Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2013-4176
mysecureshell project mysecureshell
mysecureshell 1.31: Local Information Disclosure Vulnerability
|
5.5 Medium | — | 0,43% | 23 Jan 2020 |
|
CVE-2012-2087
ispconfig
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
|
9.8 Critical | — | 2,7% | 23 Jan 2020 |
|
CVE-2012-4863
ibm websphere mq
IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
|
6.5 Medium | — | 1,2% | 23 Jan 2020 |
|
CVE-2008-7314
mirc
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
|
7.5 High | — | 1,3% | 23 Jan 2020 |
|
CVE-2019-18898
suse trousers, opensuse leap
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate pri...
|
7.8 High | — | 0,48% | 23 Jan 2020 |
|
CVE-2019-19837
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
|
5.3 Medium | — | 2,0% | 23 Jan 2020 |
|
CVE-2020-7210
umbraco cms
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
|
4.3 Medium | — | 1,0% | 23 Jan 2020 |
|
CVE-2019-19835
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdsta...
|
7.5 High | — | 1,8% | 23 Jan 2020 |
|
CVE-2020-5216
twitter secure headers
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed i...
|
5.8 Medium | — | 1,2% | 23 Jan 2020 |
|
CVE-2020-5217
twitter secure headers
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed i...
|
5.8 Medium | — | 1,8% | 23 Jan 2020 |
|
CVE-2020-5223
privatebin
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can...
|
4.4 Medium | — | 0,66% | 23 Jan 2020 |
|
CVE-2019-20399
parity libsecp256k1
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel...
|
5.9 Medium | — | 0,88% | 23 Jan 2020 |
|
CVE-2020-7915
eaton 5p 850 firmware
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
|
4.8 Medium | — | 0,65% | 22 Jan 2020 |
|
CVE-2019-20391
cesnet libyang
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications...
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20392
cesnet libyang
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, an...
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20393
cesnet libyang
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yan...
|
8.8 High | — | 2,8% | 22 Jan 2020 |
|
CVE-2019-20394
cesnet libyang
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to p...
|
8.8 High | — | 2,8% | 22 Jan 2020 |
|
CVE-2019-20395
cesnet libyang
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untruste...
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20396
cesnet libyang
A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.
|
6.5 Medium | — | 1,9% | 22 Jan 2020 |
|
CVE-2019-20397
cesnet libyang
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untruste...
|
8.8 High | — | 2,5% | 22 Jan 2020 |
|
CVE-2019-20398
cesnet libyang
A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup()....
|
6.5 Medium | — | 1,8% | 22 Jan 2020 |
|
CVE-2019-19840
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP reque...
|
9.8 Critical | — | 4,1% | 22 Jan 2020 |
|
CVE-2019-19841
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admi...
|
9.8 Critical | — | 3,3% | 22 Jan 2020 |
|
CVE-2019-19842
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to ad...
|
9.8 Critical | — | 5,0% | 22 Jan 2020 |
|
CVE-2011-3622
phorum
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
|
6.1 Medium | — | 0,66% | 22 Jan 2020 |
|
CVE-2020-5221
troglobit uftpd
In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbit...
|
7.2 High | — | 1,2% | 22 Jan 2020 |
|
CVE-2019-19834
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with...
|
7.2 High | — | 2,2% | 22 Jan 2020 |
|
CVE-2019-19836
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write t...
|
9.8 Critical | — | 3,6% | 22 Jan 2020 |
|
CVE-2019-19843
ruckuswireless unleashed, ruckuswireless zonedirector 1200 firmware
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request invo...
|
9.8 Critical | — | 1,8% | 22 Jan 2020 |
|
CVE-2019-16792
agendaless waitress, oracle communications cloud native core network function cloud native environment +1 lainnya
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to b...
|
7.5 High | — | 2,0% | 22 Jan 2020 |
|
CVE-2012-4919
gallery project gallery
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
|
9.8 Critical | — | 2,9% | 22 Jan 2020 |
|
CVE-2016-4761
webkitgtk+, canonical ubuntu linux
WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS
|
8.8 High | — | 1,4% | 22 Jan 2020 |
|
CVE-2019-5647
rapid7 appspider
The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior cou...
|
7.1 High | — | 0,34% | 22 Jan 2020 |
|
CVE-2011-3612
usebb
Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
|
8.8 High | — | 0,88% | 22 Jan 2020 |
|
CVE-2011-3613
vanillaforums vanilla
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
|
7.5 High | — | 1,7% | 22 Jan 2020 |
|
CVE-2011-3614
vanillaforums vanilla
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
|
9.8 Critical | — | 2,0% | 22 Jan 2020 |
|
CVE-2011-3621
fluxbb
A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.
|
9.8 Critical | — | 1,2% | 22 Jan 2020 |
|
CVE-2019-6146
forcepoint web security
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR...
|
6.1 Medium | — | 3,0% | 22 Jan 2020 |
|
CVE-2020-7109
elementor website builder
The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
|
9.8 Critical | — | 1,7% | 22 Jan 2020 |
|
CVE-2011-3611
usebb
A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.
|
7.2 High | — | 2,6% | 22 Jan 2020 |
|
CVE-2011-3595
joomla!
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
|
5.4 Medium | — | 0,81% | 22 Jan 2020 |
|
CVE-2011-3610
s9y serendipity event freetag
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.sw...
|
6.1 Medium | — | 1,2% | 22 Jan 2020 |
|
CVE-2020-6959
honeywell maxpro nvr xe firmware, honeywell maxpro nvr se firmware +4 lainnya
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPR...
|
9.8 Critical | — | 2,2% | 22 Jan 2020 |
|
CVE-2020-6960
honeywell maxpro nvr xe firmware, honeywell maxpro nvr se firmware +4 lainnya
The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPR...
|
9.8 Critical | — | 1,1% | 22 Jan 2020 |
|
CVE-2020-7228
codepeople calculated fields form
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an...
|
5.4 Medium | — | 0,99% | 22 Jan 2020 |
|
CVE-2011-3582
anelectron advanced electron forums
A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the...
|
8.8 High | — | 0,51% | 22 Jan 2020 |
|
CVE-2018-16270
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetoot...
|
7.5 High | — | 1,2% | 22 Jan 2020 |
|
CVE-2018-16271
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to imp...
|
6.5 Medium | — | 0,81% | 22 Jan 2020 |
|
CVE-2018-16272
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security...
|
9.8 Critical | — | 1,6% | 22 Jan 2020 |
|
CVE-2019-10780
bibtex-ruby project bibtex-ruby
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
|
9.8 Critical | — | 2,8% | 22 Jan 2020 |