Katalog CVE (hal. 5270)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.973 (Critical 36.402 · High 105.447 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 27 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 263.451–263.500 dari 263.973 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-19006 sangoma freepbx Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.	9.8 Critical	KEV	55,9%	21 Nov 2019
CVE-2019-6693 fortinet fortios Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the s...	6.5 Medium	KEV · ransomware	6,6%	21 Nov 2019
CVE-2019-1429 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...	7.5 High	KEV	77,3%	12 Nov 2019
CVE-2019-1405 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service El...	7.8 High	KEV · ransomware	30,2%	12 Nov 2019
CVE-2019-1388 microsoft windows 10 1507, microsoft windows 10 1607 +12 lainnya An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevat...	7.8 High	KEV · ransomware	8,6%	12 Nov 2019
CVE-2019-1385 microsoft windows 10 1709, microsoft windows 10 1803 +4 lainnya An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.T...	7.8 High	KEV · ransomware	3,6%	12 Nov 2019
CVE-2019-18187 trendmicro officescan Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip...	7.5 High	KEV	25,1%	28 Okt 2019
CVE-2019-11043 php, canonical ubuntu linux +20 lainnya In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allo...	9.8 Critical	KEV · ransomware	99,7%	28 Okt 2019
CVE-2019-3010 oracle solaris Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability al...	8.8 High	KEV	13,4%	16 Okt 2019
CVE-2019-16278 nazgul nostromo nhttpd Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.	9.8 Critical	KEV	99,0%	14 Okt 2019
CVE-2019-2215 google android, debian linux +51 lainnya A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, howe...	7.8 High	KEV	72,1%	11 Okt 2019
CVE-2019-1322 microsoft windows 10 1803, microsoft windows 10 1809 +4 lainnya An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This...	7.8 High	KEV · ransomware	18,8%	10 Okt 2019
CVE-2019-1315 microsoft windows 10 1607, microsoft windows 10 1703 +11 lainnya An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privi...	7.8 High	KEV · ransomware	3,5%	10 Okt 2019
CVE-2019-16928 exim, canonical ubuntu linux +2 lainnya Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c...	9.8 Critical	KEV	41,6%	27 Sep 2019
CVE-2019-16920 dlink dir-655 firmware, dlink dir-866l firmware +8 lainnya Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary i...	9.8 Critical	KEV	100,0%	27 Sep 2019
CVE-2019-16759 vbulletin vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.	9.8 Critical	KEV	99,7%	24 Sep 2019
CVE-2019-1367 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...	7.5 High	KEV · ransomware	52,4%	23 Sep 2019
CVE-2019-16057 dlink dns-320 firmware The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.	9.8 Critical	KEV · ransomware	86,5%	16 Sep 2019
CVE-2019-16256 trustedconnectivityalliance s@t browser Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information,...	9.8 Critical	KEV	4,9%	12 Sep 2019
CVE-2019-1297 microsoft excel, microsoft office +1 lainnya A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Ex...	8.8 High	KEV	21,8%	11 Sep 2019
CVE-2019-1253 microsoft windows 10 1703, microsoft windows 10 1709 +6 lainnya An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first...	7.8 High	KEV · ransomware	11,6%	11 Sep 2019
CVE-2019-1215 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This C...	7.8 High	KEV · ransomware	19,3%	11 Sep 2019
CVE-2019-1214 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File Sy...	7.8 High	KEV	1,4%	11 Sep 2019
CVE-2019-15949 nagios xi Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web inte...	8.8 High	KEV	77,0%	5 Sep 2019
CVE-2019-13608 citrix storefront server Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.	7.5 High	KEV · ransomware	30,0%	29 Agt 2019
CVE-2019-15752 docker, apache geode Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\Docker...	7.8 High	KEV	48,6%	28 Agt 2019
CVE-2019-15107 webmin An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.	9.8 Critical	KEV · ransomware	99,7%	16 Agt 2019
CVE-2019-0344 sap commerce cloud Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code...	9.8 Critical	KEV	7,5%	14 Agt 2019
CVE-2019-11581 atlassian jira server There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to...	9.8 Critical	KEV	84,6%	9 Agt 2019
CVE-2019-0193 apache solr, debian linux In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration...	7.2 High	KEV	83,5%	1 Agt 2019
CVE-2019-11708 mozilla firefox, mozilla thunderbird Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web c...	10.0 Critical	KEV	55,9%	23 Jul 2019
CVE-2019-11707 mozilla firefox, mozilla thunderbird A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targete...	8.8 High	KEV	37,7%	23 Jul 2019
CVE-2019-1579 paloaltonetworks pan-os Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interfac...	8.1 High	KEV · ransomware	44,2%	19 Jul 2019
CVE-2019-13272 linux kernel, debian linux +20 lainnya In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, whi...	7.8 High	KEV	52,2%	17 Jul 2019
CVE-2019-12991 citrix netscaler sd-wan, citrix sd-wan Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).	8.8 High	KEV	74,5%	16 Jul 2019
CVE-2019-12989 citrix netscaler sd-wan, citrix sd-wan Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.	9.8 Critical	KEV	94,9%	16 Jul 2019
CVE-2019-1132 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	9,9%	15 Jul 2019
CVE-2019-1130 microsoft windows 10 1507, microsoft windows 10 1607 +12 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	1,7%	15 Jul 2019
CVE-2019-1129 microsoft windows 10 1703, microsoft windows 10 1709 +6 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	1,8%	15 Jul 2019
CVE-2019-1068 Advisory microsoft sql server, microsoft sql server 2016 +1 lainnya A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code E...	8.8 High	KEV	57,3%	15 Jul 2019
CVE-2019-0880 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.	7.8 High	KEV	2,3%	15 Jul 2019
CVE-2018-18325 dnnsoftware dotnetnuke DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-158...	7.5 High	KEV	74,0%	3 Jul 2019
CVE-2018-15811 dnnsoftware dotnetnuke DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.	7.5 High	KEV	76,3%	3 Jul 2019
CVE-2019-7256 nortekcontrol linear emerge essential firmware, nortekcontrol linear emerge elite firmware Linear eMerge E3-Series devices allow Command Injections.	9.8 Critical	KEV	97,1%	2 Jul 2019
CVE-2019-5786 google chrome Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pag...	6.5 Medium	KEV	61,1%	27 Jun 2019
CVE-2019-1069 microsoft windows 10 1507, microsoft windows 10 1607 +9 lainnya An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnera...	7.8 High	KEV · ransomware	6,1%	12 Jun 2019
CVE-2019-1064 microsoft windows 10 1607, microsoft windows 10 1703 +9 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this v...	7.8 High	KEV · ransomware	6,9%	12 Jun 2019
CVE-2010-5330 ui airos On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by...	9.8 Critical	KEV	40,2%	11 Jun 2019
CVE-2019-10149 exim, canonical ubuntu linux +1 lainnya A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote co...	9.8 Critical	KEV	100,0%	5 Jun 2019
CVE-2018-13382 fortinet fortiproxy, fortinet fortios An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0...	7.5 High	KEV · ransomware	81,7%	4 Jun 2019

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.