Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-10781
schema-inspector project schema-inspector
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
|
9.8 Critical | — | 1,4% | 22 Jan 2020 |
|
CVE-2019-6858
schneider-electric msx configurator
A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalation when inje...
|
7.8 High | — | 0,36% | 22 Jan 2020 |
|
CVE-2018-16262
linux tizen
The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such action...
|
8.8 High | — | 0,78% | 22 Jan 2020 |
|
CVE-2018-16263
linux tizen
The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affect...
|
8.8 High | — | 0,78% | 22 Jan 2020 |
|
CVE-2018-16264
linux tizen
The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus security policy co...
|
6.5 Medium | — | 0,58% | 22 Jan 2020 |
|
CVE-2018-16265
linux tizen
The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to improper D-Bus s...
|
6.5 Medium | — | 0,59% | 22 Jan 2020 |
|
CVE-2018-16266
linux tizen
The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This a...
|
8.1 High | — | 0,71% | 22 Jan 2020 |
|
CVE-2018-16267
linux tizen
The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Suc...
|
8.1 High | — | 0,68% | 22 Jan 2020 |
|
CVE-2018-16268
linux tizen
The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configur...
|
4.3 Medium | — | 0,52% | 22 Jan 2020 |
|
CVE-2018-16269
samsung galaxy gear firmware, samsung gear 2 firmware +8 lainnya
The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security...
|
7.5 High | — | 1,4% | 22 Jan 2020 |
|
CVE-2011-4943
impresspages cms
ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)
|
9.8 Critical | — | 1,8% | 22 Jan 2020 |
|
CVE-2019-12490
simplemachines simple machines forum
An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _blank for external links.
|
6.5 Medium | — | 1,3% | 22 Jan 2020 |
|
CVE-2019-16791
postfix-mta-sts-resolver project postfix-mta-sts-resolver
In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.
|
5.9 Medium | — | 0,86% | 22 Jan 2020 |
|
CVE-2018-17981
lifesize express 220 firmware, lifesize room 220i firmware
Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
|
6.1 Medium | — | 0,78% | 22 Jan 2020 |
|
CVE-2019-19413
huawei dbs3900 tdd lte firmware, huawei dp300 firmware +5 lainnya
There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerabilit...
|
7.5 High | — | 0,96% | 21 Jan 2020 |
|
CVE-2019-19414
huawei dbs3900 tdd lte firmware, huawei dp300 firmware +5 lainnya
There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerabilit...
|
7.5 High | — | 0,96% | 21 Jan 2020 |
|
CVE-2019-20387
opensuse libsolv, debian linux
repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
|
7.5 High | — | 2,3% | 21 Jan 2020 |
|
CVE-2019-20388
xmlsoft libxml2, debian linux +22 lainnya
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
|
7.5 High | — | 3,2% | 21 Jan 2020 |
|
CVE-2020-1788
huawei honor v30 firmware
Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the...
|
5.5 Medium | — | 0,59% | 21 Jan 2020 |
|
CVE-2020-7595
xmlsoft libxml2, fedoraproject fedora +22 lainnya
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
|
7.5 High | — | 7,8% | 21 Jan 2020 |
|
CVE-2020-7594
multitech conduit mtcdt-lvw2-246a firmware
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options...
|
7.2 High | — | 2,5% | 21 Jan 2020 |
|
CVE-2019-19886
owasp modsecurity, fedoraproject fedora
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or un...
|
7.5 High | — | 2,5% | 21 Jan 2020 |
|
CVE-2019-18426
whatsapp
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file r...
|
8.2 High | KEV | 67,9% | 21 Jan 2020 |
|
CVE-2020-7040
storebackup, debian linux +3 lainnya
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local us...
|
8.1 High | — | 2,9% | 21 Jan 2020 |
|
CVE-2020-6638
grin
Grin through 2.1.1 has Insufficient Validation.
|
7.5 High | — | 1,3% | 21 Jan 2020 |
|
CVE-2019-17584
meinbergglobal syncbox/ptpv2 firmware
The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions up to v5.34o, v5.34s, v5.32* o...
|
7.5 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2020-1840
huawei mate 20 firmware
HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high privilege can...
|
6.0 Medium | — | 0,22% | 21 Jan 2020 |
|
CVE-2020-6849
hutchhouse marketo forms and tracking
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
|
8.8 High | — | 1,3% | 21 Jan 2020 |
|
CVE-2019-17357
cacti
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite val...
|
6.5 Medium | — | 34,2% | 21 Jan 2020 |
|
CVE-2019-19411
huawei usg9500 firmware
USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vuln...
|
3.7 Low | — | 1,2% | 21 Jan 2020 |
|
CVE-2019-19592
jamasoftware connect
Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
|
6.1 Medium | — | 0,69% | 21 Jan 2020 |
|
CVE-2014-2680
xmind
The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.
|
8.1 High | — | 1,9% | 21 Jan 2020 |
|
CVE-2016-11018
huge-it image gallery
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL inject...
|
9.8 Critical | — | 2,4% | 21 Jan 2020 |
|
CVE-2020-5202
apt-cacher-ng project apt-cacher-ng, debian linux +2 lainnya
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to...
|
5.5 Medium | — | 0,47% | 21 Jan 2020 |
|
CVE-2015-2784
papercrop project papercrop
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
|
9.8 Critical | — | 1,8% | 21 Jan 2020 |
|
CVE-2019-14902
samba, canonical ubuntu linux +2 lainnya
There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of th...
|
5.4 Medium | — | 1,4% | 21 Jan 2020 |
|
CVE-2019-14907
samba, fedoraproject fedora +8 lainnya
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string ob...
|
6.5 Medium | — | 3,2% | 21 Jan 2020 |
|
CVE-2019-18932
squid analysis report generator project squid analysis report generator, opensuse backports sle +1 lainnya
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root u...
|
7.0 High | — | 0,25% | 21 Jan 2020 |
|
CVE-2019-19344
samba, canonical ubuntu linux +5 lainnya
There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essential...
|
6.5 Medium | — | 2,8% | 21 Jan 2020 |
|
CVE-2019-19392
fordnn usersexportimport
The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as...
|
9.8 Critical | — | 1,4% | 21 Jan 2020 |
|
CVE-2020-6857
taskautomation carbonftp
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.
|
5.5 Medium | — | 0,97% | 21 Jan 2020 |
|
CVE-2020-7211
libslirp project libslirp, qemu
tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
|
7.5 High | — | 4,2% | 21 Jan 2020 |
|
CVE-2020-7213
parallels
Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a...
|
7.5 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2020-7229
simplejobscript
An issue was discovered in Simplejobscript.com SJS before 1.65. There is unauthenticated SQL injection via the search engine. The parameter is landing_location. The funct...
|
9.8 Critical | — | 1,5% | 21 Jan 2020 |
|
CVE-2019-3864
redhat quay
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF toke...
|
8.8 High | — | 0,44% | 21 Jan 2020 |
|
CVE-2019-14765
dimo-crm yellowbox crm
Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers.
|
8.8 High | — | 1,1% | 21 Jan 2020 |
|
CVE-2019-14766
dimo-crm yellowbox crm
Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem.
|
6.5 Medium | — | 1,1% | 21 Jan 2020 |
|
CVE-2019-14767
dimo-crm yellowbox crm
In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download...
|
7.5 High | — | 1,4% | 21 Jan 2020 |
|
CVE-2019-14768
dimo-crm yellowbox crm
An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat s...
|
8.8 High | — | 4,3% | 21 Jan 2020 |
|
CVE-2011-5282
mirc
mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
|
5.3 Medium | — | 1,1% | 21 Jan 2020 |