 Jan 2020
CVE-2020-6305 sap process integration PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scr...	6.1 Medium	—	0,76%	14 Jan 2020
CVE-2020-5193 phpgurukul hospital management system PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter.	6.1 Medium	—	0,92%	14 Jan 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.