Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2012-4767
safend data protector agent
An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, which could let a malicious user decrypt and potent...
|
6.1 Medium | — | 0,48% | 13 Jan 2020 |
|
CVE-2019-20210
cththemes citybook, cththemes easybook +1 lainnya
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
|
6.1 Medium | — | 3,2% | 13 Jan 2020 |
|
CVE-2019-20211
cththemes citybook, cththemes easybook +1 lainnya
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, List...
|
6.1 Medium | — | 2,6% | 13 Jan 2020 |
|
CVE-2019-20212
cththemes citybook, cththemes easybook +1 lainnya
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
|
6.1 Medium | — | 2,6% | 13 Jan 2020 |
|
CVE-2020-5195
cerberusftp ftp server
Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a cr...
|
6.1 Medium | — | 1,2% | 13 Jan 2020 |
|
CVE-2019-19891
mitel sip-dect firmware
An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful exploit may allo...
|
5.9 Medium | — | 0,32% | 13 Jan 2020 |
|
CVE-2019-20209
cththemes citybook, cththemes easybook +1 lainnya
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-...
|
7.5 High | — | 3,2% | 13 Jan 2020 |
|
CVE-2019-18893
avast secure browser, avg secure browser +1 lainnya
XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the con...
|
6.1 Medium | — | 1,8% | 13 Jan 2020 |
|
CVE-2019-18894
avast premium security
In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode func...
|
7.8 High | — | 1,8% | 13 Jan 2020 |
|
CVE-2020-6859
ultimatemember ultimate member
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attacker...
|
5.3 Medium | — | 2,2% | 13 Jan 2020 |
|
CVE-2019-19547
symantec endpoint detection and response, fedoraproject fedora
Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attacker...
|
6.1 Medium | — | 1,4% | 13 Jan 2020 |
|
CVE-2011-2670
mozilla firefox
Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets
|
6.1 Medium | — | 0,70% | 13 Jan 2020 |
|
CVE-2013-6225
livezilla
LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability
|
9.8 Critical | — | 26,6% | 13 Jan 2020 |
|
CVE-2014-9382
freebox os
Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation
|
6.5 Medium | — | 0,79% | 13 Jan 2020 |
|
CVE-2014-5381
granding grand ma300 firmware
Grand MA 300 allows a brute-force attack on the PIN.
|
9.8 Critical | — | 7,1% | 13 Jan 2020 |
|
CVE-2014-6038
zohocorp manageengine eventlog analyzer
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.
|
7.5 High | — | 72,8% | 13 Jan 2020 |
|
CVE-2014-6039
zohocorp manageengine eventlog analyzer
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.
|
7.5 High | — | 68,8% | 13 Jan 2020 |
|
CVE-2014-6059
vasyltech advanced access manager
WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability
|
7.2 High | — | 3,3% | 13 Jan 2020 |
|
CVE-2014-5380
granding grand ma300 firmware
Grand MA 300 allows retrieval of the access PIN from sniffed data.
|
7.5 High | — | 4,3% | 13 Jan 2020 |
|
CVE-2020-6860
symonics libmysofa, fedoraproject fedora
libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute.
|
8.8 High | — | 1,7% | 13 Jan 2020 |
|
CVE-2020-6851
uclouvain openjpeg, fedoraproject fedora +10 lainnya
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
|
7.5 High | — | 5,2% | 13 Jan 2020 |
|
CVE-2020-6848
axper vision ii firmware
Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI.
|
6.1 Medium | — | 0,67% | 13 Jan 2020 |
|
CVE-2020-6847
opentrade project opentrade
OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript.
|
5.4 Medium | — | 0,93% | 11 Jan 2020 |
|
CVE-2019-20377
tophub toplist
TopList before 2019-09-03 allows XSS via a title.
|
6.1 Medium | — | 0,65% | 11 Jan 2020 |
|
CVE-2020-6839
mruby
In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.
|
9.8 Critical | — | 1,4% | 11 Jan 2020 |
|
CVE-2020-6840
mruby
In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.
