Katalog CVE (hal. 5154)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 257.870 (Critical 35.834 · High 103.117 · KEV 1.741 · sejak 2020) · Pembaruan terakhir: 15 Okt 2026, 00:26 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 257.651–257.700 dari 257.870 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2016-0185 microsoft windows 7, microsoft windows 8.1 +1 lainnya Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) f...	7.8 High	KEV	69,8%	11 Mei 2016
CVE-2016-3718 redhat enterprise linux desktop, redhat enterprise linux eus +16 lainnya The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a c...	5.5 Medium	KEV	75,6%	5 Mei 2016
CVE-2016-3715 redhat enterprise linux desktop, redhat enterprise linux eus +16 lainnya The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.	5.5 Medium	KEV	75,3%	5 Mei 2016
CVE-2016-3714 imagemagick, canonical ubuntu linux +4 lainnya The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attacke...	8.4 High	KEV	97,5%	5 Mei 2016
CVE-2016-3081 huawei agile controller-campus firmware, huawei anyoffice +17 lainnya Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code vi...	8.1 High	KEV	96,1%	26 Apr 2016
CVE-2016-3427 oracle jdk, oracle jre +26 lainnya Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity...	9.8 Critical	KEV	92,3%	21 Apr 2016
CVE-2016-0167 microsoft windows 10 1507, microsoft windows 10 1511 +6 lainnya The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, an...	7.8 High	KEV · ransomware	5,7%	12 Apr 2016
CVE-2016-0165 microsoft windows 10 1507, microsoft windows 10 1511 +6 lainnya The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, an...	7.8 High	KEV	13,7%	12 Apr 2016
CVE-2016-0162 microsoft internet explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Discl...	4.3 Medium	KEV	22,0%	12 Apr 2016
CVE-2016-0151 microsoft windows 10 1507, microsoft windows 10 1511 +3 lainnya The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process to...	7.8 High	KEV · ransomware	62,9%	12 Apr 2016
CVE-2016-3976 sap netweaver application server java Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName p...	7.5 High	KEV	47,3%	7 Apr 2016
CVE-2016-1019 adobe flash player desktop runtime, adobe flash player +3 lainnya Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vect...	9.8 Critical	KEV · ransomware	22,3%	7 Apr 2016
CVE-2016-1646 debian linux, canonical ubuntu linux +8 lainnya The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which...	8.8 High	KEV	48,1%	29 Mar 2016
CVE-2016-1010 adobe flash player, adobe air +5 lainnya Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21...	8.8 High	KEV	19,3%	12 Mar 2016
CVE-2016-0099 microsoft windows 10 1507, microsoft windows 10 1511 +5 lainnya The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8....	7.8 High	KEV · ransomware	37,0%	9 Mar 2016
CVE-2016-2388 sap netweaver application server java The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Securit...	5.3 Medium	KEV	52,2%	16 Feb 2016
CVE-2016-2386 sap netweaver application server java SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SA...	9.8 Critical	KEV	71,5%	16 Feb 2016
CVE-2016-0752 rubyonrails rails, opensuse leap +4 lainnya Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 all...	7.5 High	KEV	95,5%	16 Feb 2016
CVE-2016-0984 adobe flash player, adobe flash player desktop runtime +3 lainnya Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR b...	8.8 High	KEV	54,5%	10 Feb 2016
CVE-2016-0040 microsoft windows 7, microsoft windows server 2008 +1 lainnya The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Win...	7.8 High	KEV	24,5%	10 Feb 2016
CVE-2016-0034 microsoft silverlight Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of servi...	8.8 High	KEV · ransomware	69,4%	13 Jan 2016
CVE-2015-7450 ibm sterling b2b integrator, ibm sterling integrator +5 lainnya Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute...	9.8 Critical	KEV	97,8%	2 Jan 2016
CVE-2015-8651 adobe air sdk, adobe air sdk & compiler +15 lainnya Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0...	8.8 High	KEV	67,7%	28 Des 2015
