June 2014
448 CVEs published, −19% on May 2014 and +21% on June 2013. CISA added 0 to KEV.
2014 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 | January 2014: 579 CVEs | February 2014: 445 CVEs | March 2014: 545 CVEs | April 2014: 676 CVEs | May 2014: 555 CVEs | June 2014: 448 CVEs | July 2014: 656 CVEs | August 2014: 407 CVEs | September 2014: 1,156 CVEs | October 2014: 1,418 CVEs | November 2014: 505 CVEs | December 2014: 618 CVEs | 8,008+50% |
- Critical
- 9922% of the 445 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 2909 days after publication
- Vendors
- 211464 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 90 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftInternet Explorer, Windows 7, Windows Server 20126455nonenew
- 2IBMMarketing Platform, Security Access Manager For Web Appliance, Openpages Grc Platform241nonenew
- 3Red HatEnterprise Linux, Enterprise Linux Server, Openstack2211new
- 4OwncloudOwncloud Server, Owncloud200nonenew
- 5CiscoUnified Communications Domain Manager, Webex Meetings Server, Unified Communications Manager190nonenew
- 6OpensuseOpensuse, Leap1421new
- 7PackagistTypo3/cms, Geshi/geshi, Symfony/yaml140nonenew
- 8SuseLinux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit1421new
- 9SapSupplier Relationship Management, Computing Center Management System Monitoring, Netweaver130nonenew
- 10LinuxLinux Kernel1101new
- 11MozillaFirefox, Thunderbird, Firefox Esr118nonenew
- 12Novell Inc.Opensuse, Suse Linux Enterprise90nonenew
- 13CanonicalUbuntu Linux801new
- 14DebianDebian Linux, Advanced Package Tool80nonenew
- 15HPExecutive Scorecard, Release Control, Service Virtualization84nonenew
- 16AdobeAdobe Air, Adobe Air Sdk, Flash Player72nonenew
- 17FedoraprojectFedora, Sssd70nonenew
- 18SymantecWeb Gateway, Data Insight, Encryption Desktop71nonenew
- 19EmcDocumentum Content Server, Documentum Digital Asset Manager, Rsa Adaptive Authentication Hosted60nonenew
- 20PyPIDjblets, Keystone, Ajenti60nonenew
- 21TYPO3TYPO360nonenew
- 22Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux611new
- 23AlienvaultOpen Source Security Information Management54nonenew
- 24F5Enterprise Manager, Arx Firmware, BIG-IP Access Policy Manager50nonenew
- 25GnuGnutls, Libtasn150nonenew
Severity
How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.
- Critical99
- High63
- Medium248
- Low35
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds90
- CWE-79XSS71
- CWE-26444
- CWE-20Improper Input Validation23
- CWE-94Code Injection23
- CWE-89SQL Injection20
- CWE-200Information Exposure19
- CWE-352CSRF18
- CWE-31015
- CWE-22Path Traversal13
- CWE-25512
- CWE-287Improper Authentication9
- CWE-596
- CWE-3995
- CWE-1894
- CWE-78OS Command Injection3
- CWE-476NULL Pointer Dereference2
- CWE-120Buffer Overflow1
- CWE-131Incorrect Buffer Size1
- CWE-134Format String1
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems12224% of sector-tagged CVEs
- Enterprise Software7114% of sector-tagged CVEs
- Web & CMS Plugins6613% of sector-tagged CVEs
- OSS Libraries489% of sector-tagged CVEs
- Networking Infrastructure387% of sector-tagged CVEs
- Cloud & SaaS367% of sector-tagged CVEs
- Security Products357% of sector-tagged CVEs
- Consumer Software296% of sector-tagged CVEs
- 7 smaller sectors48
- Not yet classified17
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 79XSS | 264 | 20Improper Input Validation | 94Code Injection | 89SQL Injection | 200Information Exposure | 352CSRF | 310 | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 52 | 1 | 2 | 2 | 3 | 1 | 2 | |||
| Microsoft Corp | 51 | 1 | 2 | 1 | 3 | 1 | 2 | |||
| IBM | 1 | 3 | 5 | 2 | 1 | 1 | 2 | 1 | ||
| Owncloud | 3 | 6 | 1 | 2 | 1 | 1 | ||||
| Red Hat | 2 | 1 | 2 | 2 | ||||||
| Cisco | 1 | 6 | 3 | 1 | 1 | |||||
| Opensuse | 3 | 1 | 1 | |||||||
| Packagist | 3 | 1 | 3 | 1 | 1 | |||||
| Suse | 1 | 1 | 3 | |||||||
| Sap | 2 | 1 | ||||||||
| Linux | 2 | 3 | ||||||||
| Mozilla | 3 | 1 |