Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2012-2142
freedesktop poppler, xpdfreader xpdf +2 lainnya
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emula...
|
7.8 High | — | 2,9% | 9 Jan 2020 |
|
CVE-2010-3282
hp-ux directory server, redhat directory server +1 lainnya
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Man...
|
3.3 Low | — | 0,26% | 9 Jan 2020 |
|
CVE-2019-6319
hp deskjet 3630 f5s43a firmware, hp deskjet 3630 f5s57a firmware +6 lainnya
HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-S...
|
8.1 High | — | 0,56% | 9 Jan 2020 |
|
CVE-2016-5311
symantec endpoint protection, symantec endpoint protection cloud +7 lainnya
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Secu...
|
7.8 High | — | 0,71% | 9 Jan 2020 |
|
CVE-2020-6166
webfactoryltd minimal coming soon & maintenance mode
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenanc...
|
5.4 Medium | — | 1,1% | 9 Jan 2020 |
|
CVE-2020-6168
webfactoryltd minimal coming soon & maintenance mode
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode s...
|
7.6 High | — | 2,0% | 9 Jan 2020 |
|
CVE-2020-6750
gnome glib, fedoraproject fedora
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, becaus...
|
5.9 Medium | — | 2,2% | 9 Jan 2020 |
|
CVE-2012-1261
plixer scrutinizer netflow & sflow analyzer
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and other versions...
|
6.1 Medium | — | 2,2% | 9 Jan 2020 |
|
CVE-2012-2714
browserid project browserid
The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifi...
|
9.8 Critical | — | 3,3% | 9 Jan 2020 |
|
CVE-2012-2724
md-systems simplenews
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list sub...
|
5.3 Medium | — | 2,5% | 9 Jan 2020 |
|
CVE-2012-1258
plixer scrutinizer netflow & sflow analyzer
cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to...
|
6.5 Medium | — | 3,3% | 9 Jan 2020 |
|
CVE-2012-1259
plixer scrutinizer netflow & sflow analyzer
Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow rem...
|
9.8 Critical | — | 4,2% | 9 Jan 2020 |
|
CVE-2012-1260
plixer scrutinizer netflow & sflow analyzer
Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions be...
|
6.1 Medium | — | 2,3% | 9 Jan 2020 |
|
CVE-2020-1925
apache olingo
Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this...
|
7.5 High | — | 2,8% | 9 Jan 2020 |
|
CVE-2019-6320
hp deskjet 3630 f5s43a firmware, hp deskjet 3630 f5s57a firmware +6 lainnya
Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a...
|
8.1 High | — | 0,56% | 9 Jan 2020 |
|
CVE-2019-6330
hp access control
A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7. This vulnerability could potentially grant eleva...
|
9.8 Critical | — | 2,4% | 9 Jan 2020 |
|
CVE-2019-6331
hp samsung mobile print
An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application config...
|
3.3 Low | — | 0,39% | 9 Jan 2020 |
|
CVE-2019-6332
hp deskjet 2600 4uj28b firmware, hp deskjet 2600 v1n01a firmware +50 lainnya
A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be exploited to allow cross-site scripting (XSS). Affected...
|
4.8 Medium | — | 0,65% | 9 Jan 2020 |
|
CVE-2020-6167
webfactoryltd minimal coming soon & maintenance mode
A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important...
|
8.8 High | — | 0,92% | 9 Jan 2020 |
|
CVE-2020-1786
huawei mate 20 pro firmware
HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability. The software does not sufficiently validate the...
|
4.6 Medium | — | 0,25% | 9 Jan 2020 |
|
CVE-2020-1810
huawei cloudengine 12800 firmware, huawei s5700 firmware +1 lainnya
There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorithm which have been considered...
|
5.3 Medium | — | 0,45% | 9 Jan 2020 |
|
CVE-2020-1787
huawei mate 20 firmware
HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certain scenario...
|
6.6 Medium | — | 0,26% | 9 Jan 2020 |
|
CVE-2020-1826
huawei honor magic2 firmware
Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encryption tool, a...
|
4.4 Medium | — | 0,11% | 9 Jan 2020 |
|
CVE-2019-4651
ibm jazz reporting service
IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to...
