January 2012
316 CVEs published, −9% on December 2011 and −20% on January 2011. CISA added 0 to KEV.
2012 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2012 | January 2012: 316 CVEs | February 2012: 349 CVEs | March 2012: 405 CVEs | April 2012: 228 CVEs | May 2012: 434 CVEs | June 2012: 413 CVEs | July 2012: 536 CVEs | August 2012: 741 CVEs | September 2012: 655 CVEs | October 2012: 559 CVEs | November 2012: 445 CVEs | December 2012: 270 CVEs | 5,351+28% |
- Critical
- 3912% of the 314 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 3666 days after publication
- Vendors
- 136223 products
- Top weakness
- XSSCWE-79 · 42 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, Fusion Middleware, Jd Edwards Enterpriseone Tools660nonenew
- 2MySQLMySQL170nonenew
- 3ApacheTomcat, Struts, HTTP Server1611new
- 4IBMWebsphere Application Server, Spss Dimensions, Spss Data Collection156nonenew
- 5SitrackerSupport Incident Tracker150nonenew
- 6MavenOrg.apache.tomcat:tomcat, Org.apache.struts.xwork:xwork-core, Org.apache.struts:struts2-core1311new
- 7GoogleChrome, Android, Chrome OS112nonenew
- 8Red HatEnterprise Linux Desktop, Enterprise Linux Workstation, Enterprise Linux Server90nonenew
- 9LinuxLinux Kernel80nonenew
- 10MicrosoftWindows Server 2008, Windows Xp, Windows Server 200385nonenew
- 11OpenSSLOpenSSL81nonenew
- 12SunSunos80nonenew
- 13Gentoo Foundation Inc.Gentoo Linux60nonenew
- 14HPEasy Printer Care Software, Storageworks P2000 G3 Msa Fc\/iscsi Dual Combo Controller Lff Array System, Diagnostics64nonenew
- 15Novell Inc.Opensuse, Suse Linux Enterprise60nonenew
- 16SiemensAutomation License Manager, Tecnomatix Factorylink61nonenew
- 17AdobeAcrobat, Reader53nonenew
- 18DebianDebian Linux50nonenew
- 19WordPressWordPress50nonenew
- 20Apache Software FoundationStruts411new
- 21AppleiPhone OS, Safari, Itunes40nonenew
- 22MozillaBugzilla40nonenew
- 23SplunkSplunk41nonenew
- 24SuseLinux Enterprise Server, Linux Enterprise Software Development Kit40nonenew
- 25TencentMicroblogpad, Mobileqq, Qqpimsecure40nonenew
Severity
How this month's CVEs score on CVSS; 2 have no score yet. Severity is not exploitation.
- Critical39
- High38
- Medium200
- Low37
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS42
- CWE-26435
- CWE-119Memory Buffer Bounds19
- CWE-200Information Exposure16
- CWE-39913
- CWE-20Improper Input Validation11
- CWE-89SQL Injection11
- CWE-94Code Injection11
- CWE-22Path Traversal9
- CWE-287Improper Authentication7
- CWE-787Out-of-bounds Write7
- CWE-3106
- CWE-352CSRF6
- CWE-1895
- CWE-416Use After Free4
- CWE-2552
- CWE-400Resource Consumption2
- CWE-190Integer Overflow1
- CWE-276Incorrect Default Permissions1
- CWE-591
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Databases7320% of sector-tagged CVEs
- Operating Systems5014% of sector-tagged CVEs
- Web & CMS Plugins4713% of sector-tagged CVEs
- Enterprise Software4011% of sector-tagged CVEs
- OSS Libraries3410% of sector-tagged CVEs
- Mobile Apps164% of sector-tagged CVEs
- Security Products164% of sector-tagged CVEs
- Consumer Software134% of sector-tagged CVEs
- 6 smaller sectors32
- Not yet classified36
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 264 | 119Memory Buffer Bounds | 200Information Exposure | 399 | 20Improper Input Validation | 89SQL Injection | 94Code Injection | 22Path Traversal | 287Improper Authentication |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | ||||||||||
| MySQL | ||||||||||
| Apache | 4 | 1 | 2 | 1 | 2 | 1 | ||||
| IBM | 4 | 2 | 1 | 1 | 1 | |||||
| Sitracker | 3 | 2 | 3 | 2 | ||||||
| Maven | 3 | 1 | 2 | 1 | 2 | 1 | ||||
| 1 | 1 | |||||||||
| Linux | 3 | 2 | 1 | 1 | ||||||
| Microsoft | 1 | 1 | ||||||||
| OpenSSL | 5 | |||||||||
| Sun | ||||||||||
| Red Hat | 1 | 1 | 1 |