Katalog CVE (hal. 5356)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 268.197 (Critical 36.842 · High 107.199 · KEV 1.768 · sejak 2020) · Pembaruan terakhir: 5 Nov 2026, 12:28 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 267.751–267.800 dari 268.197 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-0808 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	53,0%	9 Apr 2019
CVE-2019-0797 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	1,9%	9 Apr 2019
CVE-2019-0703 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Th...	6.5 Medium	KEV	9,4%	9 Apr 2019
CVE-2019-0211 apache http server, fedoraproject fedora +21 lainnya In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts ex...	7.8 High	KEV	65,0%	8 Apr 2019
CVE-2019-11001 reolink rlc-410w firmware, reolink c1 pro firmware +3 lainnya On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS com...	7.2 High	KEV	37,5%	8 Apr 2019
CVE-2018-4344 apple iphone os, apple mac os x +2 lainnya A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.	7.8 High	KEV	2,4%	3 Apr 2019
CVE-2019-5418 rubyonrails rails, debian linux +4 lainnya There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents o...	7.5 High	KEV	98,5%	27 Mar 2019
CVE-2019-10068 kentico xperience An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, i...	9.8 Critical	KEV	95,1%	26 Mar 2019
CVE-2019-7609 elastic kibana, redhat openshift container platform Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could sen...	10.0 Critical	KEV	95,3%	25 Mar 2019
CVE-2019-3396 atlassian confluence server The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.1...	9.8 Critical	KEV · ransomware	99,9%	25 Mar 2019
CVE-2019-9978 warfareplugins social warfare, warfareplugins social warfare pro The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in...	6.1 Medium	KEV	72,9%	24 Mar 2019
CVE-2019-7238 sonatype nexus repository manager Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.	9.8 Critical	KEV	76,6%	21 Mar 2019
CVE-2019-1003030 jenkins pipeline, redhat openshift container platform A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java...	9.9 Critical	KEV	97,1%	8 Mar 2019
CVE-2019-1003029 jenkins script security, redhat openshift container platform A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbo...	9.9 Critical	KEV	74,4%	8 Mar 2019
CVE-2018-18809 tibco jasperreports library, tibco jasperreports server +2 lainnya The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for Act...	6.5 Medium	KEV	79,1%	7 Mar 2019
CVE-2019-0676 microsoft internet explorer An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could...	6.5 Medium	KEV	8,1%	5 Mar 2019
CVE-2019-0604 microsoft sharepoint enterprise server, microsoft sharepoint foundation +1 lainnya A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoi...	9.8 Critical	KEV · ransomware	99,9%	5 Mar 2019
CVE-2019-6223 apple iphone os, apple mac os x A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10....	7.5 High	KEV	2,6%	5 Mar 2019
CVE-2019-9082 thinkphp, opensourcebms open source background management system +1 lainnya ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_...	8.8 High	KEV	97,4%	24 Feb 2019
CVE-2019-6340 drupal Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code exe...	8.1 High	KEV	92,0%	21 Feb 2019
CVE-2019-8394 zohocorp manageengine servicedesk plus Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.	6.5 Medium	KEV	63,3%	17 Feb 2019
CVE-2018-20250 rarlab winrar In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filena...	7.8 High	KEV · ransomware	96,0%	5 Feb 2019
CVE-2018-20753 kaseya virtual system administrator Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devi...	9.8 Critical	KEV · ransomware	29,6%	5 Feb 2019
CVE-2017-18362 connectwise manageditsync ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA databas...	9.8 Critical	KEV · ransomware	86,8%	5 Feb 2019
CVE-2019-1653 cisco rv320 firmware, cisco rv325 firmware A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker...	7.5 High	KEV	99,9%	24 Jan 2019
CVE-2019-1652 cisco rv320 firmware, cisco rv325 firmware A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker w...	7.2 High	KEV	95,9%	24 Jan 2019
CVE-2018-13374 fortinet fortiadc, fortinet fortios A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login cred...	4.3 Medium	KEV · ransomware	38,1%	22 Jan 2019
CVE-2018-15982 adobe flash player, redhat enterprise linux desktop +3 lainnya Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code executi...	7.8 High	KEV · ransomware	89,6%	18 Jan 2019
CVE-2019-0543 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This...	7.8 High	KEV · ransomware	4,7%	8 Jan 2019
CVE-2019-0541 microsoft internet explorer, microsoft excel viewer +3 lainnya A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This a...	8.8 High	KEV	53,2%	8 Jan 2019
CVE-2018-19323 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes f...	9.8 Critical	KEV · ransomware	8,4%	21 Des 2018
CVE-2018-19322 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2...	7.8 High	KEV · ransomware	1,8%	21 Des 2018
CVE-2018-19321 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2...	7.8 High	KEV · ransomware	3,7%	21 Des 2018
CVE-2018-19320 gigabyte aorus graphics engine, gigabyte app center +2 lainnya The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes r...	7.8 High	KEV · ransomware	4,6%	21 Des 2018
CVE-2018-8653 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption...	7.5 High	KEV	29,6%	20 Des 2018
CVE-2018-8639 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	22,3%	12 Des 2018
CVE-2018-8611 microsoft windows 10 1607, microsoft windows 10 1703 +10 lainnya An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerabilit...	7.8 High	KEV	4,2%	12 Des 2018
CVE-2018-20062 5none nonecms An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as...	9.8 Critical	KEV	99,5%	11 Des 2018
CVE-2018-17480 google chrome, redhat enterprise linux desktop +3 lainnya Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacke...	8.8 High	KEV	35,6%	11 Des 2018
CVE-2018-1000861 jenkins, redhat openshift container platform A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/st...	9.8 Critical	KEV	98,3%	10 Des 2018
CVE-2018-19410 paessler prtg network monitor PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenti...	9.8 Critical	KEV	97,9%	21 Nov 2018
CVE-2018-6065 google chrome, redhat enterprise linux desktop +4 lainnya Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attac...	8.8 High	KEV	60,3%	14 Nov 2018
CVE-2018-17463 google chrome, redhat enterprise linux desktop +3 lainnya Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...	8.8 High	KEV	84,6%	14 Nov 2018
CVE-2018-8589 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affect...	7.8 High	KEV	3,0%	14 Nov 2018
CVE-2018-8581 microsoft exchange server An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft...	7.4 High	KEV · ransomware	27,6%	14 Nov 2018
CVE-2018-14667 redhat richfaces, redhat enterprise linux The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could expl...	9.8 Critical	KEV	74,2%	6 Nov 2018
CVE-2018-14558 tenda ac7 firmware, tenda ac9 firmware +1 lainnya An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices wi...	9.8 Critical	KEV	8,5%	30 Okt 2018
CVE-2018-8453 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	70,0%	10 Okt 2018
CVE-2018-14634 paloaltonetworks pan-os, f5 big-ip access policy manager +11 lainnya An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary cou...	7.8 High	KEV	14,7%	25 Sep 2018
CVE-2018-15961 adobe coldfusion Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful ex...	9.8 Critical	KEV	100,0%	25 Sep 2018

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.