Katalog CVE (hal. 5366)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 268.727 (Critical 36.905 · High 107.470 · KEV 1.768 · sejak 2020) · Pembaruan terakhir: 6 Nov 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 268.251–268.300 dari 268.727 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2019-1064 microsoft windows 10 1607, microsoft windows 10 1703 +9 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this v...	7.8 High	KEV · ransomware	6,9%	12 Jun 2019
CVE-2010-5330 ui airos On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by...	9.8 Critical	KEV	40,2%	11 Jun 2019
CVE-2019-10149 exim, canonical ubuntu linux +1 lainnya A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote co...	9.8 Critical	KEV	100,0%	5 Jun 2019
CVE-2018-13382 fortinet fortiproxy, fortinet fortios An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0...	7.5 High	KEV · ransomware	81,7%	4 Jun 2019
CVE-2018-13379 fortinet fortiproxy, fortinet fortios An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2....	9.8 Critical	KEV · ransomware	100,0%	4 Jun 2019
CVE-2019-11580 atlassian crowd Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated...	9.8 Critical	KEV · ransomware	95,4%	3 Jun 2019
CVE-2019-9875 sitecore cms Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET...	8.8 High	KEV	25,4%	31 Mei 2019
CVE-2019-9874 sitecore cms, sitecore experience platform Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated...	9.8 Critical	KEV	83,7%	31 Mei 2019
CVE-2019-9670 synacor zimbra collaboration suite mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/...	9.8 Critical	KEV	100,0%	29 Mei 2019
CVE-2018-13383 fortinet fortiproxy, fortinet fortios A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in...	6.5 Medium	KEV · ransomware	32,5%	29 Mei 2019
CVE-2018-7841 schneider-electric u.motion builder A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is e...	9.8 Critical	KEV	72,5%	22 Mei 2019
CVE-2019-11634 citrix receiver, citrix workspace Citrix Workspace App before 1904 for Windows has Incorrect Access Control.	9.8 Critical	KEV · ransomware	8,1%	22 Mei 2019
CVE-2019-0903 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vu...	8.8 High	KEV	21,7%	16 Mei 2019
CVE-2019-0863 microsoft windows 10 1507, microsoft windows 10 1607 +14 lainnya An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.	7.8 High	KEV	5,2%	16 Mei 2019
CVE-2019-0708 microsoft windows 7, microsoft windows server 2008 +52 lainnya A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system...	9.8 Critical	KEV · ransomware	100,0%	16 Mei 2019
CVE-2018-14839 lg n1a1 firmware LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.	9.8 Critical	KEV	89,2%	14 Mei 2019
CVE-2019-3568 whatsapp, whatsapp business A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue...	9.8 Critical	KEV	30,1%	14 Mei 2019
CVE-2019-11510 ivanti connect secure In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafte...	10.0 Critical	KEV · ransomware	100,0%	8 Mei 2019
CVE-2018-4063 sierrawireless aleos An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can...	8.8 High	KEV	27,3%	6 Mei 2019
CVE-2017-18368 billion 5200w-t firmware, zyxel p660hn-t1a v2 firmware +1 lainnya The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forward...	9.8 Critical	KEV	94,5%	2 Mei 2019
CVE-2019-3929 crestron am-100 firmware, crestron am-101 firmware +10 lainnya The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19,...	9.8 Critical	KEV	99,0%	30 Apr 2019
CVE-2019-9621 synacor zimbra collaboration suite Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServ...	7.5 High	KEV	81,0%	30 Apr 2019
CVE-2019-2725 oracle agile product lifecycle management, oracle communications converged application server +6 lainnya Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12...	9.8 Critical	KEV · ransomware	100,0%	26 Apr 2019
CVE-2019-11539 ivanti connect secure In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version...	7.2 High	KEV · ransomware	98,5%	26 Apr 2019
CVE-2019-2616 oracle business intelligence publisher Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affect...	7.2 High	KEV	92,2%	23 Apr 2019
CVE-2019-3398 atlassian confluence server Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pa...	8.8 High	KEV	97,0%	18 Apr 2019
CVE-2019-0859 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	4,2%	9 Apr 2019
CVE-2019-0841 microsoft windows 10 1703, microsoft windows 10 1709 +4 lainnya An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerabi...	7.8 High	KEV · ransomware	41,4%	9 Apr 2019
CVE-2019-0803 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV · ransomware	45,2%	9 Apr 2019
CVE-2019-0752 microsoft internet explorer A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption...	7.5 High	KEV · ransomware	81,7%	9 Apr 2019
CVE-2019-0808 microsoft windows 7, microsoft windows server 2008 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	53,0%	9 Apr 2019
CVE-2019-0797 microsoft windows 10 1507, microsoft windows 10 1607 +11 lainnya An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnera...	7.8 High	KEV	1,9%	9 Apr 2019
CVE-2019-0703 microsoft windows 10 1507, microsoft windows 10 1607 +13 lainnya An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. Th...	6.5 Medium	KEV	9,4%	9 Apr 2019
CVE-2019-0211 apache http server, fedoraproject fedora +21 lainnya In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts ex...	7.8 High	KEV	65,0%	8 Apr 2019
CVE-2019-11001 reolink rlc-410w firmware, reolink c1 pro firmware +3 lainnya On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS com...	7.2 High	KEV	37,5%	8 Apr 2019
CVE-2018-4344 apple iphone os, apple mac os x +2 lainnya A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.	7.8 High	KEV	2,4%	3 Apr 2019
CVE-2019-5418 rubyonrails rails, debian linux +4 lainnya There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents o...	7.5 High	KEV	98,5%	27 Mar 2019
CVE-2019-10068 kentico xperience An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, i...	9.8 Critical	KEV	95,1%	26 Mar 2019
CVE-2019-7609 elastic kibana, redhat openshift container platform Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could sen...	10.0 Critical	KEV	95,3%	25 Mar 2019
CVE-2019-3396 atlassian confluence server The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.1...	9.8 Critical	KEV · ransomware	99,9%	25 Mar 2019
CVE-2019-9978 warfareplugins social warfare, warfareplugins social warfare pro The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in...	6.1 Medium	KEV	72,9%	24 Mar 2019
CVE-2019-7238 sonatype nexus repository manager Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.	9.8 Critical	KEV	76,6%	21 Mar 2019
CVE-2019-1003030 jenkins pipeline, redhat openshift container platform A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java...	9.9 Critical	KEV	97,1%	8 Mar 2019
CVE-2019-1003029 jenkins script security, redhat openshift container platform A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbo...	9.9 Critical	KEV	74,4%	8 Mar 2019
CVE-2018-18809 tibco jasperreports library, tibco jasperreports server +2 lainnya The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for Act...	6.5 Medium	KEV	79,1%	7 Mar 2019
CVE-2019-0676 microsoft internet explorer An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could...	6.5 Medium	KEV	8,1%	5 Mar 2019
CVE-2019-0604 microsoft sharepoint enterprise server, microsoft sharepoint foundation +1 lainnya A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoi...	9.8 Critical	KEV · ransomware	99,9%	5 Mar 2019
CVE-2019-6223 apple iphone os, apple mac os x A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10....	7.5 High	KEV	2,6%	5 Mar 2019
CVE-2019-9082 thinkphp, opensourcebms open source background management system +1 lainnya ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_...	8.8 High	KEV	97,4%	24 Feb 2019
CVE-2019-6340 drupal Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code exe...	8.1 High	KEV	92,0%	21 Feb 2019

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.