Katalog CVE
Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
TLP:CLEAR · 32 kali dilihat
$ cat README.txt
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2019-9539
telos automated message handling system
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System al...
|
6.1 Medium | — | 0,84% | 3 Jan 2020 |
|
CVE-2019-9538
telos automated message handling system
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling Syste...
|
6.1 Medium | — | 0,84% | 3 Jan 2020 |
|
CVE-2019-9537
telos automated message handling system
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling System allows a...
|
6.1 Medium | — | 0,84% | 3 Jan 2020 |
|
CVE-2019-19959
sqlite, canonical ubuntu linux
ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management e...
|
7.5 High | — | 3,4% | 3 Jan 2020 |
|
CVE-2014-8516
cloudfastpath netcharts server
Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extensio...
|
9.8 Critical | — | 81,7% | 3 Jan 2020 |
|
CVE-2020-5395
fontforge, fedoraproject fedora +1 lainnya
FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
|
8.8 High | — | 2,5% | 3 Jan 2020 |
|
CVE-2014-8337
helpdezk
Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code...
|
9.8 Critical | — | 4,8% | 3 Jan 2020 |
|
CVE-2014-5516
konakart
Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authenticat...
|
6.5 Medium | — | 1,3% | 3 Jan 2020 |
|
CVE-2014-5140
loadedcommerce loaded7
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote aut...
|
8.8 High | — | 2,7% | 3 Jan 2020 |
|
CVE-2014-4196
bssys rbs bs-client
Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitrary web script or HTML via the...
|
6.1 Medium | — | 0,81% | 3 Jan 2020 |
|
CVE-2014-10398
bssys rbs bs-client. retail client
Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5, 2.4, and e...
|
6.1 Medium | — | 0,81% | 3 Jan 2020 |
|
CVE-2012-5878
bulbsecurity smartphone pentest framework
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath par...
|
9.8 Critical | — | 9,3% | 3 Jan 2020 |
|
CVE-2012-5693
bulbsecurity smartphone pentest framework
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter...
|
8.8 High | — | 1,7% | 3 Jan 2020 |
|
CVE-2019-11994
hp simplivity 380 gen9 firmware, hp simplivity 380 gen10 g firmware +6 lainnya
A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity O...
|
9.8 Critical | — | 7,2% | 3 Jan 2020 |
|
CVE-2019-11993
hp simplivity 380 gen9 firmware, hp simplivity 380 gen10 g firmware +6 lainnya
A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity O...
|
7.5 High | — | 1,5% | 3 Jan 2020 |
|
CVE-2019-5064
opencv, oracle application testing suite +2 lainnya
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file ca...
|
8.8 High | — | 10,7% | 3 Jan 2020 |
|
CVE-2019-5063
opencv, oracle application testing suite +2 lainnya
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer...
|
8.8 High | — | 21,1% | 3 Jan 2020 |
|
CVE-2019-19310
gitlab
GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.
|
4.9 Medium | — | 0,89% | 3 Jan 2020 |
|
CVE-2019-19309
gitlab
GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.
|
4.3 Medium | — | 0,77% | 3 Jan 2020 |
|
CVE-2019-19263
gitlab
GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.
|
4.3 Medium | — | 0,59% | 3 Jan 2020 |
|
CVE-2019-19262
gitlab
GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.
|
4.3 Medium | — | 0,76% | 3 Jan 2020 |
|
CVE-2019-19261
gitlab
GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.
|
8.8 High | — | 1,0% | 3 Jan 2020 |
|
CVE-2019-19260
gitlab
GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).
|
5.4 Medium | — | 0,65% | 3 Jan 2020 |
|
CVE-2019-19259
gitlab
GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).
|
4.3 Medium | — | 0,59% | 3 Jan 2020 |
|
CVE-2019-19258
gitlab
GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.
|
5.3 Medium | — | 0,93% | 3 Jan 2020 |
|
CVE-2019-19257
gitlab
GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).
|
5.3 Medium | — | 0,93% | 3 Jan 2020 |
|
CVE-2019-19256
gitlab
GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.
|
5.3 Medium | — | 0,93% | 3 Jan 2020 |
|
CVE-2019-19255
gitlab
GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.
|
4.3 Medium | — | 0,77% | 3 Jan 2020 |
|
CVE-2012-4451
zend framework, fedoraproject fedora +1 lainnya
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified inp...
|
6.1 Medium | — | 1,4% | 3 Jan 2020 |
|
CVE-2019-19311
gitlab
GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.
|
5.4 Medium | — | 0,73% | 3 Jan 2020 |
|
CVE-2019-19254
gitlab
GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.
|
5.3 Medium | — | 1,1% | 3 Jan 2020 |
|
CVE-2019-19088
gitlab
Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.
|
9.8 Critical | — | 1,7% | 3 Jan 2020 |
|
CVE-2019-19087
gitlab
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).
|
4.3 Medium | — | 0,66% | 3 Jan 2020 |
|
CVE-2019-19086
gitlab
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).
|
4.3 Medium | — | 0,66% | 3 Jan 2020 |
|
CVE-2020-1871
huawei usg9500 firmware
USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials man...
|
8.2 High | — | 0,64% | 3 Jan 2020 |
|
CVE-2020-1785
huawei mate 10 pro firmware, huawei honor v10 firmware +2 lainnya
Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly check the status of certain module during certain o...
|
5.5 Medium | — | 0,48% | 3 Jan 2020 |
|
CVE-2019-5304
huawei ar120-s firmware, huawei ar1200 firmware +9 lainnya
Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to...
|
7.5 High | — | 0,97% | 3 Jan 2020 |
|
CVE-2019-19441
huawei p30 firmware
HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send specific command in the local ar...
|
6.5 Medium | — | 0,34% | 3 Jan 2020 |
|
CVE-2019-20330
fasterxml jackson-databind, oracle banking platform +28 lainnya
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
|
9.8 Critical | — | 8,6% | 3 Jan 2020 |
|
CVE-2020-5313
python pillow, canonical ubuntu linux +2 lainnya
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
|
7.1 High | — | 2,8% | 3 Jan 2020 |
|
CVE-2020-5312
python pillow, canonical ubuntu linux +2 lainnya
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
|
9.8 Critical | — | 3,7% | 3 Jan 2020 |
|
CVE-2020-5311
python pillow, canonical ubuntu linux +2 lainnya
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
|
9.8 Critical | — | 4,2% | 3 Jan 2020 |
|
CVE-2020-5310
python pillow, canonical ubuntu linux +1 lainnya
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
|
8.8 High | — | 2,0% | 3 Jan 2020 |
|
CVE-2019-20329
openlambda project openlambda
OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
|
8.1 High | — | 0,61% | 3 Jan 2020 |
|
CVE-2016-1000027
vmware spring framework
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how th...
|
9.8 Critical | — | 33,2% | 2 Jan 2020 |
|
CVE-2014-8182
openldap, debian linux
An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker cou...
|
7.5 High | — | 3,1% | 2 Jan 2020 |
|
CVE-2014-6275
fusionforge, debian linux
FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same...
|
5.9 Medium | — | 0,94% | 2 Jan 2020 |
|
CVE-2013-1642
quixplorer project quixplorer
Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir, (2) item, (3...
|
6.1 Medium | — | 1,6% | 2 Jan 2020 |
|
CVE-2013-1420
get-simple getsimple cms
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter t...
|
6.1 Medium | — | 1,1% | 2 Jan 2020 |
|
CVE-2013-0737
boltwire
Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the fieldnames parameter.
|
6.1 Medium | — | 0,88% | 2 Jan 2020 |
Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum
menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat
kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah
perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan
dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk
yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.