April 2009
570 CVEs published, +1% on March 2009 and +24% on April 2008. CISA added 0 to KEV.
2009 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 | January 2009: 469 CVEs | February 2009: 689 CVEs | March 2009: 566 CVEs | April 2009: 570 CVEs | May 2009: 367 CVEs | June 2009: 452 CVEs | July 2009: 449 CVEs | August 2009: no snapshot | September 2009: 576 CVEs | October 2009: 353 CVEs | November 2009: 311 CVEs | December 2009: 445 CVEs | 5,24711 of 12 months11/12 |
- Critical
- 8916% of the 567 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 6123 days after publication
- Vendors
- 283475 products
- Top weakness
- XSSCWE-79 · 77 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleApplication Server, Database 10g, Database 11g433nonenew
- 2MicrosoftWindows Xp, Windows 2000, Windows Vista23121new
- 3AppleCups, Mac OS X, Mac OS X Server202nonenew
- 4Novell Inc.Suse Linux Enterprise, Opensuse182nonenew
- 5IBMWebsphere Portal, Advanced Management Module, Bladecenter142nonenew
- 6MozillaFirefox, Seamonkey, Thunderbird141nonenew
- 7FoolabsXpdf131nonenew
- 8GlyphandcogXpdfreader131nonenew
- 9Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux122nonenew
- 10SunOpensolaris, Solaris, Openjdk110nonenew
- 11ApacheStruts, Geronimo, Mod Jk101nonenew
- 12PopplerPoppler100nonenew
- 13AvayaCommunication Manager, Sip Enablement Services94nonenew
- 14Gentoo Foundation Inc.Gentoo Linux91nonenew
- 15HPStorageworks Storage Mirroring, Hp-ux, Openview Network Node Manager93nonenew
- 16LinuxLinux Kernel90nonenew
- 17CiscoPix, Adaptive Security Appliance 5500, IOS80nonenew
- 18DebianDebian Linux, Advanced Package Tool, Apt82nonenew
- 19MavenOrg.apache.geronimo.plugins:console, Org.apache.struts:struts2-core, Org.apache.struts:struts2-dojo-plugin81nonenew
- 20VMwareAce, Workstation, Player81nonenew
- 21CanonicalUbuntu Linux71nonenew
- 22Mini-streamWm Downloader, Asx To MP3 Converter, Easy Rm To MP3 Converter77nonenew
- 23Red HatRed Hat Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Eus72nonenew
- 24SymantecEndpoint Protection, Antivirus, Client Security74nonenew
- 25PeterselieYourplace60nonenew
Severity
How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.
- Critical89
- High147
- Medium316
- Low15
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS77
- CWE-89SQL Injection77
- CWE-119Memory Buffer Bounds48
- CWE-20Improper Input Validation39
- CWE-26435
- CWE-22Path Traversal25
- CWE-94Code Injection25
- CWE-18924
- CWE-39920
- CWE-287Improper Authentication17
- CWE-352CSRF17
- CWE-200Information Exposure16
- CWE-167
- CWE-2554
- CWE-362Race Condition4
- CWE-594
- CWE-134Format String3
- CWE-3103
- CWE-8242
- CWE-120Buffer Overflow1
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins16726% of sector-tagged CVEs
- Operating Systems9916% of sector-tagged CVEs
- Consumer Software6410% of sector-tagged CVEs
- Databases508% of sector-tagged CVEs
- OSS Libraries508% of sector-tagged CVEs
- Enterprise Software376% of sector-tagged CVEs
- Security Products295% of sector-tagged CVEs
- Mobile Apps234% of sector-tagged CVEs
- 5 smaller sectors54
- Not yet classified63
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 119Memory Buffer Bounds | 20Improper Input Validation | 264 | 22Path Traversal | 94Code Injection | 189 | 399 | 287Improper Authentication |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | ||||||||||
| Microsoft | 1 | 2 | 2 | 2 | 3 | 2 | 4 | |||
| Apple | 5 | 3 | 1 | 3 | 5 | |||||
| Novell Inc. | 4 | 2 | 1 | 5 | 4 | |||||
| IBM | 2 | 1 | 1 | |||||||
| Mozilla | 2 | 2 | 4 | |||||||
| Foolabs | 4 | 1 | 1 | 3 | 4 | |||||
| Glyphandcog | 4 | 1 | 1 | 3 | 4 | |||||
| Gentoo Foundation Inc. | 1 | 3 | 3 | |||||||
| Sun | 1 | 3 | 1 | 1 | ||||||
| Сообщество Свободного Программного Обеспечения | 1 | 4 | 2 | |||||||
| Apache | 5 | 1 |