Katalog CVE (hal. 5143)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.565 (Critical 35.800 · High 103.006 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 14 Okt 2026, 18:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 257.101–257.150 dari 257.565 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-0903 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vu...	8.8 High	KEV	21,7%	16 Mei 2019
CVE-2019-0708 microsoft windows 7, microsoft windows server 2008 +52 lainnya A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system...	9.8 Critical	KEV · ransomware	100,0%	16 Mei 2019
CVE-2019-0863 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.	7.8 High	KEV	5,2%	16 Mei 2019
CVE-2018-14839 lg n1a1 firmware LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.	9.8 Critical	KEV	89,4%	14 Mei 2019
CVE-2019-3568 whatsapp, whatsapp business A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue...	9.8 Critical	KEV	30,1%	14 Mei 2019
CVE-2019-11510 ivanti connect secure In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafte...	10.0 Critical	KEV · ransomware	100,0%	8 Mei 2019
CVE-2018-4063 sierrawireless aleos An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can...	8.8 High	KEV	27,1%	6 Mei 2019
CVE-2017-18368 billion 5200w-t firmware, zyxel p660hn-t1a v2 firmware +1 lainnya The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forward...	9.8 Critical	KEV	94,4%	2 Mei 2019
CVE-2019-3929 crestron am-100 firmware, crestron am-101 firmware +10 lainnya The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19,...	9.8 Critical	KEV	99,0%	30 Apr 2019
CVE-2019-9621 synacor zimbra collaboration suite Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServ...	7.5 High	KEV	81,0%	30 Apr 2019
CVE-2019-2725 oracle agile product lifecycle management, oracle communications converged application server +6 lainnya Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12...	9.8 Critical	KEV · ransomware	100,0%	26 Apr 2019
CVE-2019-11539 ivanti connect secure In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version...	7.2 High	KEV · ransomware	98,5%	26 Apr 2019
CVE-2019-2616 oracle business intelligence publisher Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affect...	7.2 High	KEV	92,2%	23 Apr 2019
CVE-2019-3398 atlassian confluence server Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pa...	8.8 High	KEV	97,0%	18 Apr 2019
CVE-2019-0859 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	4,2%	9 Apr 2019
CVE-2019-0803 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	45,2%	9 Apr 2019
CVE-2019-0841 microsoft windows 10 1703, microsoft windows 10 1709 +4 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	41,4%	9 Apr 2019
CVE-2019-0752 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...	7.5 High	KEV · ransomware	81,7%	9 Apr 2019
CVE-2019-0797 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	1,9%	9 Apr 2019
CVE-2019-0808 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	53,0%	9 Apr 2019
CVE-2019-0703 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Th...	6.5 Medium	KEV	9,6%	9 Apr 2019
CVE-2019-0211 apache http server, fedoraproject fedora +21 lainnya In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts ex...	7.8 High	KEV	65,0%	8 Apr 2019
CVE-2019-11001 reolink rlc-410w firmware, reolink c1 pro firmware +3 lainnya On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS com...	7.2 High	KEV	37,5%	8 Apr 2019
CVE-2018-4344 apple iphone os, apple mac os x +2 lainnya A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.	7.8 High	KEV	2,4%	3 Apr 2019
CVE-2019-5418 rubyonrails rails, debian linux +4 lainnya There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents o...	7.5 High	KEV	98,5%	27 Mar 2019
CVE-2019-10068 kentico xperience An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, i...	9.8 Critical	KEV	95,1%	26 Mar 2019
CVE-2019-7609 elastic kibana, redhat openshift container platform Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could sen...	10.0 Critical	KEV	95,3%	25 Mar 2019
CVE-2019-3396 atlassian confluence server The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.1...	9.8 Critical	KEV · ransomware	99,9%	25 Mar 2019
CVE-2019-9978 warfareplugins social warfare, warfareplugins social warfare pro The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in...	6.1 Medium	KEV	72,9%	24 Mar 2019
CVE-2019-7238 sonatype nexus repository manager Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.	9.8 Critical	KEV	77,1%	21 Mar 2019
CVE-2019-1003029 jenkins script security, redhat openshift container platform A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbo...	9.9 Critical	KEV	74,4%	8 Mar 2019
CVE-2019-1003030 jenkins pipeline, redhat openshift container platform A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java...	9.9 Critical	KEV	97,1%	8 Mar 2019
CVE-2018-18809 tibco jasperreports library, tibco jasperreports server +2 lainnya The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for Act...	6.5 Medium	KEV	79,1%	7 Mar 2019
CVE-2019-0676 microsoft internet explorer An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could...	6.5 Medium	KEV	8,1%	5 Mar 2019
CVE-2019-0604 microsoft sharepoint enterprise server, microsoft sharepoint foundation +1 lainnya A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoi...	9.8 Critical	KEV · ransomware	99,9%	5 Mar 2019
CVE-2019-6223 apple iphone os, apple mac os x A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10....	7.5 High	KEV	2,6%	5 Mar 2019
CVE-2019-9082 thinkphp, opensourcebms open source background management system +1 lainnya ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_...	8.8 High	KEV	97,4%	24 Feb 2019
CVE-2019-6340 drupal Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code exe...	8.1 High	KEV	92,0%	21 Feb 2019
CVE-2019-8394 zohocorp manageengine servicedesk plus Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.	6.5 Medium	KEV	63,3%	17 Feb 2019
CVE-2018-20250 rarlab winrar In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filena...	7.8 High	KEV · ransomware	96,0%	5 Feb 2019
CVE-2018-20753 kaseya virtual system administrator Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devi...	9.8 Critical	KEV · ransomware	29,6%	5 Feb 2019
CVE-2017-18362 connectwise manageditsync ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA databas...	9.8 Critical	KEV · ransomware	86,8%	5 Feb 2019
CVE-2019-1653 cisco rv320 firmware, cisco rv325 firmware A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker...	7.5 High	KEV	99,9%	24 Jan 2019
CVE-2019-1652 cisco rv320 firmware, cisco rv325 firmware A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker w...	7.2 High	KEV	95,9%	24 Jan 2019
CVE-2018-13374 fortinet fortiadc, fortinet fortios A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login cred...	4.3 Medium	KEV · ransomware	38,1%	22 Jan 2019
CVE-2018-15982 adobe flash player, redhat enterprise linux desktop +3 lainnya Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code executi...	7.8 High	KEV · ransomware	89,6%	18 Jan 2019
CVE-2019-0541 microsoft internet explorer, microsoft excel viewer +3 lainnya A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This a...	8.8 High	KEV	53,2%	8 Jan 2019
CVE-2019-0543 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This...	7.8 High	KEV · ransomware	4,7%	8 Jan 2019
CVE-2018-19320 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes r...	7.8 High	KEV · ransomware	3,6%	21 Des 2018
CVE-2018-19321 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2...	7.8 High	KEV · ransomware	3,7%	21 Des 2018

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.