May 2015
417 CVEs published, −25% on April 2015 and −25% on May 2014. CISA added 0 to KEV.
2015 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 | January 2015: 737 CVEs | February 2015: 496 CVEs | March 2015: 457 CVEs | April 2015: 558 CVEs | May 2015: 417 CVEs | June 2015: 499 CVEs | July 2015: 644 CVEs | August 2015: 625 CVEs | September 2015: 499 CVEs | October 2015: 739 CVEs | November 2015: 368 CVEs | December 2015: 567 CVEs | 6,606−18% |
- Critical
- 9924% of the 410 with a CVSS score
- Added to CISA KEV
- 03 of this month's CVEs are in KEV, listed a median 2569 days after publication
- Vendors
- 163492 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 63 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows, Internet Explorer, Windows Server 201278531new
- 2AdobeAcrobat Reader, Acrobat, Adobe Acrobat4939nonenew
- 3AppleMac OS X, iPhone OS, Safari4329nonenew
- 4CiscoHeadend Digital Broadband Delivery System, Headend System Release, Wireless Lan Controller Software412nonenew
- 5IBMLicense Metric Tool, Security Siteprotector System, Endpoint Manager Family395nonenew
- 6DebianDebian Linux321nonenew
- 7GoogleChrome, Google Chrome, Google V8190nonenew
- 8CanonicalUbuntu Linux, Ubuntu182nonenew
- 9IBM Corp.Security Siteprotector System, IBM Domino, IBM Webshpere Portal175nonenew
- 10MozillaFirefox, Thunderbird, Firefox Esr140nonenew
- 11OpensuseOpensuse140nonenew
- 12FedoraprojectFedora121nonenew
- 13OracleSolaris, Linux, Enterprise Manager Ops Center110nonenew
- 14Red HatEnterprise Linux Server Supplementary Eus, Enterprise Linux Workstation Supplementary, Enterprise Linux Desktop Supplementary100nonenew
- 15WiresharkWireshark90nonenew
- 16LinuxLinux Kernel81nonenew
- 17SapCustomer Relationship Management, Hana, Sybase Unwired Platform Online Data Proxy80nonenew
- 18HPAccess Control, Hewlett-packard Virtual Application Network Software-defined Networking Controller, HP Access Control72nonenew
- 19Aruba NetworksClearpass Policy Manager62nonenew
- 20Blue CoatSSL Visibility Appliance SV1800 Firmware, SSL Visibility Appliance SV800 Firmware, SSL Visibility Appliance SV3800 Firmware50nonenew
- 21FortinetFortios, Fortiadc-700d, Fortiadc Firmware50nonenew
- 22NovellSuse Linux Enterprise Desktop, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit50nonenew
- 23ClamavClamav40nonenew
- 24DockerDocker, Libcontainer40nonenew
- 25EmcDocument Sciences Xpression, Rsa Identity Management and Governance, Autostart41nonenew
Severity
How this month's CVEs score on CVSS; 7 have no score yet. Severity is not exploitation.
- Critical99
- High70
- Medium207
- Low34
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds63
- CWE-79XSS48
- CWE-200Information Exposure39
- CWE-26433
- CWE-39927
- CWE-284Improper Access Control26
- CWE-20Improper Input Validation19
- CWE-89SQL Injection18
- CWE-352CSRF15
- CWE-18910
- CWE-179
- CWE-94Code Injection9
- CWE-3108
- CWE-22Path Traversal7
- CWE-362Race Condition5
- CWE-416Use After Free4
- CWE-74Injection3
- CWE-78OS Command Injection3
- CWE-192
- CWE-2542
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems15026% of sector-tagged CVEs
- Consumer Software6711% of sector-tagged CVEs
- Mobile Apps6711% of sector-tagged CVEs
- Networking Infrastructure6411% of sector-tagged CVEs
- Enterprise Software6211% of sector-tagged CVEs
- Databases336% of sector-tagged CVEs
- Security Products336% of sector-tagged CVEs
- Web & CMS Plugins295% of sector-tagged CVEs
- OSS Libraries285% of sector-tagged CVEs
- Not yet classified16
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 79XSS | 200Information Exposure | 264 | 399 | 284Improper Access Control | 20Improper Input Validation | 89SQL Injection | 352CSRF | 189 |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 28 | 11 | 8 | 14 | 1 | |||||
| Adobe | 16 | 3 | 4 | 14 | 1 | |||||
| Apple | 12 | 2 | 2 | 14 | 1 | |||||
| Cisco | 9 | 3 | 3 | 9 | 2 | 10 | 1 | 5 | ||
| IBM | 4 | 6 | 9 | 2 | 4 | 3 | 1 | 1 | 2 | |
| Adobe Systems Inc. | 15 | 14 | 1 | |||||||
| Debian | 3 | 3 | 1 | 2 | 2 | 1 | 1 | 1 | 1 | |
| Microsoft Corp | 15 | |||||||||
| 2 | 1 | 1 | 1 | 1 | 1 | |||||
| Google Inc | 2 | 1 | 1 | 1 | 1 | 1 | ||||
| Canonical | 1 | 1 | 1 | 4 | 1 | |||||
| IBM Corp. | 4 | 3 | 1 | 1 | 1 | 2 | 1 |