Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-14862
knockoutjs knockout, redhat decision manager +3 lainnya
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users al...
|
6.1 Medium | — | 2,1% | 2 Jan 2020 |
|
CVE-2019-14863
angularjs, redhat decision manager +1 lainnya
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its us...
|
6.1 Medium | — | 1,2% | 2 Jan 2020 |
|
CVE-2019-14864
redhat ansible, redhat ansible tower +6 lainnya
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Spl...
|
6.5 Medium | — | 1,9% | 2 Jan 2020 |
|
CVE-2019-14859
python-ecdsa project python-ecdsa, redhat ceph storage +2 lainnya
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malforme...
|
9.1 Critical | — | 1,5% | 2 Jan 2020 |
|
CVE-2019-10158
infinispan, redhat jboss data grid
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in...
|
9.8 Critical | — | 2,0% | 2 Jan 2020 |
|
CVE-2019-10775
ecstatic project ecstatic
ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
|
7.5 High | — | 1,3% | 2 Jan 2020 |
|
CVE-2013-3935
opsview, opsview core
Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administr...
|
8.8 High | — | 0,54% | 2 Jan 2020 |
|
CVE-2013-3936
opsview, opsview core
Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to inject arbitrary web script or HTML...
|
6.1 Medium | — | 0,77% | 2 Jan 2020 |
|
CVE-2020-5179
comtech stampede fx-1010 firmware
Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering...
|
7.2 High | — | 2,8% | 2 Jan 2020 |
|
CVE-2019-20204
postieplugin postie
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
|
5.4 Medium | — | 3,4% | 2 Jan 2020 |
|
CVE-2019-20205
saitoha libsixel
libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.
|
8.8 High | — | 1,0% | 2 Jan 2020 |
|
CVE-2019-20208
gpac, debian linux
dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow.
|
5.5 Medium | — | 1,5% | 2 Jan 2020 |
|
CVE-2019-20213
dlink dir-859 firmware, dlink dir-822 firmware +12 lainnya
D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
|
7.5 High | — | 2,2% | 2 Jan 2020 |
|
CVE-2019-20218
sqlite, debian linux +2 lainnya
selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
|
7.5 High | — | 3,6% | 2 Jan 2020 |
|
CVE-2019-20220
sitracker support incident tracker
In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.
|
6.1 Medium | — | 0,67% | 2 Jan 2020 |
|
CVE-2019-20221
sitracker support incident tracker
In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page.
|
6.1 Medium | — | 0,67% | 2 Jan 2020 |
|
CVE-2019-20222
sitracker support incident tracker
In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.
|
6.1 Medium | — | 0,67% | 2 Jan 2020 |
|
CVE-2019-20223
sitracker support incident tracker
In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235.
|
6.1 Medium | — | 0,67% | 2 Jan 2020 |
|
CVE-2019-20203
postieplugin postie
The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
|
5.3 Medium | — | 2,1% | 2 Jan 2020 |
|
CVE-2019-17558
apache solr, oracle primavera unifier
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity...
|
7.5 High | KEV | 98,6% | 30 Des 2019 |
|
CVE-2019-17621
dlink dir-859 firmware, dlink dir-822 firmware +12 lainnya
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, b...
|
9.8 Critical | KEV | 89,6% | 30 Des 2019 |
|
CVE-2019-20085
tvt nvms-1000 firmware
TVT NVMS-1000 devices allow GET /.. Directory Traversal
|
7.5 High | KEV | 96,1% | 30 Des 2019 |
|
CVE-2019-19781
citrix application delivery controller firmware, citrix netscaler gateway firmware +1 lainnya
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
|
9.8 Critical | KEV · ransomware | 100,0% | 27 Des 2019 |
|
CVE-2019-10758
mongo-express project mongo-express
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands...
|
9.9 Critical | KEV | 84,7% | 24 Des 2019 |
|
CVE-2019-7483
sonicwall sma 100 firmware
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
|
7.5 High | KEV | 4,0% | 19 Des 2019 |
|
CVE-2019-8605
apple iphone os, apple mac os x +2 lainnya
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious applica...
