Katalog CVE (hal. 5210)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 261.947 (Critical 36.196 · High 104.724 · KEV 1.754 · sejak 2020) · Pembaruan terakhir: 21 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 260.451–260.500 dari 261.947 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-7236 uhp-100 firmware UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section).	6.1 Medium	—	0,67%	19 Jan 2020
CVE-2020-7234 ruckuswireless r310 firmware Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login to the sup...	4.8 Medium	—	0,55%	19 Jan 2020
CVE-2020-7233 kmccontrols bac-a1616bc firmware KMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME variable in the BC_Logon.swf file.	9.8 Critical	—	1,7%	19 Jan 2020
CVE-2020-7231 evoko home Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is valid.	5.3 Medium	—	0,97%	19 Jan 2020
CVE-2020-7232 evoko home Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information (such as usernames and password hashes) via a WebSocket request, as demonstrat...	7.5 High	—	1,5%	19 Jan 2020
CVE-2020-7227 westermo mrd-315 firmware Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of differen...	6.5 Medium	—	1,3%	18 Jan 2020
CVE-2020-7222 amcrest web server An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An atta...	5.3 Medium	—	1,3%	18 Jan 2020
CVE-2019-19696 trendmicro password manager A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unautho...	5.5 Medium	—	0,47%	18 Jan 2020
CVE-2019-19697 trendmicro antivirus + security 2019, trendmicro internet security 2019 +2 lainnya An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privile...	6.7 Medium	—	0,82%	18 Jan 2020
CVE-2019-20357 trendmicro antivirus + security 2019, trendmicro antivirus + security 2020 +6 lainnya A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allo...	7.8 High	—	0,73%	18 Jan 2020
CVE-2019-15625 trendmicro password manager A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extra...	5.5 Medium	—	0,98%	18 Jan 2020
CVE-2020-7104 kibokolabs chained quiz The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.	6.1 Medium	—	1,6%	17 Jan 2020
CVE-2014-5007 zohocorp manageengine desktop central, zohocorp manageengine desktop central managed service providers Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition be...	9.8 Critical	—	37,3%	17 Jan 2020
CVE-2020-5397 vmware spring framework, oracle application testing suite +25 lainnya Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring Web...	5.3 Medium	—	2,6%	17 Jan 2020
CVE-2019-17635 eclipse memory analyzer Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version...	7.8 High	—	1,3%	17 Jan 2020
CVE-2019-19339 redhat enterprise linux, redhat enterprise linux eus It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsis...	6.5 Medium	—	0,31%	17 Jan 2020
CVE-2019-17634 eclipse memory analyzer Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The...	9.0 Critical	—	1,9%	17 Jan 2020
CVE-2019-17125 solarwinds orion platform A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular...	6.1 Medium	—	1,5%	17 Jan 2020
CVE-2019-17127 solarwinds orion platform A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject a...	6.1 Medium	—	1,9%	17 Jan 2020
CVE-2019-14629 intel data analytics acceleration library Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access.	5.5 Medium	—	0,27%	17 Jan 2020
CVE-2020-3940 vmware workspace one boxer, vmware workspace one content +7 lainnya VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.	5.9 Medium	—	0,80%	17 Jan 2020
CVE-2020-6862 zte f6x2w firmware V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without e...	5.3 Medium	—	6,3%	17 Jan 2020
CVE-2019-14596 intel chipset inf utility Improper access control in the installer for Intel(R) Chipset Device Software INF Utility before version 10.1.18 may allow an authenticated user to potentially enable den...	5.5 Medium	—	0,27%	17 Jan 2020
CVE-2019-14600 intel snmp subagent stand-alone Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potentially enable escalation of...	6.7 Medium	—	0,34%	17 Jan 2020
CVE-2019-14601 intel raid web console 3 Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of priv...	7.8 High	—	0,29%	17 Jan 2020
CVE-2019-14613 intel vtune profiler Improper access control in driver for Intel(R) VTune(TM) Amplifier for Windows* before update 8 may allow an authenticated user to potentially enable escalation of privil...	7.8 High	—	0,34%	17 Jan 2020
CVE-2019-14615 canonical ubuntu linux, intel atom e3805 +53 lainnya Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable...	5.5 Medium	—	1,4%	17 Jan 2020
CVE-2019-10956 geutebrueck g-code eec-2400 firmware, geutebrueck g-cam ebc-2110 firmware +9 lainnya Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated user, using a spec...	7.2 High	—	2,7%	17 Jan 2020
CVE-2019-10957 geutebrueck g-code eec-2400 firmware, geutebrueck g-cam ebc-2110 firmware +9 lainnya Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with acce...	4.8 Medium	—	0,94%	17 Jan 2020
CVE-2019-10958 geutebrueck g-code eec-2400 firmware, geutebrueck g-cam ebc-2110 firmware +9 lainnya Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with acce...	7.2 High	—	3,3%	17 Jan 2020
CVE-2019-15854 maarch rm An issue was discovered in Maarch RM before 2.5. A privilege escalation vulnerability allows an authenticated user with lowest privileges to give herself highest administ...	8.8 High	—	1,3%	17 Jan 2020
CVE-2019-15855 maarch rm An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted POST reque...	9.1 Critical	—	1,5%	17 Jan 2020
CVE-2019-20003 dicube easescreen crystal Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends an...	6.1 Medium	—	0,70%	17 Jan 2020
CVE-2019-3686 suse openqa openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27b was vulnerable to XSS in the distri and version parameter. This was reported through the bug bounty program...	6.1 Medium	—	0,62%	17 Jan 2020
CVE-2019-3683 suse openstack cloud, suse keystone-json-assignment +1 lainnya The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-...	8.8 High	—	0,94%	17 Jan 2020
CVE-2019-3682 suse caas platform The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.	7.8 High	—	0,31%	17 Jan 2020
CVE-2019-19801 gallagher command centre In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2...	5.5 Medium	—	0,28%	17 Jan 2020
CVE-2019-19802 gallagher command centre In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70...	6.5 Medium	—	0,75%	17 Jan 2020
CVE-2019-17361 saltstack salt, debian linux +2 lainnya In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with netw...	9.8 Critical	—	15,2%	17 Jan 2020
CVE-2019-19142 intelbras wrn 240 firmware Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.	7.5 High	—	7,8%	17 Jan 2020
CVE-2019-15742 plantronics hub A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit this issue to gain...	7.8 High	—	5,0%	17 Jan 2020
CVE-2020-5398 vmware spring framework, oracle application testing suite +29 lainnya In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file d...	7.5 High	—	88,8%	17 Jan 2020
CVE-2020-7039 libslirp project libslirp, qemu +2 lainnya tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer over...	5.6 Medium	—	3,6%	16 Jan 2020
CVE-2019-3997 simplisafe ss3 firmware Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair a rogue keypad to an armed sy...	4.6 Medium	—	0,39%	16 Jan 2020
CVE-2019-5126 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previ...	8.8 High	—	3,5%	16 Jan 2020
CVE-2019-5130 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can...	8.8 High	—	2,3%	16 Jan 2020
CVE-2019-5131 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document ca...	8.8 High	—	2,4%	16 Jan 2020
CVE-2019-5145 foxitsoftware phantompdf, foxitsoftware reader An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previ...	8.8 High	—	3,1%	16 Jan 2020
CVE-2019-9500 broadcom brcmfmac driver, linux kernel The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functio...	8.3 High	—	3,9%	16 Jan 2020
CVE-2019-9503 broadcom brcmfmac driver, redhat enterprise linux The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a f...	8.3 High	—	3,3%	16 Jan 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.