Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-19548
norton power eraser
Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise...
|
7.8 High | — | 0,39% | 14 Jan 2020 |
|
CVE-2015-1869
redhat automatic bug reporting tool
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages f...
|
7.8 High | — | 0,41% | 14 Jan 2020 |
|
CVE-2015-3147
redhat automatic bug reporting tool, redhat enterprise linux desktop +5 lainnya
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary fil...
|
6.5 Medium | — | 1,1% | 14 Jan 2020 |
|
CVE-2015-3150
redhat automatic bug reporting tool
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) Cho...
|
7.1 High | — | 0,40% | 14 Jan 2020 |
|
CVE-2015-3151
redhat automatic bug reporting tool
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via uns...
|
7.8 High | — | 0,56% | 14 Jan 2020 |
|
CVE-2015-3159
redhat automatic bug reporting tool
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-...
|
7.8 High | — | 0,39% | 14 Jan 2020 |
|
CVE-2019-12398
apache airflow
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arb...
|
4.8 Medium | — | 2,8% | 14 Jan 2020 |
|
CVE-2020-5852
f5 big-ip local traffic manager, f5 big-ip advanced firewall manager +11 lainnya
Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). This vulnerability affects TMM through a virtual serv...
|
7.5 High | — | 1,2% | 14 Jan 2020 |
|
CVE-2020-5853
f5 big-ip access policy manager
In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with sp...
|
5.4 Medium | — | 0,52% | 14 Jan 2020 |
|
CVE-2019-10995
abb cp651 firmware, abb cp651-web firmware +6 lainnya
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.
|
8.8 High | — | 0,73% | 14 Jan 2020 |
|
CVE-2015-2325
pcre, opensuse +2 lainnya
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash...
|
7.8 High | — | 1,6% | 14 Jan 2020 |
|
CVE-2015-2326
pcre, opensuse +2 lainnya
The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular...
|
5.5 Medium | — | 1,6% | 14 Jan 2020 |
|
CVE-2015-0558
adbglobal p.dga4001n firmware
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790" and the MAC address to gener...
|
5.3 Medium | — | 1,2% | 14 Jan 2020 |
|
CVE-2014-2271
wps office, huawei p2-6011 firmware
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS conne...
|
8.1 High | — | 1,5% | 14 Jan 2020 |
|
CVE-2014-7844
redhat enterprise linux desktop, redhat enterprise linux server +6 lainnya
BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
|
7.8 High | — | 1,6% | 14 Jan 2020 |
|
CVE-2014-4609
libav
Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute arbitrary cod...
|
8.8 High | — | 5,7% | 14 Jan 2020 |
|
CVE-2014-4610
ffmpeg
Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and...
|
8.8 High | — | 4,5% | 14 Jan 2020 |
|
CVE-2014-5138
iii sierra
Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows remote att...
|
7.5 High | — | 1,6% | 14 Jan 2020 |
|
CVE-2014-5238
open-xchange appsuite
XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and p...
|
7.8 High | — | 1,9% | 14 Jan 2020 |
|
CVE-2015-8366
libraw
Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code vi...
|
9.8 Critical | — | 5,1% | 14 Jan 2020 |
|
CVE-2015-8367
libraw
The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initializatio...
|
9.8 Critical | — | 5,6% | 14 Jan 2020 |
|
CVE-2020-5851
f5 big-ip local traffic manager, f5 big-ip advanced firewall manager +11 lainnya
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only imp...
|
4.6 Medium | — | 0,33% | 14 Jan 2020 |
|
CVE-2013-7185
daum potplayer
PotPlayer 1.5.40688: .avi File Memory Corruption
|
7.8 High | — | 2,8% | 14 Jan 2020 |
|
CVE-2019-12399
apache kafka, oracle banking corporate lending process management +11 lainnya
When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updat...
|
7.5 High | — | 3,9% | 14 Jan 2020 |
|
CVE-2019-0219
apache cordova inappbrowser, oracle instantis enterprisetrack +1 lainnya
A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
|
9.8 Critical | — | 7,8% | 14 Jan 2020 |
|
CVE-2013-2773
gonitro nitropdf
Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution
|
7.8 High | — | 0,42% | 14 Jan 2020 |
|
CVE-2014-9211
clickdesk
ClickDesk version 4.3 and below has persistent cross site scripting
|
6.1 Medium | — | 0,86% | 14 Jan 2020 |
|
CVE-2020-5194
cerberusftp ftp server
The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Impro...
|
5.4 Medium | — | 0,68% | 14 Jan 2020 |
|
CVE-2020-5196
cerberusftp ftp server
Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and...
|
8.1 High | — | 1,2% | 14 Jan 2020 |
|
CVE-2020-6958
yet another java service wrapper project yet another java service wrapper
An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate data from...
|
9.1 Critical | — | 2,4% | 14 Jan 2020 |
|
CVE-2020-6954
cayintech smp-pro4 firmware
An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the w...
|
6.5 Medium | — | 0,96% | 13 Jan 2020 |
|
CVE-2020-6955
cayintech smp-pro4 firmware
An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.
|
6.1 Medium | — | 0,70% | 13 Jan 2020 |
|
CVE-2019-19680
proofpoint enterprise protection
A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 and 8.14.2 respectively, allows...
|
8.8 High | — | 1,1% | 13 Jan 2020 |
|
CVE-2019-20142
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service.
|
4.3 Medium | — | 0,89% | 13 Jan 2020 |
|
CVE-2019-20143
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control.
|
5.3 Medium | — | 0,88% | 13 Jan 2020 |
|
CVE-2019-20144
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.
|
4.3 Medium | — | 0,69% | 13 Jan 2020 |
|
CVE-2020-6832
gitlab
An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from privat...
|
5.3 Medium | — | 0,93% | 13 Jan 2020 |
|
CVE-2020-5197
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.
|
4.3 Medium | — | 0,75% | 13 Jan 2020 |
|
CVE-2019-20145
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control.
|
4.3 Medium | — | 0,69% | 13 Jan 2020 |
|
CVE-2019-20146
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.
|
5.3 Medium | — | 1,1% | 13 Jan 2020 |
|
CVE-2019-20147
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.
|
5.3 Medium | — | 0,93% | 13 Jan 2020 |
|
CVE-2019-20148
gitlab
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.
|
5.3 Medium | — | 0,90% | 13 Jan 2020 |
|
CVE-2012-4750
ezhometech ezserver
A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, which could let a remote malicious user execute arbi...
|
9.8 Critical | — | 8,9% | 13 Jan 2020 |
|
CVE-2012-4760
safend data protector agent
A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges...
|
7.8 High | — | 0,48% | 13 Jan 2020 |
|
CVE-2012-4761
safend data protector agent
A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772, which could let a local m...
|
7.8 High | — | 0,48% | 13 Jan 2020 |
|
CVE-2019-19727
schedmd slurm, opensuse leap
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.
|
5.5 Medium | — | 0,35% | 13 Jan 2020 |
|
CVE-2019-19728
schedmd slurm, opensuse leap +1 lainnya
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.
|
7.5 High | — | 1,3% | 13 Jan 2020 |
|
CVE-2020-5390
pysaml2 project pysaml2, canonical ubuntu linux +1 lainnya
PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wra...
|
7.5 High | — | 1,2% | 13 Jan 2020 |
|
CVE-2020-6948
hashbrowncms hashbrown cms
A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the...
|
9.8 Critical | — | 2,8% | 13 Jan 2020 |
|
CVE-2020-6949
hashbrowncms hashbrown cms
A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's accoun...
|
8.8 High | — | 1,3% | 13 Jan 2020 |