October 2014
1,418 CVEs published, +23% on September 2014 and 2.2× October 2013. CISA added 0 to KEV.
2014 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 | January 2014: 579 CVEs | February 2014: 445 CVEs | March 2014: 545 CVEs | April 2014: 676 CVEs | May 2014: 555 CVEs | June 2014: 448 CVEs | July 2014: 656 CVEs | August 2014: 407 CVEs | September 2014: 1,156 CVEs | October 2014: 1,418 CVEs | November 2014: 505 CVEs | December 2014: 618 CVEs | 8,008+50% |
- Critical
- 584% of the 1,413 with a CVSS score
- Added to CISA KEV
- 06 of this month's CVEs are in KEV, listed a median 2742 days after publication
- Vendors
- 8051,292 products
- Top weakness
- CWE-310717 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleDatabase Server, Java Platform, Jre11813nonenew
- 2MagzterAutocar India, Bbc Knowledge Magazine, Bespoke450nonenew
- 3Red HatEnterprise Linux Desktop Supplementary, Enterprise Linux Workstation Supplementary, Enterprise Linux Server Supplementary451nonenew
- 4IBMWebsphere Portal, Qradar Security Information and Event Manager, Tririga Application Platform433nonenew
- 5CiscoASA, Adaptive Security Appliance Software, Unified Communications Manager351nonenew
- 6AppleMac OS X, iPhone OS, OS X Server341nonenew
- 7MavenOrg.jenkins-ci.main:jenkins-core, Org.jvnet.hudson.plugins:monitoring, Org.apache.cxf:cxf-rt-frontend-jaxrs260nonenew
- 8MicrosoftInternet Explorer, Windows Server 2008 Service Pack 2, Windows Server 200825145new
- 9MariaDBMariaDB220nonenew
- 10SuseLinux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit212nonenew
- 11DrupalCustom Search Module, Zen, Bluemasters200nonenew
- 12McafeeNetwork Data Loss Prevention, Endpoint Encryption For Files and Folders, File and Removable Media Protection200nonenew
- 13PocketmagsAdt Aesthetic Dentistry Today, American Waterfowler, Classic Arms \& Militaria200nonenew
- 14PyPINova, Python-gnupg, Requests190nonenew
- 15CanonicalUbuntu Linux, Ubuntu180nonenew
- 16JenkinsJenkins180nonenew
- 17HPSystem Management Homepage, Sprinter, Systems Insight Manager171nonenew
- 18OpenstackNova, Horizon, Cinder170nonenew
- 19GoogleChrome, Chrome OS, V8161nonenew
- 20MozillaFirefox, Thunderbird, Bugzilla160nonenew
- 21OpensuseOpensuse, Evergreen162nonenew
- 22DebianDebian Linux, Apt, Advanced Package Tool150nonenew
- 23SunSunos140nonenew
- 24JuniperJunos Space, Junos, SRX220130nonenew
- 25NobexrcAbram Radio Groove\!, Amnesia Groove, Asylum\!110nonenew
Severity
How this month's CVEs score on CVSS; 5 have no score yet. Severity is not exploitation.
- Critical58
- High133
- Medium1,120
- Low102
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-310717
- CWE-79XSS129
- CWE-20Improper Input Validation51
- CWE-26451
- CWE-200Information Exposure47
- CWE-39940
- CWE-89SQL Injection36
- CWE-94Code Injection28
- CWE-119Memory Buffer Bounds26
- CWE-287Improper Authentication22
- CWE-352CSRF22
- CWE-22Path Traversal16
- CWE-25511
- CWE-362Race Condition6
- CWE-416Use After Free5
- CWE-78OS Command Injection5
- CWE-1893
- CWE-592
- CWE-125Out-of-bounds Read1
- CWE-161
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins16212% of sector-tagged CVEs
- Operating Systems15211% of sector-tagged CVEs
- Consumer Software13410% of sector-tagged CVEs
- Enterprise Software1299% of sector-tagged CVEs
- Databases1229% of sector-tagged CVEs
- OSS Libraries957% of sector-tagged CVEs
- Mobile Apps675% of sector-tagged CVEs
- Networking Infrastructure655% of sector-tagged CVEs
- Security Products484% of sector-tagged CVEs
- Cloud & SaaS443% of sector-tagged CVEs
- Not yet classified287
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 310 | 79XSS | 20Improper Input Validation | 264 | 200Information Exposure | 399 | 89SQL Injection | 94Code Injection | 119Memory Buffer Bounds | 287Improper Authentication |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | ||||||||
| Magzter | 45 | |||||||||
| IBM | 3 | 12 | 5 | 3 | 5 | 1 | 2 | |||
| Red Hat | 3 | 1 | 2 | 6 | 7 | 6 | 2 | 1 | ||
| Cisco | 2 | 5 | 2 | 2 | 2 | 11 | 2 | 1 | 2 | |
| Apple | 8 | 1 | 5 | 5 | 3 | 1 | 3 | 3 | ||
| Oracle Corp. | ||||||||||
| Maven | 2 | 4 | 4 | 4 | 2 | 1 | 3 | |||
| Microsoft | 1 | 9 | 5 | 3 | 1 | 2 | ||||
| Microsoft Corp | 1 | 9 | 4 | 3 | 1 | 2 | ||||
| MariaDB | ||||||||||
| Suse |