Katalog CVE (hal. 5142)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.565 (Critical 35.800 · High 103.006 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 14 Okt 2026, 18:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 257.051–257.100 dari 257.565 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-3010 oracle solaris Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability al...	8.8 High	KEV	13,4%	16 Okt 2019
CVE-2019-16278 nazgul nostromo nhttpd Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.	9.8 Critical	KEV	99,0%	14 Okt 2019
CVE-2019-2215 google android, debian linux +51 lainnya A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, howe...	7.8 High	KEV	72,1%	11 Okt 2019
CVE-2019-1322 microsoft windows 10 1803, microsoft windows 10 1809 +4 lainnya An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This...	7.8 High	KEV · ransomware	19,2%	10 Okt 2019
CVE-2019-1315 microsoft windows 10 1607, microsoft windows 10 1703 +11 lainnya An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privi...	7.8 High	KEV · ransomware	3,5%	10 Okt 2019
CVE-2019-16928 exim, canonical ubuntu linux +2 lainnya Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c...	9.8 Critical	KEV	41,6%	27 Sep 2019
CVE-2019-16920 dlink dir-655 firmware, dlink dir-866l firmware +8 lainnya Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary i...	9.8 Critical	KEV	100,0%	27 Sep 2019
CVE-2019-16759 vbulletin vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.	9.8 Critical	KEV	99,7%	24 Sep 2019
CVE-2019-1367 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...	7.5 High	KEV · ransomware	52,4%	23 Sep 2019
CVE-2019-16057 dlink dns-320 firmware The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.	9.8 Critical	KEV · ransomware	86,5%	16 Sep 2019
CVE-2019-16256 trustedconnectivityalliance s@t browser Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information,...	9.8 Critical	KEV	4,9%	12 Sep 2019
CVE-2019-1297 microsoft excel, microsoft office +1 lainnya A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Ex...	8.8 High	KEV	21,8%	11 Sep 2019
CVE-2019-1253 microsoft windows 10 1703, microsoft windows 10 1709 +6 lainnya An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first...	7.8 High	KEV · ransomware	11,6%	11 Sep 2019
CVE-2019-1214 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File Sy...	7.8 High	KEV	1,4%	11 Sep 2019
CVE-2019-1215 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This C...	7.8 High	KEV · ransomware	19,3%	11 Sep 2019
CVE-2019-15949 nagios xi Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web inte...	8.8 High	KEV	77,0%	5 Sep 2019
CVE-2019-13608 citrix storefront server Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.	7.5 High	KEV · ransomware	30,0%	29 Agt 2019
CVE-2019-15752 docker, apache geode Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\Docker...	7.8 High	KEV	48,6%	28 Agt 2019
CVE-2019-15107 webmin An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.	9.8 Critical	KEV · ransomware	99,7%	16 Agt 2019
CVE-2019-0344 sap commerce cloud Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code...	9.8 Critical	KEV	7,1%	14 Agt 2019
CVE-2019-11581 atlassian jira server There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to...	9.8 Critical	KEV	84,6%	9 Agt 2019
CVE-2019-0193 apache solr, debian linux In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration...	7.2 High	KEV	83,5%	1 Agt 2019
CVE-2019-11707 mozilla firefox, mozilla thunderbird A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targete...	8.8 High	KEV	37,7%	23 Jul 2019
CVE-2019-11708 mozilla firefox, mozilla thunderbird Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web c...	10.0 Critical	KEV	55,9%	23 Jul 2019
CVE-2019-1579 paloaltonetworks pan-os Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interfac...	8.1 High	KEV · ransomware	46,2%	19 Jul 2019
CVE-2019-13272 linux kernel, debian linux +20 lainnya In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, whi...	7.8 High	KEV	52,2%	17 Jul 2019
CVE-2019-12991 citrix netscaler sd-wan, citrix sd-wan Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).	8.8 High	KEV	74,1%	16 Jul 2019
CVE-2019-12989 citrix netscaler sd-wan, citrix sd-wan Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.	9.8 Critical	KEV	95,0%	16 Jul 2019
CVE-2019-1130 microsoft windows 10 1507, microsoft windows 10 1607 +12 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	1,7%	15 Jul 2019
CVE-2019-1132 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	9,9%	15 Jul 2019
CVE-2019-1129 microsoft windows 10 1703, microsoft windows 10 1709 +6 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	1,8%	15 Jul 2019
CVE-2019-1068 Advisory microsoft sql server, microsoft sql server 2016 +1 lainnya A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code E...	8.8 High	KEV	57,3%	15 Jul 2019
CVE-2019-0880 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.	7.8 High	KEV	2,3%	15 Jul 2019
CVE-2018-15811 dnnsoftware dotnetnuke DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.	7.5 High	KEV	76,1%	3 Jul 2019
CVE-2018-18325 dnnsoftware dotnetnuke DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-158...	7.5 High	KEV	73,9%	3 Jul 2019
CVE-2019-7256 nortekcontrol linear emerge essential firmware, nortekcontrol linear emerge elite firmware Linear eMerge E3-Series devices allow Command Injections.	9.8 Critical	KEV	97,1%	2 Jul 2019
CVE-2019-5786 google chrome Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pag...	6.5 Medium	KEV	61,1%	27 Jun 2019
CVE-2019-1064 microsoft windows 10 1607, microsoft windows 10 1703 +9 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this v...	7.8 High	KEV · ransomware	6,9%	12 Jun 2019
CVE-2019-1069 microsoft windows 10 1507, microsoft windows 10 1607 +9 lainnya An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnera...	7.8 High	KEV · ransomware	6,1%	12 Jun 2019
CVE-2010-5330 ui airos On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by...	9.8 Critical	KEV	39,4%	11 Jun 2019
CVE-2019-10149 exim, canonical ubuntu linux +1 lainnya A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote co...	9.8 Critical	KEV	100,0%	5 Jun 2019
CVE-2018-13379 fortinet fortiproxy, fortinet fortios An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2....	9.8 Critical	KEV · ransomware	100,0%	4 Jun 2019
CVE-2018-13382 fortinet fortiproxy, fortinet fortios An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0...	7.5 High	KEV · ransomware	81,7%	4 Jun 2019
CVE-2019-11580 atlassian crowd Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated...	9.8 Critical	KEV · ransomware	95,4%	3 Jun 2019
CVE-2019-9874 sitecore cms, sitecore experience platform Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated...	9.8 Critical	KEV	83,7%	31 Mei 2019
CVE-2019-9875 sitecore cms Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET...	8.8 High	KEV	13,8%	31 Mei 2019
CVE-2019-9670 synacor zimbra collaboration suite mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/...	9.8 Critical	KEV	100,0%	29 Mei 2019
CVE-2018-13383 fortinet fortiproxy, fortinet fortios A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in...	6.5 Medium	KEV · ransomware	33,6%	29 Mei 2019
CVE-2018-7841 schneider-electric u.motion builder A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is e...	9.8 Critical	KEV	72,7%	22 Mei 2019
CVE-2019-11634 citrix receiver, citrix workspace Citrix Workspace App before 1904 for Windows has Incorrect Access Control.	9.8 Critical	KEV · ransomware	8,1%	22 Mei 2019

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.