|
9.8 Critical | — | 1,5% | 11 Jan 2020 |
|
CVE-2020-6838
mruby
In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.
|
9.8 Critical | — | 1,5% | 11 Jan 2020 |
|
CVE-2019-20378
ganglia-web
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
|
6.1 Medium | — | 1,2% | 11 Jan 2020 |
|
CVE-2019-20379
ganglia-web
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
|
6.1 Medium | — | 0,92% | 11 Jan 2020 |
|
CVE-2020-6836
hot-formula-parser project hot-formula-parser
grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to...
|
9.8 Critical | — | 2,1% | 11 Jan 2020 |
|
CVE-2020-6377
google chrome, opensuse backports sle +5 lainnya
Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | — | 1,5% | 10 Jan 2020 |
|
CVE-2019-19475
zohocorp manageengine applications manager
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due t...
|
8.8 High | — | 2,6% | 10 Jan 2020 |
|
CVE-2019-13767
google chrome, opensuse backports sle +2 lainnya
Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corru...
|
8.8 High | — | 15,5% | 10 Jan 2020 |
|
CVE-2020-6835
bftpd project bftpd
An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking.
|
9.8 Critical | — | 2,0% | 10 Jan 2020 |
|
CVE-2012-4603
citrix receiver, citrix xenapp online
Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary code by convi...
|
7.8 High | — | 6,9% | 10 Jan 2020 |
|
CVE-2012-3821
arialsoftware campaign enterprise
A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify the SerialN...
|
4.3 Medium | — | 1,2% | 10 Jan 2020 |
|
CVE-2012-4284
sparklabs viscosity
A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a...
|
9.8 Critical | — | 69,5% | 10 Jan 2020 |
|
CVE-2011-5020
online tv database project online tv database
An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.
|
9.8 Critical | — | 1,0% | 10 Jan 2020 |
|
CVE-2019-18588
dell emc powermax, dell emc unisphere for powermax
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479....
|
5.4 Medium | — | 0,67% | 10 Jan 2020 |
|
CVE-2019-18194
totalav 2020
TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into...
|
7.8 High | — | 2,2% | 10 Jan 2020 |
|
CVE-2019-19817
gonitro nitro free pdf reader
The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-of-Bounds Read via crafted Uni...
|
5.5 Medium | — | 1,0% | 10 Jan 2020 |
|
CVE-2019-19819
gonitro nitropdf
The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereference via craf...
|
5.5 Medium | — | 1,0% | 10 Jan 2020 |
|
CVE-2019-14301
ricoh sp c250sf firmware, ricoh sp c252sf firmware +50 lainnya
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
|
7.5 High | — | 1,4% | 10 Jan 2020 |
|
CVE-2019-14302
ricoh sp c250sf firmware, ricoh sp c252sf firmware +58 lainnya
On Ricoh SP C250DN 1.06 devices, a debug port can be used.
|
6.8 Medium | — | 0,37% | 10 Jan 2020 |
|
CVE-2019-14304
ricoh sp c250sf firmware, ricoh sp c252sf firmware +50 lainnya
Ricoh SP C250DN 1.06 devices allow CSRF.
|
8.8 High | — | 0,71% | 10 Jan 2020 |
|
CVE-2019-14306
ricoh sp c250sf firmware, ricoh sp c252sf firmware +46 lainnya
Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
|
7.5 High | — | 1,4% | 10 Jan 2020 |
|
CVE-2019-19820
kyrol internet security
An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-o...
|
7.8 High | — | 0,65% | 10 Jan 2020 |
|
CVE-2012-3822
arialsoftware campaign enterprise
Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials.
|
7.5 High | — | 1,9% | 10 Jan 2020 |
|
CVE-2012-3823
arialsoftware campaign enterprise
Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
|
7.5 High | — | 1,5% | 10 Jan 2020 |
|
CVE-2012-3824
arialsoftware campaign enterprise
In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
|
7.5 High | — | 1,8% | 10 Jan 2020 |