February 2014
445 CVEs published, −23% on January 2014 and +9% on February 2013. CISA added 0 to KEV.
2014 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 | January 2014: 579 CVEs | February 2014: 445 CVEs | March 2014: 545 CVEs | April 2014: 676 CVEs | May 2014: 555 CVEs | June 2014: 448 CVEs | July 2014: 656 CVEs | August 2014: 407 CVEs | September 2014: 1,156 CVEs | October 2014: 1,418 CVEs | November 2014: 505 CVEs | December 2014: 618 CVEs | 8,008+50% |
- Critical
- 7116% of the 442 with a CVSS score
- Added to CISA KEV
- 04 of this month's CVEs are in KEV, listed a median 3435.5 days after publication
- Vendors
- 187411 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 69 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Red HatEnterprise Linux Workstation, Enterprise Linux Desktop, Enterprise Linux Eus4432new
- 2CiscoUnified Communications Manager, Unified Contact Center Express Editor Software, Ips Sensor Software353nonenew
- 3MicrosoftInternet Explorer, Windows 8, Microsoft .net Framework 3.5.134252new
- 4IBMRational Focal Point, Sametime, Financial Transaction Manager322nonenew
- 5OpensuseOpensuse, Leap, Osc2962new
- 6AppleMac OS X, Quicktime, Mac OS X Server289nonenew
- 7CanonicalUbuntu Linux285nonenew
- 8SuseLinux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit2062new
- 9MozillaFirefox, Seamonkey, Thunderbird185nonenew
- 10DebianDebian Linux, Advanced Package Tool143nonenew
- 11PidginPidgin142nonenew
- 12OracleSolaris, Vm Server, Enterprise Manager Ops Center133nonenew
- 13GoogleChrome1211new
- 14FedoraprojectFedora113nonenew
- 15Gentoo Foundation Inc.Gentoo Linux100nonenew
- 16Марк Спенсер, Шон Иган И Др.Pidgin101nonenew
- 17Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Iptables90nonenew
- 18ApacheTomcat, Activemq, Subversion80nonenew
- 19LinuxLinux Kernel80nonenew
- 20MavenOrg.apache.tomcat:tomcat, Org.jenkins-ci.main:jenkins-core, Org.apache.activemq:activemq-core80nonenew
- 21Novell Inc.Suse Linux Enterprise70nonenew
- 22AdobeFlash Player, Adobe Air, Adobe Air Sdk642new
- 23EcryptfsEcryptfs Utils, Ecryptfs-utils60nonenew
- 24PHPPHP60nonenew
- 25SapNetweaver, Customer Relationship Management, Netweaver Exchange Infrastructure \(Bc-xi\)60nonenew
Severity
How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.
- Critical71
- High73
- Medium262
- Low36
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds69
- CWE-79XSS68
- CWE-26458
- CWE-20Improper Input Validation51
- CWE-200Information Exposure22
- CWE-31021
- CWE-89SQL Injection17
- CWE-18916
- CWE-287Improper Authentication15
- CWE-352CSRF14
- CWE-39911
- CWE-22Path Traversal10
- CWE-25510
- CWE-94Code Injection4
- CWE-362Race Condition3
- CWE-593
- CWE-1021Clickjacking2
- CWE-209Error Message Info Leak2
- CWE-416Use After Free2
- CWE-787Out-of-bounds Write2
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems14126% of sector-tagged CVEs
- Enterprise Software7313% of sector-tagged CVEs
- Networking Infrastructure5711% of sector-tagged CVEs
- OSS Libraries469% of sector-tagged CVEs
- Mobile Apps407% of sector-tagged CVEs
- Web & CMS Plugins326% of sector-tagged CVEs
- Consumer Software326% of sector-tagged CVEs
- Communications234% of sector-tagged CVEs
- Security Products234% of sector-tagged CVEs
- Not yet classified22
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 79XSS | 264 | 20Improper Input Validation | 200Information Exposure | 310 | 89SQL Injection | 189 | 287Improper Authentication | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Red Hat | 4 | 10 | 4 | 3 | 7 | 2 | 2 | |||
| Cisco | 2 | 5 | 8 | 1 | 1 | 5 | 8 | 3 | ||
| Microsoft | 23 | 2 | 3 | 2 | ||||||
| IBM | 1 | 9 | 9 | 3 | 1 | 2 | ||||
| Microsoft Corp | 22 | 2 | 3 | 2 | ||||||
| Opensuse | 2 | 1 | 3 | 2 | 1 | 1 | 1 | |||
| Apple | 19 | 4 | 1 | 1 | 2 | |||||
| Canonical | 1 | 4 | 3 | 3 | 2 | |||||
| Suse | 1 | 1 | 1 | 1 | 1 | 1 | ||||
| Mozilla | 2 | 1 | 1 | 1 | ||||||
| Debian | 1 | 1 | 2 | 1 | ||||||
| Pidgin | 3 | 7 | 3 |