Katalog CVE (hal. 5172)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 258.834 (Critical 35.935 · High 103.510 · KEV 1.746 · sejak 2020) · Pembaruan terakhir: 16 Okt 2026, 06:27 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 258.551–258.600 dari 258.834 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2017-5689 hpe proliant ml10 gen9 server firmware, siemens simatic itp1000 firmware +34 lainnya An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Managea...	9.8 Critical	KEV	92,2%	2 Mei 2017
CVE-2017-3066 adobe coldfusion Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apac...	9.8 Critical	KEV	90,6%	27 Apr 2017
CVE-2017-8291 artifex ghostscript, debian linux +6 lainnya Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafte...	7.8 High	KEV	97,0%	27 Apr 2017
CVE-2017-5030 google chrome, debian linux +3 lainnya Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to...	8.8 High	KEV	40,6%	24 Apr 2017
CVE-2017-3506 oracle weblogic server Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3....	7.4 High	KEV	96,0%	24 Apr 2017
CVE-2016-1555 netgear wnap320 firmware, netgear wndap350 firmware +5 lainnya (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP3...	9.8 Critical	KEV	98,3%	21 Apr 2017
CVE-2017-0199 microsoft office, microsoft windows 7 +4 lainnya Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP...	7.8 High	KEV · ransomware	99,5%	12 Apr 2017
CVE-2017-0210 microsoft internet explorer An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information...	8.8 High	KEV	22,3%	12 Apr 2017
CVE-2016-8735 apache tomcat, canonical ubuntu linux +17 lainnya Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecyc...	9.8 Critical	KEV	90,3%	6 Apr 2017
CVE-2017-6884 zyxel emg2926 firmware A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, spe...	8.8 High	KEV · ransomware	34,6%	6 Apr 2017
CVE-2014-3931 multi-router looking glass project multi-router looking glass fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.	9.8 Critical	KEV	29,0%	31 Mar 2017
CVE-2017-7269 microsoft internet information services Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote at...	9.8 Critical	KEV	99,8%	27 Mar 2017
CVE-2017-3881 cisco ios, cisco ios xe A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to c...	9.8 Critical	KEV	99,0%	17 Mar 2017
CVE-2017-0144 microsoft server message block, siemens acuson p300 firmware +7 lainnya The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Wind...	8.8 High	KEV · ransomware	99,2%	17 Mar 2017
CVE-2017-0145 microsoft server message block, siemens acuson p300 firmware +7 lainnya The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Wind...	8.8 High	KEV · ransomware	89,9%	17 Mar 2017
CVE-2017-0146 microsoft server message block, siemens acuson p300 firmware +7 lainnya The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Wind...	8.8 High	KEV · ransomware	89,9%	17 Mar 2017
CVE-2017-0147 microsoft windows 10 1507, microsoft windows 10 1511 +16 lainnya The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Wind...	7.5 High	KEV · ransomware	99,7%	17 Mar 2017
CVE-2017-0148 microsoft server message block, siemens acuson p300 firmware +7 lainnya The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Wind...	8.1 High	KEV · ransomware	99,4%	17 Mar 2017
CVE-2017-0149 microsoft internet explorer Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "In...	8.8 High	KEV	29,2%	17 Mar 2017
CVE-2017-0143 microsoft server message block, philips intellispace portal +8 lainnya The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Wind...	8.8 High	KEV · ransomware	93,3%	17 Mar 2017
CVE-2017-0101 microsoft windows 7, microsoft windows server 2008 +1 lainnya The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2...	7.8 High	KEV · ransomware	57,5%	17 Mar 2017
CVE-2017-0059 microsoft internet explorer Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Informa...	4.3 Medium	KEV	62,0%	17 Mar 2017
CVE-2017-0001 microsoft windows 10 1507, microsoft windows 10 1511 +8 lainnya The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windo...	7.8 High	KEV	3,1%	17 Mar 2017
CVE-2017-0005 microsoft windows 10 1507, microsoft windows 10 1511 +8 lainnya The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windo...	7.8 High	KEV	11,0%	17 Mar 2017
