Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2012-4030
chamilo lms
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
|
7.5 High | — | 1,3% | 10 Jan 2020 |
|
CVE-2020-6162
bftpd project bftpd
An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uninitialized value. The daemon crashes at startup in the...
|
9.1 Critical | — | 1,7% | 10 Jan 2020 |
|
CVE-2019-4508
ibm qradar security information and event manager
IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force ID: 164429.
|
7.8 High | — | 0,26% | 10 Jan 2020 |
|
CVE-2019-4559
ibm qradar security information and event manager
IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force...
|
5.3 Medium | — | 1,1% | 10 Jan 2020 |
|
CVE-2020-1766
otrs, debian linux
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special...
|
6.1 Medium | — | 1,2% | 10 Jan 2020 |
|
CVE-2020-1767
otrs, debian linux
Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the custome...
|
4.3 Medium | — | 1,2% | 10 Jan 2020 |
|
CVE-2020-1765
otrs, debian linux +2 lainnya
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTick...
|
5.3 Medium | — | 1,5% | 10 Jan 2020 |
|
CVE-2013-6231
eng spagobi
SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
|
8.8 High | — | 9,9% | 10 Jan 2020 |
|
CVE-2013-6430
pivotal software spring framework
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, w...
|
5.4 Medium | — | 1,8% | 10 Jan 2020 |
|
CVE-2013-7380
ep imageconvert project ep imageconvert
The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
|
9.8 Critical | — | 2,2% | 10 Jan 2020 |
|
CVE-2014-4561
ultimate-weather project ultimate-weather
The ultimate-weather plugin 1.0 for WordPress has XSS
|
6.1 Medium | — | 3,8% | 10 Jan 2020 |
|
CVE-2014-5092
status2k
Status2k allows Remote Command Execution in admin/options/editpl.php.
|
8.8 High | — | 7,1% | 10 Jan 2020 |
|
CVE-2014-5093
status2k
Status2k does not remove the install directory allowing credential reset.
|
9.8 Critical | — | 3,8% | 10 Jan 2020 |
|
CVE-2011-4595
caseproof prettylinks
Pretty-Link WordPress plugin 1.5.2 has XSS
|
6.1 Medium | — | 2,4% | 10 Jan 2020 |
|
CVE-2014-5081
sphider, sphiderpro sphider pro +1 lainnya
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
|
9.8 Critical | — | 10,5% | 10 Jan 2020 |
|
CVE-2014-4530
flog project flog
flog plugin 0.1 for WordPress has XSS
|
6.1 Medium | — | 0,94% | 10 Jan 2020 |
|
CVE-2014-4982
xorux lpar2rrd
LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
|
9.8 Critical | — | 4,6% | 10 Jan 2020 |
|
CVE-2014-4984
dejavuprotech crescendo - sales crm
Déjà Vu Crescendo Sales CRM has remote SQL Injection
|
9.8 Critical | — | 3,0% | 10 Jan 2020 |
|
CVE-2014-5011
dompdf project dompdf
DOMPDF before 0.6.2 allows Information Disclosure.
|
6.5 Medium | — | 1,5% | 10 Jan 2020 |
|
CVE-2014-5012
dompdf project dompdf
DOMPDF before 0.6.2 allows denial of service.
|
6.5 Medium | — | 1,2% | 10 Jan 2020 |
|
CVE-2014-5013
dompdf project dompdf
DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
|
8.8 High | — | 4,5% | 10 Jan 2020 |
|
CVE-2019-20375
psi electronic logbook
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a...
|
6.1 Medium | — | 0,78% | 10 Jan 2020 |
|
CVE-2019-20376
psi electronic logbook
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to...
|
6.1 Medium | — | 0,78% | 10 Jan 2020 |
|
CVE-2019-20373
debian linux, ltsp ldm
LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax...
|
7.8 High | — | 0,44% | 9 Jan 2020 |
|
CVE-2019-20374
typora
A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks....
|
9.6 Critical | — | 2,3% | 9 Jan 2020 |
|
CVE-2020-6756
rasilient pixelstor 5000 firmware
languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter.
|
9.8 Critical | — | 10,6% | 9 Jan 2020 |
|
CVE-2020-6757
rasilient pixelstor 5000 firmware
contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute code via the name parameter.
|
8.8 High | — | 1,4% | 9 Jan 2020 |
|
CVE-2020-6758
rasilient pixelstor 5000 firmware
A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitr...
|
6.1 Medium | — | 0,79% | 9 Jan 2020 |
|
CVE-2020-5504
phpmyadmin, suse linux enterprise server +1 lainnya
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username w...
|
8.8 High | — | 38,8% | 9 Jan 2020 |
|
CVE-2019-20179
soplanning
SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
|
8.8 High | — | 1,0% | 9 Jan 2020 |
|
CVE-2019-20181
getawesomesupport awesome support
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
|
4.8 Medium | — | 0,72% | 9 Jan 2020 |
|
CVE-2019-20182
fooplugins foogallery
The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
|
4.8 Medium | — | 0,72% | 9 Jan 2020 |
|
CVE-2019-20183
employee records system project employee records system
uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacke...
|
7.2 High | — | 7,8% | 9 Jan 2020 |
|
CVE-2019-20184
keepass
KeePass 2.4.1 allows CSV injection in the title field of a CSV export.
|
7.8 High | — | 1,6% | 9 Jan 2020 |
|
CVE-2019-20178
peel shopping
Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.
|
6.5 Medium | — | 0,43% | 9 Jan 2020 |
|
CVE-2012-2950
gatewaygeomatics mapserver
Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensit...
|
8.1 High | — | 2,4% | 9 Jan 2020 |
|
CVE-2012-3806
samsung kies
Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a denial of service.
|
7.5 High | — | 3,7% | 9 Jan 2020 |
|
CVE-2012-3807
samsung kies
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
|
9.8 Critical | — | 31,6% | 9 Jan 2020 |
|
CVE-2012-3808
samsung kies
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
|
7.5 High | — | 5,0% | 9 Jan 2020 |
|
CVE-2012-3809
samsung kies
Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
|
7.5 High | — | 5,0% | 9 Jan 2020 |
|
CVE-2012-3810
samsung kies
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
|
7.5 High | — | 5,0% | 9 Jan 2020 |
|
CVE-2019-20372
f5 nginx, apple xcode +3 lainnya
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages i...
|
5.3 Medium | — | 15,0% | 9 Jan 2020 |
|
CVE-2019-20180
tablepress
The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility...
|
6.8 Medium | — | 2,3% | 9 Jan 2020 |
|
CVE-2019-18859
digi anywhereusb/14 firmware
Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.
|
6.1 Medium | — | 2,4% | 9 Jan 2020 |
|
CVE-2012-2226
invisioncommunity invision power board
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by up...
|
9.8 Critical | — | 7,4% | 9 Jan 2020 |
|
CVE-2012-2931
tinywebgallery
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file.
|
7.2 High | — | 1,4% | 9 Jan 2020 |
|
CVE-2012-3490
wisc htcondor
The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in Condor 7.6.x...
|
8.8 High | — | 3,6% | 9 Jan 2020 |
|
CVE-2012-4434
cipherdyne fwknop
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.
|
8.8 High | — | 3,3% | 9 Jan 2020 |
|
CVE-2012-5558
smiley project smiley, smileys project smileys
Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows rem...
|
4.8 Medium | — | 0,96% | 9 Jan 2020 |
|
CVE-2012-1915
codeigniter
EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
|
6.1 Medium | — | 1,9% | 9 Jan 2020 |