September 2014
1,156 CVEs published, 2.8× August 2014 and 2.4× September 2013. CISA added 0 to KEV.
2014 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 | January 2014: 579 CVEs | February 2014: 445 CVEs | March 2014: 545 CVEs | April 2014: 676 CVEs | May 2014: 555 CVEs | June 2014: 448 CVEs | July 2014: 656 CVEs | August 2014: 407 CVEs | September 2014: 1,156 CVEs | October 2014: 1,418 CVEs | November 2014: 505 CVEs | December 2014: 618 CVEs | 8,008+50% |
- Critical
- 787% of the 1,146 with a CVSS score
- Added to CISA KEV
- 04 of this month's CVEs are in KEV, listed a median 2692.5 days after publication
- Vendors
- 7991,178 products
- Top weakness
- CWE-310719 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AppleiPhone OS, Mac OS X, tvOS65103new
- 2MicrosoftInternet Explorer, Lync Server, Microsoft Lync Server4437nonenew
- 3IBMInitiate Master Data Service, Rational Clearcase, Qradar Security Information and Event Manager4342new
- 4CiscoIOS XR, IOS XE, IOS230nonenew
- 5PyPIPlone, ZOPE2, Portage231nonenew
- 6PlonePlone220nonenew
- 7AdobeFlash Player, Adobe Air, Adobe Air Sdk2117nonenew
- 8LinuxLinux Kernel180nonenew
- 9OpensuseOpensuse, Evergreen1452new
- 10PlayscapeBouncy Bill, Bouncy Bill Easter Tales, Bouncy Bill Holloween130nonenew
- 11WiresharkWireshark120nonenew
- 12Wireshark TeamWireshark Network Protocol Analyzer120nonenew
- 13CanonicalUbuntu Linux, Ubuntu, Acpi-support1122new
- 14Red HatEnterprise Linux Server Aus, Enterprise Linux Desktop, Enterprise Linux Workstation1122new
- 15MozillaFirefox, Thunderbird, Firefox Esr95nonenew
- 16AdvantechAdvantech Webaccess80nonenew
- 17RuntasticRuntastic Heart Rate, Runtastic Me, Runtastic Mountain Bike70nonenew
- 18DebianDebian Linux, Advanced Package Tool622new
- 19GcspublishingBeekeeping Forum, Bersa Forum, Goat Forum60nonenew
- 20GnuBash653new
- 21IlearnwithAlphabet \& Spelling Kids Games, Animals\! Kids Preschool Games, Counting \& Addition Kids Games60nonenew
- 22OracleSolaris, Linux632new
- 23Withhive9 Innings\, Actionpuzzlefamily For Kakao, Homerun Battle 260nonenew
- 24Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Gnu Bash, Libvncserver62nonenew
- 25ApachePoi, Commons-httpclient, Tomcat50nonenew
Severity
How this month's CVEs score on CVSS; 10 have no score yet. Severity is not exploitation.
- Critical78
- High62
- Medium964
- Low42
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-310719
- CWE-119Memory Buffer Bounds109
- CWE-79XSS67
- CWE-20Improper Input Validation37
- CWE-26437
- CWE-200Information Exposure31
- CWE-39923
- CWE-94Code Injection15
- CWE-89SQL Injection13
- CWE-352CSRF10
- CWE-2558
- CWE-1897
- CWE-78OS Command Injection7
- CWE-287Improper Authentication5
- CWE-22Path Traversal4
- CWE-362Race Condition3
- CWE-592
- CWE-1211
- CWE-171
- CWE-311Missing Encryption1
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Consumer Software12412% of sector-tagged CVEs
- Web & CMS Plugins10711% of sector-tagged CVEs
- Mobile Apps10410% of sector-tagged CVEs
- Operating Systems9810% of sector-tagged CVEs
- Enterprise Software818% of sector-tagged CVEs
- OSS Libraries576% of sector-tagged CVEs
- Networking Infrastructure515% of sector-tagged CVEs
- Security Products364% of sector-tagged CVEs
- 7 smaller sectors93
- Not yet classified254
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 310 | 119Memory Buffer Bounds | 79XSS | 20Improper Input Validation | 264 | 200Information Exposure | 399 | 94Code Injection | 89SQL Injection | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Apple | 3 | 15 | 1 | 13 | 4 | 7 | 1 | |||
| Microsoft | 1 | 36 | 1 | 1 | 2 | 1 | 1 | |||
| IBM | 1 | 1 | 7 | 1 | 6 | 8 | 2 | 1 | 4 | |
| Microsoft Corp | 36 | 1 | 1 | 1 | 1 | |||||
| Cisco | 1 | 3 | 2 | 8 | 4 | 1 | ||||
| PyPI | 1 | 4 | 4 | 4 | 3 | 4 | ||||
| Plone | 4 | 4 | 4 | 3 | 4 | |||||
| Adobe | 13 | 2 | 2 | 1 | ||||||
| Adobe Systems Inc. | 13 | 1 | 2 | 1 | ||||||
| Linux | 9 | 1 | 1 | 5 | ||||||
| Opensuse | 3 | 2 | ||||||||
| Playscape | 13 |