July 2014
656 CVEs published, +46% on June 2014 and +31% on July 2013. CISA added 0 to KEV.
2014 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 | January 2014: 579 CVEs | February 2014: 445 CVEs | March 2014: 545 CVEs | April 2014: 676 CVEs | May 2014: 555 CVEs | June 2014: 448 CVEs | July 2014: 656 CVEs | August 2014: 407 CVEs | September 2014: 1,156 CVEs | October 2014: 1,418 CVEs | November 2014: 505 CVEs | December 2014: 618 CVEs | 8,008+50% |
- Critical
- 7912% of the 653 with a CVSS score
- Added to CISA KEV
- 02 of this month's CVEs are in KEV, listed a median 2838 days after publication
- Vendors
- 282614 products
- Top weakness
- XSSCWE-79 · 171 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleFusion Middleware, Jdk, Java Platform999nonenew
- 2AppleiPhone OS, Mac OS X, tvOS4510nonenew
- 3IBMAlgo Credit Limits, Algorithmics, Websphere Portal Unified Task List Portlet4001new
- 4CiscoWebex Meetings Server, Unified Communications Manager, Unified Communications Domain Manager333nonenew
- 5MicrosoftInternet Explorer, Windows 8, Windows 8.12923nonenew
- 6DebianDebian Linux263nonenew
- 7Red HatJboss Enterprise Application Platform, Enterprise Linux Server, Cloudforms 3.0 Management Engine252nonenew
- 8CanonicalUbuntu Linux, Ubuntu, Acpi-support171nonenew
- 9HPIntelligent Management Center, Imc Branch Intelligent Management System Software Module, Universal Configuration Management Database165nonenew
- 10SuseLinux Enterprise Server, Linux Enterprise Desktop, Linux Enterprise Software Development Kit150nonenew
- 11Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux151nonenew
- 12MozillaFirefox, Thunderbird, Firefox Esr149nonenew
- 13MoodleMoodle130nonenew
- 14OpensuseOpensuse121nonenew
- 15PackagistMoodle/moodle, Phpmyadmin/phpmyadmin, Yiisoft/yii120nonenew
- 16ApacheHTTP Server, Cxf, Subversion110nonenew
- 17LinuxLinux Kernel100nonenew
- 18NetgatepfSense100nonenew
- 19PHPPHP100nonenew
- 20FedoraprojectFedora81nonenew
- 21GoogleChrome, Sketchup, Google Chrome83nonenew
- 22MavenOrg.elasticsearch:elasticsearch, Io.netty:netty-handler, Org.apache.cxf:cxf-core701new
- 23Novell Inc.Opensuse71nonenew
- 24PHP GroupPHP70nonenew
- 25Apache Software FoundationHTTP Server60nonenew
Severity
How this month's CVEs score on CVSS; 3 have no score yet. Severity is not exploitation.
- Critical79
- High71
- Medium434
- Low69
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS171
- CWE-119Memory Buffer Bounds60
- CWE-26455
- CWE-200Information Exposure36
- CWE-20Improper Input Validation35
- CWE-89SQL Injection22
- CWE-22Path Traversal19
- CWE-352CSRF13
- CWE-94Code Injection12
- CWE-287Improper Authentication10
- CWE-2559
- CWE-3109
- CWE-1897
- CWE-596
- CWE-3995
- CWE-362Race Condition4
- CWE-78OS Command Injection4
- CWE-190Integer Overflow3
- CWE-400Resource Consumption3
- CWE-284Improper Access Control2
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems11016% of sector-tagged CVEs
- Databases10615% of sector-tagged CVEs
- Enterprise Software9013% of sector-tagged CVEs
- Web & CMS Plugins8712% of sector-tagged CVEs
- Networking Infrastructure7010% of sector-tagged CVEs
- OSS Libraries578% of sector-tagged CVEs
- Mobile Apps548% of sector-tagged CVEs
- Consumer Software325% of sector-tagged CVEs
- 6 smaller sectors68
- Not yet classified26
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 119Memory Buffer Bounds | 264 | 200Information Exposure | 20Improper Input Validation | 89SQL Injection | 22Path Traversal | 352CSRF | 94Code Injection | 287Improper Authentication |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | 4 | 1 | |||||
| Apple | 15 | 13 | 2 | 3 | ||||||
| IBM | 11 | 5 | 9 | 3 | 1 | 2 | 1 | |||
| Oracle Corp. | 1 | |||||||||
| Cisco | 5 | 2 | 4 | 3 | 7 | 1 | 3 | 1 | 1 | |
| Microsoft | 21 | 3 | 1 | 1 | ||||||
| Microsoft Corp | 21 | 3 | 1 | 1 | ||||||
| Debian | 2 | 1 | 1 | 5 | 1 | |||||
| Red Hat | 1 | 1 | 4 | 2 | 2 | |||||
| Canonical | 2 | |||||||||
| HP | 2 | 1 | ||||||||
| Сообщество Свободного Программного Обеспечения | 3 | 1 | 1 | 2 |