December 2014
618 CVEs published, +22% on November 2014 and +25% on December 2013. CISA added 0 to KEV.
2014 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2014 | January 2014: 579 CVEs | February 2014: 445 CVEs | March 2014: 545 CVEs | April 2014: 676 CVEs | May 2014: 555 CVEs | June 2014: 448 CVEs | July 2014: 656 CVEs | August 2014: 407 CVEs | September 2014: 1,156 CVEs | October 2014: 1,418 CVEs | November 2014: 505 CVEs | December 2014: 618 CVEs | 8,008+50% |
- Critical
- 6110% of the 614 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 2681 days after publication
- Vendors
- 285543 products
- Top weakness
- XSSCWE-79 · 90 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1IBMWebsphere Service Registry and Repository, Security Access Manager For Mobile, Security Access Manager For Web612nonenew
- 2MicrosoftWindows, Internet Explorer, Office Compatibility Pack4431nonenew
- 3Red HatRed Hat Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server4001new
- 4AppleMac OS X, tvOS, iPhone OS3415nonenew
- 5DebianDebian Linux, Hivex280nonenew
- 6AdobeAcrobat Reader, Acrobat, Flash Player26201new
- 7CanonicalUbuntu Linux, Ubuntu250nonenew
- 8CiscoMeraki Mx Firmware, Meraki Mr Firmware, Meraki Ms Firmware240nonenew
- 9ZenossZenoss Core181nonenew
- 10FedoraprojectFedora160nonenew
- 11OpensuseOpensuse, Evergreen160nonenew
- 12X.orgX Server, X11, Xfree86130nonenew
- 13MozillaFirefox, Seamonkey, Thunderbird120nonenew
- 14OracleSolaris, Linux, Enterprise Manager Ops Center110nonenew
- 15GnuBinutils, Glibc, Cpio100nonenew
- 16GoogleAndroid, Chrome100nonenew
- 17ZohocorpManageengine IT360, Manageengine Opmanager, Manageengine Social It Plus101nonenew
- 18Ettercap-projectEttercap80nonenew
- 19MantisbtMantisbt80nonenew
- 20ApacheHTTP Server, Subversion, Cloudstack70nonenew
- 21EmcDocumentum Content Server, Rsa Adaptive Authentication On-premise, Appsync72nonenew
- 22HuaweiEspace Desktop, Honor Cube Wireless Router WS860S, Honor Cube Wireless Router WS860S Firewall71nonenew
- 23LinuxLinux Kernel70nonenew
- 24MageiaMageia70nonenew
- 25VideolanVlc Media Player70nonenew
Severity
How this month's CVEs score on CVSS; 4 have no score yet. Severity is not exploitation.
- Critical61
- High129
- Medium370
- Low54
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS90
- CWE-119Memory Buffer Bounds68
- CWE-200Information Exposure51
- CWE-20Improper Input Validation43
- CWE-352CSRF43
- CWE-26441
- CWE-89SQL Injection29
- CWE-39927
- CWE-94Code Injection24
- CWE-22Path Traversal22
- CWE-284Improper Access Control12
- CWE-77Command Injection12
- CWE-31011
- CWE-1710
- CWE-18910
- CWE-287Improper Authentication9
- CWE-2558
- CWE-196
- CWE-2544
- CWE-593
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems15421% of sector-tagged CVEs
- Enterprise Software13318% of sector-tagged CVEs
- Web & CMS Plugins7811% of sector-tagged CVEs
- Consumer Software598% of sector-tagged CVEs
- Mobile Apps547% of sector-tagged CVEs
- Networking Infrastructure507% of sector-tagged CVEs
- OSS Libraries476% of sector-tagged CVEs
- Security Products426% of sector-tagged CVEs
- 6 smaller sectors81
- Not yet classified36
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 119Memory Buffer Bounds | 200Information Exposure | 20Improper Input Validation | 352CSRF | 264 | 89SQL Injection | 399 | 94Code Injection | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| IBM | 17 | 8 | 3 | 4 | 7 | 1 | 1 | 2 | 2 | |
| Microsoft | 2 | 6 | 4 | 10 | 1 | 1 | 10 | |||
| Apple | 3 | 3 | 1 | 1 | 9 | 7 | ||||
| Debian | 9 | 2 | 1 | 3 | ||||||
| Adobe | 2 | 4 | 2 | 9 | ||||||
| Canonical | 6 | 2 | 1 | 4 | 1 | 1 | ||||
| Cisco | 4 | 7 | 3 | 3 | 1 | 1 | ||||
| Red Hat | 1 | 4 | 1 | 2 | 2 | 1 | 1 | |||
| Red Hat Inc. | 10 | |||||||||
| Zenoss | 1 | 4 | 2 | 3 | 2 | 1 | ||||
| Fedoraproject | 1 | 7 | 1 | 1 | 1 | |||||
| Opensuse | 1 | 2 | 1 | 1 | 1 |