Katalog CVE (hal. 5361)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 268.727 (Critical 36.905 · High 107.470 · KEV 1.768 · sejak 2020) · Pembaruan terakhir: 6 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 268.001–268.050 dari 268.727 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2015-5951 thomsonreuters fatca A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP files to the web root and exe...	9.9 Critical	—	2,7%	6 Jan 2020
CVE-2015-4553 dedecms A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.	8.8 High	—	56,7%	6 Jan 2020
CVE-2020-5513 gilacms gila cms Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.	6.8 Medium	—	25,8%	6 Jan 2020
CVE-2020-5512 gilacms gila cms Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.	6.8 Medium	—	18,9%	6 Jan 2020
CVE-2020-5204 troglobit uftpd In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() wit...	8.8 High	—	1,1%	6 Jan 2020
CVE-2019-19585 rconfig An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" up...	7.8 High	—	5,7%	6 Jan 2020
CVE-2019-19509 rconfig An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the pa...	8.8 High	—	71,6%	6 Jan 2020
CVE-2019-18179 otrs, debian linux +2 lainnya An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x through 6.0.23. An attacker who is...	4.3 Medium	—	1,6%	6 Jan 2020
CVE-2019-16717 open-xchange appsuite OX App Suite through 7.10.2 has XSS.	6.1 Medium	—	1,5%	6 Jan 2020
CVE-2019-16716 open-xchange appsuite OX App Suite through 7.10.2 has Incorrect Access Control.	6.6 Medium	—	1,7%	6 Jan 2020
CVE-2019-16274 dten d5 firmware, dten d7 firmware DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.	7.5 High	—	0,67%	6 Jan 2020
CVE-2019-16273 dten d5 firmware, dten d7 firmware DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading to arbitrary code execution and system administrat...	9.8 Critical	—	2,3%	6 Jan 2020
CVE-2019-16272 dten d5 firmware, dten d7 firmware On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement.	9.8 Critical	—	1,2%	6 Jan 2020
CVE-2014-3743 marked project marked Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vector...	6.1 Medium	—	1,7%	6 Jan 2020
CVE-2020-5515 gilacms gila cms Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.	7.2 High	—	26,5%	6 Jan 2020
CVE-2020-5514 gilacms gila cms Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.	9.1 Critical	—	44,1%	6 Jan 2020
CVE-2015-4039 e-plugins wp membership Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTM...	5.4 Medium	—	2,8%	6 Jan 2020
CVE-2020-5840 hashbrowncms hashbrown cms An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field.	7.5 High	—	1,5%	6 Jan 2020
CVE-2019-9472 google android In DCRYPTO_equals of compare.c, there is a possible timing attack due to improperly used crypto. This could lead to local information disclosure with no additional execut...	5.5 Medium	—	0,14%	6 Jan 2020
CVE-2019-9471 google android In set_outbound_iatu of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System ex...	6.7 Medium	—	0,16%	6 Jan 2020
CVE-2019-9470 google android In dma_sblk_start of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execu...	6.7 Medium	—	0,16%	6 Jan 2020
CVE-2019-9469 google android In km_compute_shared_hmac of km4.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no add...	7.8 High	—	0,16%	6 Jan 2020
CVE-2019-9468 google android In export_key_der of export_key.cpp, there is possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional executi...	7.8 High	—	0,16%	6 Jan 2020
CVE-2019-18792 oisf suricata, debian linux An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet...	9.1 Critical	—	2,5%	6 Jan 2020
CVE-2019-15603 seeftl project seeftl The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.	6.1 Medium	—	0,75%	6 Jan 2020
CVE-2019-15602 itwork fileview The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.	6.1 Medium	—	0,75%	6 Jan 2020
CVE-2016-11017 akips network monitor The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters...	9.8 Critical	—	4,4%	6 Jan 2020
CVE-2019-20343 mojohaus exec maven The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an a...	9.8 Critical	—	2,4%	6 Jan 2020
CVE-2020-5519 litespeedtech openlitespeed The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.	9.8 Critical	—	1,2%	6 Jan 2020
CVE-2019-15999 cisco data center network manager A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized access to th...	6.3 Medium	—	3,6%	6 Jan 2020
CVE-2019-15985 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary...	7.2 High	—	3,3%	6 Jan 2020
CVE-2019-15984 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary...	7.2 High	—	46,9%	6 Jan 2020
CVE-2019-15983 cisco data center network manager A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is store...	4.9 Medium	—	1,3%	6 Jan 2020
CVE-2019-15982 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated...	7.2 High	—	14,3%	6 Jan 2020
CVE-2019-15981 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated...	7.2 High	—	14,3%	6 Jan 2020
CVE-2019-15980 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an authenticated...	7.2 High	—	50,0%	6 Jan 2020
CVE-2019-15979 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative...	7.2 High	—	3,3%	6 Jan 2020
CVE-2019-15978 cisco data center network manager Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative...	7.2 High	—	37,5%	6 Jan 2020
CVE-2019-15977 cisco data center network manager Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentica...	7.5 High	—	38,1%	6 Jan 2020
CVE-2019-15976 cisco data center network manager Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentica...	9.8 Critical	—	92,8%	6 Jan 2020
CVE-2019-15975 cisco data center network manager Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentica...	9.8 Critical	—	96,5%	6 Jan 2020
CVE-2019-5990 anglers-net cgi an-anlyzer Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer.	7.5 High	—	1,3%	6 Jan 2020
CVE-2019-5989 anglers-net cgi an-anlyzer DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web scrip...	6.1 Medium	—	0,80%	6 Jan 2020
CVE-2019-5988 anglers-net cgi an-anlyzer Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script o...	6.1 Medium	—	0,80%	6 Jan 2020
CVE-2019-5987 anglers-net cgi an-anlyzer Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management Page.	8.8 High	—	2,5%	6 Jan 2020
CVE-2019-20354 pisignage The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi...	4.3 Medium	—	8,8%	6 Jan 2020
CVE-2019-20352 nasm netwide assembler In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.	7.1 High	—	0,84%	6 Jan 2020
CVE-2020-5192 phpgurukul hospital management system PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and al...	8.8 High	—	23,5%	6 Jan 2020
CVE-2020-5191 phpgurukul hospital management system PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.	6.1 Medium	—	6,2%	6 Jan 2020
CVE-2019-19265 icewarp mail server IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.	6.1 Medium	—	1,0%	6 Jan 2020

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.