|
9.8 Critical | — | 1,4% | 9 Jan 2020 |
|
CVE-2019-14919
billion sg600 r2 firmware
An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded credentials int...
|
7.8 High | — | 1,5% | 9 Jan 2020 |
|
CVE-2019-14920
billion sg600 r2 firmware
Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/web/adm/syst...
|
8.8 High | — | 2,2% | 9 Jan 2020 |
|
CVE-2019-14918
billion sg600 r2 firmware
XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client...
|
5.4 Medium | — | 0,78% | 9 Jan 2020 |
|
CVE-2019-20224
artica pandora fms
netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src...
|
8.8 High | — | 49,7% | 9 Jan 2020 |
|
CVE-2019-19332
linux kernel, redhat enterprise linux
An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CP...
|
6.1 Medium | — | 0,68% | 9 Jan 2020 |
|
CVE-2014-3211
publify
Publify before 8.0.1 is vulnerable to a Denial of Service attack
|
7.5 High | — | 1,1% | 9 Jan 2020 |
|
CVE-2014-3447
bss continuity cms project bss continuty cms
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
|
7.5 High | — | 1,8% | 9 Jan 2020 |
|
CVE-2014-3448
bss continuity cms project bss continuty cms
BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
|
9.8 Critical | — | 4,0% | 9 Jan 2020 |
|
CVE-2014-3449
bss continuity cms project bss continuty cms
BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
|
9.8 Critical | — | 2,7% | 9 Jan 2020 |
|
CVE-2014-3753
1password
AgileBits 1Password through 1.0.9.340 allows security feature bypass
|
5.5 Medium | — | 0,89% | 9 Jan 2020 |
|
CVE-2020-5308
phpgurukul dairy farm shop management system
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName pa...
|
6.1 Medium | — | 1,3% | 9 Jan 2020 |
|
CVE-2014-2650
atos openstage 80 firmware, atos openstage 80 g firmware +13 lainnya
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
|
9.8 Critical | — | 2,6% | 9 Jan 2020 |
|
CVE-2014-2651
atos openstage 80 firmware, atos openstage 80 g firmware +12 lainnya
Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface
|
9.8 Critical | — | 1,7% | 9 Jan 2020 |
|
CVE-2014-2686
redhat ansible
Ansible prior to 1.5.4 mishandles the evaluation of some strings.
|
7.5 High | — | 1,2% | 9 Jan 2020 |
|
CVE-2019-19494
sagemcom f@st 3890 firmware, sagemcom f@st 3686 firmware +5 lainnya
Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via...
|
8.8 High | — | 23,1% | 9 Jan 2020 |
|
CVE-2020-5205
powauth pow
In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug....
|
5.4 Medium | — | 0,77% | 9 Jan 2020 |
|
CVE-2020-6628
libming
Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
|
8.8 High | — | 1,5% | 9 Jan 2020 |
|
CVE-2020-6629
libming
Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.
|
6.5 Medium | — | 1,3% | 9 Jan 2020 |
|
CVE-2020-6630
gpac
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_data_size() in isomedia/isom_read.c.
|
5.5 Medium | — | 0,78% | 9 Jan 2020 |
|
CVE-2020-6631
gpac
An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_process_pmt() in media_tools/m2ts_mux.c.
|
5.5 Medium | — | 0,85% | 9 Jan 2020 |
|
CVE-2020-6632
prestashop
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header...
|
6.1 Medium | — | 0,68% | 9 Jan 2020 |
|
CVE-2020-6624
jhead project jhead
jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.
|
7.1 High | — | 1,4% | 9 Jan 2020 |
|
CVE-2020-6625
jhead project jhead
jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.
|
7.1 High | — | 1,4% | 9 Jan 2020 |
|
CVE-2019-11292
pivotal software operations manager
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access...
|
6.5 Medium | — | 1,1% | 9 Jan 2020 |
|
CVE-2011-5018
koala-framework koala framework
Koala Framework before 2011-11-21 has XSS via the request_uri parameter.
|
6.1 Medium | — | 1,0% | 8 Jan 2020 |
|
CVE-2011-5247
prophecyinternational snare
Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword.
|
7.5 High | — | 1,1% | 8 Jan 2020 |