Katalog CVE (hal. 5144)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.565 (Critical 35.800 · High 103.006 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 14 Okt 2026, 18:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 257.151–257.200 dari 257.565 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2018-19322 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2...	7.8 High	KEV · ransomware	1,8%	21 Des 2018
CVE-2018-19323 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes f...	9.8 Critical	KEV · ransomware	8,4%	21 Des 2018
CVE-2018-8653 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption...	7.5 High	KEV	29,6%	20 Des 2018
CVE-2018-8639 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	22,2%	12 Des 2018
CVE-2018-8611 microsoft windows 10 1607, microsoft windows 10 1703 +10 lainnya An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerabilit...	7.8 High	KEV	4,2%	12 Des 2018
CVE-2018-20062 5none nonecms An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as...	9.8 Critical	KEV	99,5%	11 Des 2018
CVE-2018-17480 google chrome, redhat enterprise linux desktop +3 lainnya Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacke...	8.8 High	KEV	35,6%	11 Des 2018
CVE-2018-1000861 jenkins, redhat openshift container platform A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/st...	9.8 Critical	KEV	98,3%	10 Des 2018
CVE-2018-19410 paessler prtg network monitor PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenti...	9.8 Critical	KEV	97,9%	21 Nov 2018
CVE-2018-6065 google chrome, redhat enterprise linux desktop +4 lainnya Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attac...	8.8 High	KEV	60,3%	14 Nov 2018
CVE-2018-17463 google chrome, redhat enterprise linux desktop +3 lainnya Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...	8.8 High	KEV	84,6%	14 Nov 2018
CVE-2018-8589 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affect...	7.8 High	KEV	3,0%	14 Nov 2018
CVE-2018-8581 microsoft exchange server An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft...	7.4 High	KEV · ransomware	27,4%	14 Nov 2018
CVE-2018-14667 redhat richfaces, redhat enterprise linux The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could expl...	9.8 Critical	KEV	74,2%	6 Nov 2018
CVE-2018-14558 tenda ac7 firmware, tenda ac9 firmware +1 lainnya An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices wi...	9.8 Critical	KEV	8,5%	30 Okt 2018
CVE-2018-8453 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	70,0%	10 Okt 2018
CVE-2018-14634 paloaltonetworks pan-os, f5 big-ip access policy manager +11 lainnya An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary cou...	7.8 High	KEV	14,7%	25 Sep 2018
CVE-2018-15961 adobe coldfusion Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful ex...	9.8 Critical	KEV	100,0%	25 Sep 2018
CVE-2018-8440 microsoft windows 10 1607, microsoft windows 10 1703 +8 lainnya An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vul...	7.8 High	KEV · ransomware	18,4%	13 Sep 2018
CVE-2018-11776 apache struts, netapp active iq unified manager +6 lainnya Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like...	8.1 High	KEV	100,0%	22 Agt 2018
CVE-2018-8405 microsoft windows 10 1507, microsoft windows 10 1607 +9 lainnya An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevat...	7.8 High	KEV · ransomware	3,4%	15 Agt 2018
CVE-2018-8406 microsoft windows 10 1507, microsoft windows 10 1607 +6 lainnya An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevat...	7.8 High	KEV · ransomware	3,4%	15 Agt 2018
CVE-2018-8414 microsoft windows 10 1703, microsoft windows 10 1709 +3 lainnya A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This a...	8.8 High	KEV	72,9%	15 Agt 2018
CVE-2018-8373 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption...	7.5 High	KEV	61,9%	15 Agt 2018
CVE-2018-15133 laravel In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN...	8.1 High	KEV	76,8%	9 Agt 2018
CVE-2018-14933 nuuo nvrmini firmware upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.	9.8 Critical	KEV	94,8%	4 Agt 2018
CVE-2018-14847 mikrotik routeros MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a direct...	9.1 Critical	KEV	96,0%	2 Agt 2018
CVE-2018-7602 drupal, debian linux A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a D...	9.8 Critical	KEV · ransomware	99,2%	19 Jul 2018
CVE-2018-8298 microsoft chakracore A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerabil...	7.5 High	KEV	74,7%	11 Jul 2018
CVE-2018-4990 adobe acrobat dc, adobe acrobat reader dc Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful expl...	8.8 High	KEV	36,2%	9 Jul 2018
CVE-2018-5002 adobe flash player desktop runtime, adobe flash player +3 lainnya Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the...	7.8 High	KEV	25,1%	9 Jul 2018
CVE-2018-9276 paessler prtg network monitor An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can...	7.2 High	KEV	87,0%	2 Jul 2018
CVE-2018-6961 vmware nsx sd-wan by velocloud VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default...	8.1 High	KEV	86,3%	11 Jun 2018
CVE-2016-9079 debian linux, redhat enterprise linux +8 lainnya A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Brow...	7.5 High	KEV	87,5%	11 Jun 2018
CVE-2018-0296 cisco adaptive security appliance software, cisco firepower threat defense +1 lainnya A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload...	7.5 High	KEV	99,9%	7 Jun 2018
CVE-2018-11138 quest kace system management appliance The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbi...	9.8 Critical	KEV · ransomware	91,7%	31 Mei 2018
CVE-2018-4939 adobe coldfusion Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successf...	9.8 Critical	KEV	62,0%	19 Mei 2018
CVE-2018-8174 microsoft windows 10 1607, microsoft windows 10 1703 +8 lainnya A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerabili...	7.5 High	KEV · ransomware	88,3%	9 Mei 2018
CVE-2018-8120 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnera...	7.0 High	KEV · ransomware	73,4%	9 Mei 2018
CVE-2018-0824 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Cod...	8.8 High	KEV	73,2%	9 Mei 2018
CVE-2018-10561 dasannetworks gpon router firmware An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentic...	9.8 Critical	KEV	92,8%	4 Mei 2018
CVE-2018-10562 dasannetworks gpon router firmware An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Bec...	9.8 Critical	KEV · ransomware	99,9%	4 Mei 2018
CVE-2018-2628 oracle weblogic server Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0,...	9.8 Critical	KEV	100,0%	19 Apr 2018
CVE-2018-5430 tibco jasperreports server, tibco jaspersoft +1 lainnya The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, T...	8.8 High	KEV	48,1%	17 Apr 2018
CVE-2018-1273 broadcom spring data commons, pivotal software spring data rest +3 lainnya Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutraliz...	9.8 Critical	KEV · ransomware	97,0%	11 Apr 2018
CVE-2018-7600 drupal, debian linux Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple...	9.8 Critical	KEV · ransomware	100,0%	29 Mar 2018
CVE-2018-0171 cisco ios A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an aff...	9.8 Critical	KEV	99,5%	28 Mar 2018
CVE-2018-0172 cisco ios, cisco ios xe A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause...	8.6 High	KEV	7,8%	28 Mar 2018
CVE-2018-0173 cisco ios, cisco ios xe A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could all...	8.6 High	KEV	7,6%	28 Mar 2018
CVE-2018-0174 cisco ios, cisco ios xe A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause...	8.6 High	KEV	7,6%	28 Mar 2018

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.