November 2009
311 CVEs published, −12% on October 2009 and −28% on November 2008. CISA added 0 to KEV.
2009 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 | January 2009: 469 CVEs | February 2009: 689 CVEs | March 2009: 566 CVEs | April 2009: 570 CVEs | May 2009: 367 CVEs | June 2009: 452 CVEs | July 2009: 449 CVEs | August 2009: no snapshot | September 2009: 576 CVEs | October 2009: 353 CVEs | November 2009: 311 CVEs | December 2009: 445 CVEs | 5,24711 of 12 months11/12 |
- Critical
- 6621% of the 308 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 4495 days after publication
- Vendors
- 167275 products
- Top weakness
- XSSCWE-79 · 46 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1SunJre, Jdk, Sdk3210nonenew
- 2AppleMac OS X, Mac OS X Server, Safari292nonenew
- 3MicrosoftOffice, Open Xml File Format Converter, Excel Viewer20111new
- 4LinuxLinux Kernel, Kernel120nonenew
- 5IBMTivoli Storage Manager, Lotus Notes Intellisync, Powerha95nonenew
- 6TYPO3TYPO390nonenew
- 7HPOpenview Network Node Manager, Discovery\&dependency Mapping Inventory, Nonstop Server74nonenew
- 8PackagistTypo3/cms-backend, Typo3/cms-core, Typo3/cms70nonenew
- 9CanonicalUbuntu Linux61nonenew
- 10DebianDebian Linux51nonenew
- 11PHPPHP50nonenew
- 12Red HatEnterprise Linux Server, Enterprise Linux Desktop, Enterprise Linux Eus50nonenew
- 13AdobeShockwave Player44nonenew
- 14FedoraprojectFedora41nonenew
- 15GoogleChrome42nonenew
- 16MozillaFirefox, Bugzilla, Nss42nonenew
- 17MySQLMySQL40nonenew
- 18OpensuseOpensuse40nonenew
- 19OracleMySQL40nonenew
- 20PearPear, Mail42nonenew
- 21TeleparkTelepark.wiki40nonenew
- 22VMwareEsx, Server, ESXi40nonenew
- 23ApacheHTTP Server, Tomcat31nonenew
- 24Autodesk3ds Max, Alias Wavefront Maya, Autodesk Maya33nonenew
- 25CutephpCutenews30nonenew
Severity
How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.
- Critical66
- High69
- Medium165
- Low8
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS46
- CWE-119Memory Buffer Bounds45
- CWE-89SQL Injection26
- CWE-94Code Injection25
- CWE-26419
- CWE-20Improper Input Validation17
- CWE-39915
- CWE-22Path Traversal10
- CWE-200Information Exposure9
- CWE-352CSRF9
- CWE-3107
- CWE-287Improper Authentication6
- CWE-1895
- CWE-2553
- CWE-362Race Condition3
- CWE-190Integer Overflow2
- CWE-592
- CWE-732Incorrect Permissions2
- CWE-787Out-of-bounds Write2
- CWE-125Out-of-bounds Read1
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 119Memory Buffer Bounds | 89SQL Injection | 94Code Injection | 264 | 20Improper Input Validation | 399 | 22Path Traversal | 200Information Exposure | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Sun | 6 | 1 | 2 | 4 | 1 | 3 | ||||
| Apple | 2 | 6 | 2 | 1 | 3 | 1 | ||||
| Microsoft | 2 | 8 | 2 | 2 | 1 | |||||
| Linux | 2 | 2 | 1 | 3 | ||||||
| IBM | 1 | 3 | 1 | |||||||
| TYPO3 | 3 | 1 | 1 | 1 | 1 | |||||
| HP | 2 | 1 | ||||||||
| Packagist | 2 | 1 | 1 | 1 | ||||||
| Canonical | 1 | |||||||||
| Debian | ||||||||||
| PHP | 3 | |||||||||
| Adobe | 1 | 2 | 1 |