Katalog CVE (hal. 5360)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 268.727 (Critical 36.905 · High 107.470 · KEV 1.768 · sejak 2020) · Pembaruan terakhir: 6 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 267.951–268.000 dari 268.727 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2020-6170 genexis platinum-4410 firmware An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML source code of t...	9.8 Critical	—	7,3%	8 Jan 2020
CVE-2019-20361 icegram email subscribers & newsletters There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a...	9.8 Critical	—	85,1%	8 Jan 2020
CVE-2019-20360 givewp A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (P...	7.5 High	—	2,5%	8 Jan 2020
CVE-2020-6163 mediawiki The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/P...	6.1 Medium	—	0,70%	8 Jan 2020
CVE-2014-5209 ntp, f5 big-ip access policy manager +11 lainnya An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sen...	5.3 Medium	—	2,5%	8 Jan 2020
CVE-2019-17151 tencent wechat This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required...	5.4 Medium	—	1,4%	7 Jan 2020
CVE-2019-17148 parallels desktop This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An attacker must...	7.8 High	—	0,50%	7 Jan 2020
CVE-2019-17147 tp-link tl-wr841n firmware This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit thi...	8.8 High	—	13,7%	7 Jan 2020
CVE-2019-17146 dlink dcs-935l firmware, dlink dcs-960l firmware This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to exploit thi...	9.8 Critical	—	9,5%	7 Jan 2020
CVE-2019-18652 watchguard xmt515 firmware A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tri...	6.1 Medium	—	0,77%	7 Jan 2020
CVE-2020-5841 opservices opmon An issue was discovered in OpServices OpMon 9.3.1-1. Using password change parameters, an attacker could perform SQL injection without authentication.	9.8 Critical	—	1,2%	7 Jan 2020
CVE-2019-6529 kunbus pr100088 modbus gateway firmware An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Version 1.1.13166).	4.9 Medium	—	1,0%	7 Jan 2020
CVE-2019-14906 libsdl simple directmedia layer, redhat enterprise linux A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions th...	9.8 Critical	—	1,8%	7 Jan 2020
CVE-2020-5842 codologic codoforum Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin...	6.1 Medium	—	1,8%	7 Jan 2020
CVE-2020-5307 phpgurukul dairy farm shop management system PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode par...	9.8 Critical	—	16,6%	7 Jan 2020
CVE-2019-9465 google android In the Titan M handling of cryptographic operations, there is a possible information disclosure due to an unusual root cause. This could lead to local information disclos...	5.5 Medium	—	0,27%	7 Jan 2020
CVE-2019-6700 fortinet fortisiem An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the exter...	6.5 Medium	—	0,89%	7 Jan 2020
CVE-2019-18386 unisys mcp firmware Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when receiving specifically crafted mes...	8.7 High	—	0,79%	7 Jan 2020
CVE-2019-16154 fortinet fortiauthenticator An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting atta...	6.1 Medium	—	0,70%	7 Jan 2020
CVE-2019-10776 git-diff-apply project git-diff-apply In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to...	9.8 Critical	—	2,1%	7 Jan 2020
CVE-2018-10465 jamf Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universa...	8.8 High	—	1,2%	7 Jan 2020
CVE-2019-14819 redhat openshift container platform A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespac...	8.8 High	—	1,1%	7 Jan 2020
CVE-2014-8673 soplanning Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33.	9.8 Critical	—	11,9%	7 Jan 2020
CVE-2019-14879 moodle A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capa...	5.4 Medium	—	0,71%	7 Jan 2020
CVE-2019-14866 gnu cpio, redhat enterprise linux In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker c...	7.3 High	—	0,69%	7 Jan 2020
CVE-2019-14854 redhat openshift container platform OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged...	6.5 Medium	—	0,80%	7 Jan 2020
CVE-2019-14843 redhat single sign-on, redhat jboss enterprise application platform A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed o...	8.8 High	—	1,2%	7 Jan 2020
CVE-2019-14837 redhat keycloak, redhat single sign-on A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset...	9.1 Critical	—	1,7%	7 Jan 2020
CVE-2019-14834 thekelleys dnsmasq, fedoraproject fedora A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors invo...	3.7 Low	—	2,7%	7 Jan 2020
CVE-2013-5658 aultware pwstore AultWare pwStore 2010.8.30.0 has XSS	6.1 Medium	—	1,5%	7 Jan 2020
CVE-2013-5657 aultware pwstore AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request	7.5 High	—	6,8%	7 Jan 2020
CVE-2013-5656 fuzezip project fuzezip FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability	7.8 High	—	1,5%	7 Jan 2020
CVE-2013-5638 transcend-info wifisd firmware Transcend WiFiSD 1.8 has persistent XSS	5.4 Medium	—	0,58%	7 Jan 2020
CVE-2013-5637 pqigroup air card firmware PQI AirCard has persistent XSS	5.4 Medium	—	0,49%	7 Jan 2020
CVE-2020-5393 appspace on-prem In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS.	6.1 Medium	—	0,71%	7 Jan 2020
CVE-2013-5571 hmailserver HMailServer 5.3.x and prior: Memory Corruption which could cause DOS	5.9 Medium	—	0,89%	7 Jan 2020
CVE-2013-5122 cisco linksys ea2700 firmware, cisco linksys ea3500 firmware +2 lainnya Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access	9.8 Critical	—	3,7%	7 Jan 2020
CVE-2020-5843 codologic codoforum Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.	4.8 Medium	—	0,55%	7 Jan 2020
CVE-2019-6857 schneider-electric modicon m580 firmware, schneider-electric modicon m340 firmware +27 lainnya A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notific...	7.5 High	—	1,6%	6 Jan 2020
CVE-2019-6856 schneider-electric modicon m580 firmware, schneider-electric modicon m340 firmware +27 lainnya A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notific...	7.5 High	—	1,6%	6 Jan 2020
CVE-2019-6855 schneider-electric ecostruxure control expert, schneider-electric unity pro +21 lainnya Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prio...	7.3 High	—	0,96%	6 Jan 2020
CVE-2019-6854 schneider-electric clearscada A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which c...	7.8 High	—	0,17%	6 Jan 2020
CVE-2018-7794 schneider-electric modicon m580 firmware, schneider-electric modicon m340 firmware +27 lainnya A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notific...	7.5 High	—	1,4%	6 Jan 2020
CVE-2014-9405 freebox os A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious u...	5.4 Medium	—	1,5%	6 Jan 2020
CVE-2014-8674 soplanning Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the deb...	5.4 Medium	—	2,6%	6 Jan 2020
CVE-2020-5846 ahsay cloud backup suite An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pat...	8.8 High	—	1,4%	6 Jan 2020
CVE-2019-20348 okerthai g232v1 firmware OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to inte...	6.8 Medium	—	0,56%	6 Jan 2020
CVE-2019-18842 usriot usr-wifi232-s firmware, usriot usr-wifi232-t firmware +2 lainnya A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allow...	6.1 Medium	—	0,69%	6 Jan 2020
CVE-2019-18625 oisf suricata, debian linux An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN...	7.5 High	—	1,7%	6 Jan 2020
CVE-2019-16271 dten d5 firmware, dten d7 firmware DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on TCP port 8080 without authent...	5.3 Medium	—	1,6%	6 Jan 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.