December 2009
445 CVEs published, +43% on November 2009 and −16% on December 2008. CISA added 0 to KEV.
2009 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2009 | January 2009: 469 CVEs | February 2009: 689 CVEs | March 2009: 566 CVEs | April 2009: 570 CVEs | May 2009: 367 CVEs | June 2009: 452 CVEs | July 2009: 449 CVEs | August 2009: no snapshot | September 2009: 576 CVEs | October 2009: 353 CVEs | November 2009: 311 CVEs | December 2009: 445 CVEs | 5,24711 of 12 months11/12 |
- Critical
- 9121% of the 440 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 4558 days after publication
- Vendors
- 252387 products
- Top weakness
- XSSCWE-79 · 93 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1IBMDB2, Aix, Infosphere Information Server222nonenew
- 2MicrosoftWindows 2000, Windows Xp, Windows 2003 Server1914nonenew
- 3HPOpenview Network Node Manager, Openview Storage Data Protector, Nonstop Server1817nonenew
- 4MozillaFirefox, Seamonkey, Thunderbird136nonenew
- 5AdobeAdobe Air, Flash Player, Flash Media Server1181new
- 6SunJava System Directory Server, Ray Server Software, Opensolaris111nonenew
- 7LinuxLinux Kernel100nonenew
- 8CiscoWebex, Adaptive Security Appliance 5500, Adaptive Security Appliance Web SSL VPN96nonenew
- 9MoodleMoodle90nonenew
- 10Fr.simon RundellSte Parish Admin, Hs Religiousartgallery, Pd Resources80nonenew
- 11CutephpCutenews60nonenew
- 12Red HatJboss Enterprise Application Platform, Red Hat Enterprise Linux, Enterprise Mrg60nonenew
- 13ScriptsezEz Blog, Ez Poll Hoster, Ez Cart60nonenew
- 14Sql-ledgerSql-ledger60nonenew
- 15KORN19Utf-8 Cutenews50nonenew
- 16Novell Inc.Opensuse50nonenew
- 17ZabbixZabbix51nonenew
- 18Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux50nonenew
- 19ActivewebsoftwaresActive Auction House, Active Bids, Active Business Directory40nonenew
- 20AlienvaultOpen Source Security Information Management40nonenew
- 21DeluxebbDeluxebb40nonenew
- 22NullsoftWinamp44nonenew
- 23PHPPHP41nonenew
- 24ApcSwitched Rack Pdu, Network Management Card, AP7932 B230nonenew
- 25DrupalDrupal30nonenew
Severity
How this month's CVEs score on CVSS; 5 have no score yet. Severity is not exploitation.
- Critical91
- High113
- Medium216
- Low20
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS93
- CWE-119Memory Buffer Bounds57
- CWE-89SQL Injection55
- CWE-26430
- CWE-22Path Traversal22
- CWE-200Information Exposure21
- CWE-94Code Injection19
- CWE-39913
- CWE-18912
- CWE-20Improper Input Validation11
- CWE-352CSRF11
- CWE-287Improper Authentication9
- CWE-2557
- CWE-3106
- CWE-165
- CWE-362Race Condition5
- CWE-594
- CWE-416Use After Free2
- CWE-284Improper Access Control1
- CWE-400Resource Consumption1
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 119Memory Buffer Bounds | 89SQL Injection | 264 | 22Path Traversal | 200Information Exposure | 94Code Injection | 399 | 189 | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| IBM | 2 | 3 | 4 | 3 | 2 | |||||
| Microsoft | 3 | 6 | 4 | 1 | 2 | |||||
| HP | 12 | 1 | ||||||||
| Mozilla | 1 | 1 | 2 | 1 | ||||||
| Adobe | 2 | 1 | 1 | 1 | 2 | 1 | ||||
| Sun | 1 | 1 | ||||||||
| Linux | 2 | 1 | 2 | 1 | ||||||
| Cisco | 6 | 2 | ||||||||
| Moodle | 1 | 2 | 3 | |||||||
| Fr.simon Rundell | 4 | 4 | ||||||||
| Cutephp | 3 | 1 | 1 | |||||||
| Scriptsez | 4 |