CVE-2015-7755 juniper screenos Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6....	9.8 Critical	KEV	61,1%	19 Des 2015
CVE-2015-6175 microsoft windows 10 1507 The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."	7.8 High	KEV	5,1%	9 Des 2015
CVE-2015-5287 Advisory redhat automatic bug reporting tool, oracle linux +5 lainnya The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on...	7.8 High	KEV	5,0%	7 Des 2015
CVE-2015-5317 jenkins, redhat openshift The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request...	7.5 High	KEV	23,0%	25 Nov 2015
CVE-2015-4852 oracle virtual desktop infrastructure, oracle storagetek tape analytics sw tool +1 lainnya The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serial...	9.8 Critical	KEV	95,1%	18 Nov 2015
CVE-2015-4902 oracle jdk, oracle jre +19 lainnya Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.	5.3 Medium	KEV	13,6%	22 Okt 2015
CVE-2015-7645 adobe flash player, opensuse evergreen +8 lainnya Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbit...	7.8 High	KEV · ransomware	65,3%	15 Okt 2015
CVE-2015-2546 microsoft windows 10 1507, microsoft windows 7 +7 lainnya The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows...	8.2 High	KEV · ransomware	10,1%	9 Sep 2015
CVE-2015-2545 microsoft office Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed...	7.8 High	KEV	85,9%	9 Sep 2015
CVE-2015-2502 microsoft internet explorer Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "M...	8.8 High	KEV	51,0%	19 Agt 2015
CVE-2015-1769 microsoft windows 10, microsoft windows 7 +7 lainnya Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold...	6.6 Medium	KEV	4,1%	15 Agt 2015
CVE-2015-1642 microsoft office Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulner...	7.8 High	KEV	53,1%	15 Agt 2015
CVE-2015-3246 Advisory redhat enterprise linux, opensuse +1 lainnya libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cau...	7.4 High	KEV	8,5%	11 Agt 2015
CVE-2015-4495 mozilla firefox, mozilla firefox os +13 lainnya The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and r...	8.8 High	KEV	68,6%	8 Agt 2015
CVE-2015-5477 juniper junos named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKE...	7.5 High	KEV	99,4%	29 Jul 2015
CVE-2015-2426 microsoft windows 10, microsoft windows 7 +7 lainnya Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wind...	8.8 High	KEV	86,6%	20 Jul 2015
CVE-2015-2590 oracle jdk, oracle jre +17 lainnya Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and ava...	9.8 Critical	KEV	25,5%	16 Jul 2015
CVE-2015-2387 microsoft windows 7, microsoft windows 8 +7 lainnya ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Win...	7.8 High	KEV	34,9%	14 Jul 2015
CVE-2015-2425 microsoft internet explorer Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex...	8.8 High	KEV	44,7%	14 Jul 2015
CVE-2015-2424 microsoft excel viewer, microsoft office +4 lainnya Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to...	8.8 High	KEV	40,4%	14 Jul 2015
CVE-2015-2419 microsoft internet explorer JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si...	8.8 High	KEV	53,1%	14 Jul 2015
CVE-2015-5123 redhat enterprise linux desktop, redhat enterprise linux server +7 lainnya Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x th...	9.8 Critical	KEV	18,8%	14 Jul 2015
CVE-2015-5122 adobe flash player, adobe flash player desktop runtime +7 lainnya Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x...	9.8 Critical	KEV	93,9%	14 Jul 2015
CVE-2015-5119 adobe flash player, redhat enterprise linux desktop +9 lainnya Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 o...	9.8 Critical	KEV	99,3%	8 Jul 2015
CVE-2015-3113 adobe flash player, opensuse evergreen +13 lainnya Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows rem...	9.8 Critical	KEV	99,8%	23 Jun 2015
CVE-2015-2360 microsoft windows 7, microsoft windows 8 +7 lainnya win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wi...	8.8 High	KEV	14,8%	10 Jun 2015
CVE-2015-1770 microsoft office Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use...	8.8 High	KEV	35,0%	10 Jun 2015

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.