|
7.8 High | KEV | 17,6% | 18 Des 2019 |
|
CVE-2019-8526
apple mac os x
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.
|
7.8 High | KEV | 0,70% | 18 Des 2019 |
|
CVE-2019-7286
apple iphone os, apple mac os x
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be...
|
7.8 High | KEV | 15,9% | 18 Des 2019 |
|
CVE-2019-7287
apple iphone os
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kerne...
|
7.8 High | KEV | 4,6% | 18 Des 2019 |
|
CVE-2019-8506
apple icloud, apple itunes +7 lainnya
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iClou...
|
8.8 High | KEV | 16,2% | 18 Des 2019 |
|
CVE-2019-4716
ibm planning analytics
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as ro...
|
9.8 Critical | KEV | 86,4% | 18 Des 2019 |
|
CVE-2019-7481
sonicwall sma 100 firmware
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and ear...
|
7.5 High | KEV · ransomware | 99,9% | 17 Des 2019 |
|
CVE-2019-18935
telerik ui for asp.net ajax
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryp...
|
9.8 Critical | KEV · ransomware | 99,7% | 11 Des 2019 |
|
CVE-2019-1458
microsoft windows 10 1507, microsoft windows 10 1607 +6 lainnya
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...
|
7.8 High | KEV · ransomware | 74,4% | 10 Des 2019 |
|
CVE-2019-5544
vmware horizon daas, vmware esxi
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range w...
|
9.8 Critical | KEV · ransomware | 97,3% | 6 Des 2019 |
|
CVE-2019-7193
qnap qts
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to thei...
|
9.8 Critical | KEV · ransomware | 14,4% | 5 Des 2019 |
|
CVE-2019-7194
qnap photo station
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo...
|
9.8 Critical | KEV · ransomware | 83,1% | 5 Des 2019 |
|
CVE-2019-7195
qnap photo station
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo...
|
9.8 Critical | KEV · ransomware | 89,5% | 5 Des 2019 |
|
CVE-2019-7192
qnap photo station
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo...
|
9.8 Critical | KEV · ransomware | 88,1% | 5 Des 2019 |
|
CVE-2019-15271
cisco rv016 multi-wan vpn firmware, cisco rv042 dual wan vpn firmware +2 lainnya
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary...
|
8.8 High | KEV | 5,5% | 26 Nov 2019 |
|
CVE-2019-5825
google chrome
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
6.5 Medium | KEV | 55,9% | 25 Nov 2019 |
|
CVE-2019-13720
google chrome, opensuse leap
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
|
8.8 High | KEV | 49,4% | 25 Nov 2019 |
|
CVE-2019-19006
sangoma freepbx
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
|
9.8 Critical | KEV | 55,9% | 21 Nov 2019 |
|
CVE-2019-6693
fortinet fortios
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the s...
|
6.5 Medium | KEV · ransomware | 6,6% | 21 Nov 2019 |
|
CVE-2019-1429
microsoft internet explorer
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...
|
7.5 High | KEV | 77,3% | 12 Nov 2019 |
|
CVE-2019-1405
microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service El...
|
7.8 High | KEV · ransomware | 30,2% | 12 Nov 2019 |
|
CVE-2019-1385
microsoft windows 10 1709, microsoft windows 10 1803 +4 lainnya
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.T...
|
7.8 High | KEV · ransomware | 3,6% | 12 Nov 2019 |
|
CVE-2019-1388
microsoft windows 10 1507, microsoft windows 10 1607 +12 lainnya
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevat...
|
7.8 High | KEV · ransomware | 8,6% | 12 Nov 2019 |
|
CVE-2019-18187
trendmicro officescan
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip...
|
7.5 High | KEV | 25,1% | 28 Okt 2019 |
|
CVE-2019-11043
php, canonical ubuntu linux +20 lainnya
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allo...
|
9.8 Critical | KEV · ransomware | 99,7% | 28 Okt 2019 |