Katalog CVE (hal. 5355)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 268.197 (Critical 36.842 · High 107.199 · KEV 1.768 · sejak 2020) · Pembaruan terakhir: 5 Nov 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 267.701–267.750 dari 268.197 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-15107 webmin An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.	9.8 Critical	KEV · ransomware	99,7%	16 Agt 2019
CVE-2019-0344 sap commerce cloud Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code...	9.8 Critical	KEV	7,5%	14 Agt 2019
CVE-2019-11581 atlassian jira server There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to...	9.8 Critical	KEV	84,6%	9 Agt 2019
CVE-2019-0193 apache solr, debian linux In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration...	7.2 High	KEV	83,5%	1 Agt 2019
CVE-2019-11708 mozilla firefox, mozilla thunderbird Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web c...	10.0 Critical	KEV	55,9%	23 Jul 2019
CVE-2019-11707 mozilla firefox, mozilla thunderbird A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targete...	8.8 High	KEV	38,0%	23 Jul 2019
CVE-2019-1579 paloaltonetworks pan-os Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interfac...	8.1 High	KEV · ransomware	44,2%	19 Jul 2019
CVE-2019-13272 linux kernel, debian linux +20 lainnya In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, whi...	7.8 High	KEV	52,2%	17 Jul 2019
CVE-2019-12991 citrix netscaler sd-wan, citrix sd-wan Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).	8.8 High	KEV	74,5%	16 Jul 2019
CVE-2019-12989 citrix netscaler sd-wan, citrix sd-wan Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.	9.8 Critical	KEV	95,0%	16 Jul 2019
CVE-2019-1132 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	9,9%	15 Jul 2019
CVE-2019-1130 microsoft windows 10 1507, microsoft windows 10 1607 +12 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	1,7%	15 Jul 2019
CVE-2019-1129 microsoft windows 10 1703, microsoft windows 10 1709 +6 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	1,8%	15 Jul 2019
CVE-2019-1068 Advisory microsoft sql server, microsoft sql server 2016 +1 lainnya A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code E...	8.8 High	KEV	57,3%	15 Jul 2019
CVE-2019-0880 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.	7.8 High	KEV	2,3%	15 Jul 2019
CVE-2018-18325 dnnsoftware dotnetnuke DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-158...	7.5 High	KEV	74,0%	3 Jul 2019
CVE-2018-15811 dnnsoftware dotnetnuke DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.	7.5 High	KEV	76,3%	3 Jul 2019
CVE-2019-7256 nortekcontrol linear emerge essential firmware, nortekcontrol linear emerge elite firmware Linear eMerge E3-Series devices allow Command Injections.	9.8 Critical	KEV	97,1%	2 Jul 2019
CVE-2019-5786 google chrome Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pag...	6.5 Medium	KEV	61,1%	27 Jun 2019
CVE-2019-1069 microsoft windows 10 1507, microsoft windows 10 1607 +9 lainnya An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnera...	7.8 High	KEV · ransomware	6,2%	12 Jun 2019
CVE-2019-1064 microsoft windows 10 1607, microsoft windows 10 1703 +9 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this v...	7.8 High	KEV · ransomware	6,9%	12 Jun 2019
CVE-2010-5330 ui airos On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by...	9.8 Critical	KEV	40,2%	11 Jun 2019
CVE-2019-10149 exim, canonical ubuntu linux +1 lainnya A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote co...	9.8 Critical	KEV	100,0%	5 Jun 2019
CVE-2018-13382 fortinet fortiproxy, fortinet fortios An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0...	7.5 High	KEV · ransomware	81,7%	4 Jun 2019
CVE-2018-13379 fortinet fortiproxy, fortinet fortios An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2....	9.8 Critical	KEV · ransomware	100,0%	4 Jun 2019
CVE-2019-11580 atlassian crowd Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated...	9.8 Critical	KEV · ransomware	95,4%	3 Jun 2019
CVE-2019-9875 sitecore cms Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET...	8.8 High	KEV	25,4%	31 Mei 2019
CVE-2019-9874 sitecore cms, sitecore experience platform Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated...	9.8 Critical	KEV	83,7%	31 Mei 2019
CVE-2019-9670 synacor zimbra collaboration suite mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/...	9.8 Critical	KEV	100,0%	29 Mei 2019
CVE-2018-13383 fortinet fortiproxy, fortinet fortios A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in...	6.5 Medium	KEV · ransomware	32,5%	29 Mei 2019
CVE-2018-7841 schneider-electric u.motion builder A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is e...	9.8 Critical	KEV	72,5%	22 Mei 2019
CVE-2019-11634 citrix receiver, citrix workspace Citrix Workspace App before 1904 for Windows has Incorrect Access Control.	9.8 Critical	KEV · ransomware	8,1%	22 Mei 2019
CVE-2019-0903 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vu...	8.8 High	KEV	21,7%	16 Mei 2019
CVE-2019-0863 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.	7.8 High	KEV	5,2%	16 Mei 2019
CVE-2019-0708 microsoft windows 7, microsoft windows server 2008 +52 lainnya A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system...	9.8 Critical	KEV · ransomware	100,0%	16 Mei 2019
CVE-2018-14839 lg n1a1 firmware LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.	9.8 Critical	KEV	89,2%	14 Mei 2019
CVE-2019-3568 whatsapp, whatsapp business A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue...	9.8 Critical	KEV	30,1%	14 Mei 2019
CVE-2019-11510 ivanti connect secure In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafte...	10.0 Critical	KEV · ransomware	100,0%	8 Mei 2019
CVE-2018-4063 sierrawireless aleos An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can...	8.8 High	KEV	27,3%	6 Mei 2019
CVE-2017-18368 billion 5200w-t firmware, zyxel p660hn-t1a v2 firmware +1 lainnya The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forward...	9.8 Critical	KEV	94,5%	2 Mei 2019
CVE-2019-3929 crestron am-100 firmware, crestron am-101 firmware +10 lainnya The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19,...	9.8 Critical	KEV	99,0%	30 Apr 2019
CVE-2019-9621 synacor zimbra collaboration suite Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServ...	7.5 High	KEV	81,0%	30 Apr 2019
CVE-2019-2725 oracle agile product lifecycle management, oracle communications converged application server +6 lainnya Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12...	9.8 Critical	KEV · ransomware	100,0%	26 Apr 2019
CVE-2019-11539 ivanti connect secure In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version...	7.2 High	KEV · ransomware	98,5%	26 Apr 2019
CVE-2019-2616 oracle business intelligence publisher Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affect...	7.2 High	KEV	92,2%	23 Apr 2019
CVE-2019-3398 atlassian confluence server Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pa...	8.8 High	KEV	97,0%	18 Apr 2019
CVE-2019-0859 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	4,2%	9 Apr 2019
CVE-2019-0841 microsoft windows 10 1703, microsoft windows 10 1709 +4 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	41,4%	9 Apr 2019
CVE-2019-0803 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	45,2%	9 Apr 2019
CVE-2019-0752 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...	7.5 High	KEV · ransomware	81,7%	9 Apr 2019

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.