Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2020-6625
jhead project jhead
jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.
|
7.1 High | — | 1,4% | 9 Jan 2020 |
|
CVE-2019-11292
pivotal software operations manager
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access...
|
6.5 Medium | — | 1,1% | 9 Jan 2020 |
|
CVE-2011-5018
koala-framework koala framework
Koala Framework before 2011-11-21 has XSS via the request_uri parameter.
|
6.1 Medium | — | 1,0% | 8 Jan 2020 |
|
CVE-2011-5247
prophecyinternational snare
Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword.
|
7.5 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2011-5250
prophecyinternational snare
Snare for Linux before 1.7.0 has CSRF in the web interface.
|
6.5 Medium | — | 0,66% | 8 Jan 2020 |
|
CVE-2011-5266
imperva securesphere web application firewall
Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.
|
9.8 Critical | — | 1,2% | 8 Jan 2020 |
|
CVE-2020-6617
nothings stb truetype.h
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
|
8.8 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2020-6618
nothings stb truetype.h
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
|
8.8 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2020-6619
nothings stb truetype.h
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
|
8.8 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2020-6620
nothings stb truetype.h
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
|
8.8 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2020-6621
nothings stb truetype.h
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
|
8.8 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2020-6622
nothings stb truetype.h
stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
|
8.8 High | — | 1,4% | 8 Jan 2020 |
|
CVE-2020-6623
nothings stb truetype.h
stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
|
8.8 High | — | 1,5% | 8 Jan 2020 |
|
CVE-2019-9812
mozilla firefox
Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and f...
|
9.3 Critical | — | 1,5% | 8 Jan 2020 |
|
CVE-2019-17012
mozilla firefox, mozilla firefox esr +3 lainnya
Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that wit...
|
8.8 High | — | 2,3% | 8 Jan 2020 |
|
CVE-2019-17013
mozilla firefox
Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some...
|
8.8 High | — | 0,98% | 8 Jan 2020 |
|
CVE-2019-17014
mozilla firefox
If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information lea...
|
7.4 High | — | 1,1% | 8 Jan 2020 |
|
CVE-2019-17015
mozilla firefox, mozilla firefox esr
During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent pro...
|
8.8 High | — | 1,8% | 8 Jan 2020 |
|
CVE-2019-17016
mozilla firefox, mozilla firefox esr +7 lainnya
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into...
|
6.1 Medium | — | 2,0% | 8 Jan 2020 |
|
CVE-2019-17017
mozilla firefox, mozilla firefox esr +7 lainnya
Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploit...
|
8.8 High | — | 2,5% | 8 Jan 2020 |
|
CVE-2019-17018
mozilla firefox
When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox...
|
5.3 Medium | — | 0,88% | 8 Jan 2020 |
|
CVE-2019-17019
mozilla firefox
When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when...
|
8.8 High | — | 1,0% | 8 Jan 2020 |
|
CVE-2019-17020
mozilla firefox, canonical ubuntu linux
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of th...
|
6.5 Medium | — | 1,1% | 8 Jan 2020 |
|
CVE-2019-17021
mozilla firefox, mozilla firefox esr +1 lainnya
During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: th...
|
5.3 Medium | — | 1,9% | 8 Jan 2020 |
|
CVE-2019-17022
mozilla firefox, mozilla firefox esr +7 lainnya
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is p...
|
6.1 Medium | — | 2,0% | 8 Jan 2020 |
|
CVE-2019-17023
mozilla firefox, canonical ubuntu linux +1 lainnya
After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the...
|
6.5 Medium | — | 1,3% | 8 Jan 2020 |
|
CVE-2019-17024
mozilla firefox, mozilla firefox esr +10 lainnya
Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that wit...
|
8.8 High | — | 2,5% | 8 Jan 2020 |
|
CVE-2019-17025
mozilla firefox, canonical ubuntu linux
Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some...
|
8.8 High | — | 1,3% | 8 Jan 2020 |
|
CVE-2019-17001
mozilla firefox
A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This i...
|
6.1 Medium | — | 0,80% | 8 Jan 2020 |
|
CVE-2019-17002
mozilla firefox
If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vul...
|
4.3 Medium | — | 0,73% | 8 Jan 2020 |
|
CVE-2019-17005
mozilla firefox, mozilla firefox esr +3 lainnya
The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to...
|
8.8 High | — | 1,9% | 8 Jan 2020 |
|
CVE-2019-17008
mozilla firefox, mozilla firefox esr +2 lainnya
When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbir...
|
8.8 High | — | 1,9% | 8 Jan 2020 |
|
CVE-2019-17009
mozilla firefox, mozilla firefox esr +2 lainnya
When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerabili...
|
7.8 High | — | 0,33% | 8 Jan 2020 |
|
CVE-2019-17010
mozilla firefox, mozilla firefox esr +3 lainnya
Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a p...
|
7.5 High | — | 1,8% | 8 Jan 2020 |
|
CVE-2019-17011
mozilla firefox, mozilla firefox esr +3 lainnya
Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially e...
|
7.5 High | — | 1,5% | 8 Jan 2020 |
|
CVE-2020-6609
gnu libredwg, opensuse backports sle +1 lainnya
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c.
|
8.8 High | — | 1,8% | 8 Jan 2020 |
|
CVE-2020-6610
gnu libredwg, opensuse backports +1 lainnya
GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.
|
6.5 Medium | — | 1,4% | 8 Jan 2020 |
|
CVE-2020-6611
gnu libredwg, opensuse backports sle +1 lainnya
GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.
|
6.5 Medium | — | 1,5% | 8 Jan 2020 |
|
CVE-2020-6612
gnu libredwg, opensuse backports sle +1 lainnya
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c.
|
8.1 High | — | 1,7% | 8 Jan 2020 |
|
CVE-2020-6613
gnu libredwg, opensuse backports sle +1 lainnya
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c.
|
8.1 High | — | 1,7% | 8 Jan 2020 |
|
CVE-2020-6614
gnu libredwg, opensuse backports sle +1 lainnya
GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c.
|
8.1 High | — | 1,7% | 8 Jan 2020 |
|
CVE-2020-6615
gnu libredwg, opensuse backports sle +1 lainnya
GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl).
|
6.5 Medium | — | 1,5% | 8 Jan 2020 |
|
CVE-2019-17000
mozilla firefox
An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy...
|
6.1 Medium | — | 0,80% | 8 Jan 2020 |
|
CVE-2019-11764
mozilla firefox, mozilla firefox esr +2 lainnya
Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption a...
|
8.8 High | — | 1,5% | 8 Jan 2020 |
|
CVE-2019-11765
mozilla firefox
A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of valid...
|
6.5 Medium | — | 0,84% | 8 Jan 2020 |
|
CVE-2020-6583
bigprof online invoicing system
BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session...
|
6.1 Medium | — | 0,69% | 8 Jan 2020 |
|
CVE-2019-11745
mozilla firefox, mozilla firefox esr +13 lainnya
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could ha...
|
8.8 High | — | 3,0% | 8 Jan 2020 |
|
CVE-2019-11756
mozilla firefox
Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71...
|
8.8 High | — | 1,5% | 8 Jan 2020 |
|
CVE-2019-11757
mozilla firefox, mozilla firefox esr +2 lainnya
When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free...
|
8.8 High | — | 1,4% | 8 Jan 2020 |
|
CVE-2019-11758
mozilla firefox, mozilla firefox esr +2 lainnya
Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption i...
|
8.8 High | — | 1,3% | 8 Jan 2020 |