CVE-2017-0022 microsoft xml core services, microsoft windows 8.1 +2 lainnya Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 201...	6.5 Medium	KEV	18,1%	17 Mar 2017
CVE-2017-5638 apache struts, ibm storwize v3500 firmware +7 lainnya The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-up...	9.8 Critical	KEV · ransomware	100,0%	11 Mar 2017
CVE-2017-6334 netgear dgn2200 series firmware dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in th...	8.8 High	KEV	72,6%	6 Mar 2017
CVE-2017-0037 microsoft edge, microsoft internet explorer Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement functi...	8.1 High	KEV	80,4%	26 Feb 2017
CVE-2017-6077 netgear dgn2200 firmware ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the pin...	9.8 Critical	KEV	68,7%	22 Feb 2017
CVE-2016-10174 netgear d6100 firmware, netgear d7000 firmware +26 lainnya The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be ex...	9.8 Critical	KEV	83,3%	30 Jan 2017
CVE-2016-5198 google chrome, redhat enterprise linux desktop +2 lainnya V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which...	8.8 High	KEV	34,2%	19 Jan 2017
CVE-2017-5521 netgear r6200 firmware, netgear r6300 firmware +11 lainnya An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to...	8.1 High	KEV	89,2%	17 Jan 2017
CVE-2016-10033 phpmailer project phpmailer, wordpress +1 lainnya The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execut...	9.8 Critical	KEV	99,7%	30 Des 2016
CVE-2016-7262 microsoft excel, microsoft excel viewer +1 lainnya Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attack...	7.8 High	KEV	57,7%	20 Des 2016
CVE-2016-7892 adobe flash player desktop runtime, adobe flash player Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitat...	8.8 High	KEV	18,8%	15 Des 2016
CVE-2016-6277 netgear d6220 firmware, netgear d6400 firmware +9 lainnya NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before...	8.8 High	KEV	99,8%	14 Des 2016
CVE-2016-9563 sap netweaver application server java BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~we...	6.5 Medium	KEV	24,2%	23 Nov 2016
CVE-2016-8562 siemens simatic cp 1543-1 firmware, siemens siplus net cp 1543-1 firmware A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible...	7.5 High	KEV	3,6%	18 Nov 2016
CVE-2016-5195 canonical ubuntu linux, linux kernel +16 lainnya Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW...	7.0 High	KEV	83,5%	10 Nov 2016
CVE-2016-7256 microsoft windows 10 1507, microsoft windows 10 1511 +8 lainnya atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Win...	8.8 High	KEV	64,6%	10 Nov 2016
CVE-2016-7255 microsoft windows 10 1507, microsoft windows 10 1511 +8 lainnya The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, W...	7.8 High	KEV · ransomware	81,0%	10 Nov 2016
CVE-2016-7201 microsoft edge The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted...	8.8 High	KEV	80,0%	10 Nov 2016
CVE-2016-7200 microsoft edge The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted...	8.8 High	KEV	82,8%	10 Nov 2016
CVE-2016-7855 adobe flash player, redhat enterprise linux desktop +2 lainnya Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary cod...	8.8 High	KEV	25,2%	1 Nov 2016
CVE-2016-7193 microsoft office, microsoft office compatibility pack +2 lainnya Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Wo...	7.8 High	KEV	57,6%	14 Okt 2016
CVE-2016-3393 microsoft windows 10 1507, microsoft windows 10 1511 +7 lainnya Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R...	7.8 High	KEV	68,5%	14 Okt 2016
CVE-2016-3298 microsoft internet explorer, microsoft windows 7 +2 lainnya Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers...	6.5 Medium	KEV	33,3%	14 Okt 2016
CVE-2016-6415 cisco ios, cisco ios xe +1 lainnya The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allow...	7.5 High	KEV	87,7%	19 Sep 2016
CVE-2016-3351 microsoft internet explorer, microsoft edge Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Informat...	6.5 Medium	KEV · ransomware	26,5%	14 Sep 2016
CVE-2016-4657 apple iphone os WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.	8.8 High	KEV	66,8%	25 Agt 2016

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.