Katalog CVE (hal. 5148)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.501 (Critical 35.796 · High 102.981 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 14 Okt 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 257.351–257.400 dari 257.501 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2014-9163 adobe flash player Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attack...	7.8 High	KEV	20,7%	10 Des 2014
CVE-2014-8439 adobe flash player, adobe air +2 lainnya Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK...	8.8 High	KEV	20,4%	25 Nov 2014
CVE-2014-6324 microsoft windows 7, microsoft windows 8 +4 lainnya The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows...	8.8 High	KEV	87,3%	18 Nov 2014
CVE-2014-6332 microsoft windows 7, microsoft windows 8 +7 lainnya OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 201...	8.8 High	KEV	94,9%	11 Nov 2014
CVE-2014-4077 microsoft office 2007 ime, microsoft windows 7 +3 lainnya Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is i...	7.8 High	KEV	54,6%	11 Nov 2014
CVE-2014-6352 microsoft windows 7, microsoft windows 8 +6 lainnya Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow...	7.8 High	KEV	77,5%	22 Okt 2014
CVE-2014-4123 microsoft internet explorer Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability,"...	8.8 High	KEV	47,1%	15 Okt 2014
CVE-2014-4148 microsoft windows 7, microsoft windows 8 +7 lainnya win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,...	8.8 High	KEV	59,9%	15 Okt 2014
CVE-2014-4113 microsoft windows 7, microsoft windows 8 +7 lainnya win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,...	7.8 High	KEV	86,9%	15 Okt 2014
CVE-2014-4114 microsoft windows 7, microsoft windows 8 +6 lainnya Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow...	7.8 High	KEV	81,6%	15 Okt 2014
CVE-2014-6287 rejetto http file server The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary progra...	9.8 Critical	KEV	99,3%	7 Okt 2014
CVE-2014-6278 gnu bash GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary co...	8.8 High	KEV	99,7%	30 Sep 2014
CVE-2014-7169 gnu bash, arista eos +14 lainnya GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attack...	9.8 Critical	KEV	99,9%	25 Sep 2014
CVE-2014-6271 gnu bash, arista eos +14 lainnya GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code...	9.8 Critical	KEV	100,0%	24 Sep 2014
CVE-2014-4404 apple iphone os, apple mac os x +1 lainnya Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an applicatio...	7.8 High	KEV	48,9%	18 Sep 2014
CVE-2013-2597 codeaurora android-msm Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center...	8.4 High	KEV	1,5%	31 Agt 2014
CVE-2014-2817 microsoft internet explorer Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."	8.8 High	KEV	26,3%	12 Agt 2014
CVE-2014-0546 adobe acrobat, adobe acrobat reader Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native...	9.8 Critical	KEV	22,3%	12 Agt 2014
CVE-2014-3120 elasticsearch The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the...	8.1 High	KEV	88,6%	28 Jul 2014
CVE-2013-3993 ibm infosphere biginsights IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via craf...	6.5 Medium	KEV · ransomware	4,8%	7 Jul 2014
CVE-2014-3153 linux kernel, redhat enterprise linux server aus +7 lainnya The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to...	7.8 High	KEV	37,2%	7 Jun 2014
CVE-2014-1812 microsoft windows 7, microsoft windows 8 +4 lainnya The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an...	8.8 High	KEV · ransomware	64,9%	14 Mei 2014
CVE-2014-0130 redhat subscription asset manager, redhat enterprise linux server +1 lainnya Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5,...	7.5 High	KEV	53,7%	7 Mei 2014
CVE-2014-0196 linux kernel, debian linux +28 lainnya The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows l...	5.5 Medium	KEV	22,5%	7 Mei 2014
CVE-2014-1776 microsoft internet explorer Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption...	9.8 Critical	KEV	82,7%	27 Apr 2014
CVE-2014-0780 indusoft web studio Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and...	9.8 Critical	KEV	74,7%	25 Apr 2014
CVE-2014-0160 openssl, filezilla-project filezilla server +26 lainnya The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensit...	7.5 High	KEV	100,0%	7 Apr 2014
CVE-2014-1761 microsoft office, microsoft office compatibility pack +5 lainnya Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on Share...	7.8 High	KEV	77,7%	25 Mar 2014
CVE-2014-2120 cisco adaptive security appliance software Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web scri...	6.1 Medium	KEV	22,6%	19 Mar 2014
CVE-2013-7331 microsoft internet explorer The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intr...	6.5 Medium	KEV	50,2%	26 Feb 2014
CVE-2014-0502 adobe flash player, adobe air sdk +8 lainnya Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, A...	8.8 High	KEV	24,8%	21 Feb 2014
CVE-2014-0322 microsoft internet explorer Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMar...	8.8 High	KEV	85,1%	14 Feb 2014
CVE-2014-0497 adobe flash player, google chrome +7 lainnya Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows r...	9.8 Critical	KEV	99,9%	5 Feb 2014
CVE-2014-0496 adobe acrobat Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.9 and 11.x before 11.0.06 on Windows and Mac OS X allows attackers to execute arbitrary code via...	8.8 High	KEV	40,0%	15 Jan 2014
CVE-2013-3900 microsoft windows 10 1507, microsoft windows 10 1607 +20 lainnya Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers...	5.5 Medium	KEV	44,6%	11 Des 2013
CVE-2013-5065 microsoft windows 2003 server, microsoft windows xp NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wil...	7.8 High	KEV	34,7%	28 Nov 2013
CVE-2013-6282 linux kernel The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers...	8.8 High	KEV	39,7%	20 Nov 2013
CVE-2013-5223 dlink dsl-2760u firmware Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the...	5.4 Medium	KEV	50,8%	19 Nov 2013
CVE-2013-3918 microsoft windows 7, microsoft windows 8 +8 lainnya The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008...	8.8 High	KEV	73,7%	12 Nov 2013
CVE-2013-3906 microsoft excel viewer, microsoft lync +6 lainnya GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 201...	7.8 High	KEV	84,9%	6 Nov 2013
CVE-2013-3897 microsoft internet explorer Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or c...	8.8 High	KEV	77,3%	9 Okt 2013
CVE-2013-3896 microsoft silverlight Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive in...	5.5 Medium	KEV	68,0%	9 Okt 2013
CVE-2013-3893 microsoft internet explorer Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary...	8.8 High	KEV	87,5%	18 Sep 2013
CVE-2013-4810 hp application lifecycle management, hp procurve manager HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbit...	9.8 Critical	KEV	79,5%	16 Sep 2013
CVE-2013-3346 adobe acrobat, adobe acrobat reader Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corr...	9.8 Critical	KEV	78,9%	30 Agt 2013
CVE-2013-2251 apache archiva, apache struts +2 lainnya Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirec...	9.8 Critical	KEV	100,0%	20 Jul 2013
CVE-2013-3163 microsoft internet explorer Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "I...	8.8 High	KEV	70,7%	10 Jul 2013
CVE-2013-1690 mozilla firefox, mozilla thunderbird +13 lainnya Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange e...	8.8 High	KEV	69,0%	26 Jun 2013
CVE-2013-2465 oracle jre, sun jre Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlie...	9.8 Critical	KEV · ransomware	98,8%	18 Jun 2013
CVE-2013-1331 microsoft office Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading...	7.8 High	KEV	79,8%	12 Jun 2013

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.