July 2015
644 CVEs published, +29% on June 2015 and −2% on July 2014. CISA added 0 to KEV.
2015 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 | January 2015: 737 CVEs | February 2015: 496 CVEs | March 2015: 457 CVEs | April 2015: 558 CVEs | May 2015: 417 CVEs | June 2015: 499 CVEs | July 2015: 644 CVEs | August 2015: 625 CVEs | September 2015: 499 CVEs | October 2015: 739 CVEs | November 2015: 368 CVEs | December 2015: 567 CVEs | 6,606−18% |
- Critical
- 12620% of the 637 with a CVSS score
- Added to CISA KEV
- 09 of this month's CVEs are in KEV, listed a median 2443 days after publication
- Vendors
- 129419 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 108 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleSolaris, Berkeley Db, Fusion Middleware176221new
- 2AdobeAcrobat Dc, Acrobat, Acrobat Reader85583new
- 3AppleMac OS X, iPhone OS, Quicktime728nonenew
- 4MicrosoftInternet Explorer, Windows Server 2012, Windows 8.160255new
- 5CiscoNX-OS, Adaptive Security Appliance, Adaptive Security Appliance Software552nonenew
- 6DebianDebian Linux, Unattended-upgrades47101new
- 7OpensuseOpensuse, Evergreen, Openstack Cloud3864new
- 8CanonicalUbuntu Linux, Ubuntu3691new
- 9Red HatEnterprise Linux Workstation Supplementary, Enterprise Linux Server Supplementary, Enterprise Linux Desktop Supplementary3364new
- 10IBMDB2, Infosphere Master Data Management, Websphere Application Server282nonenew
- 11GoogleChrome, Google Chrome, V8221nonenew
- 12MozillaFirefox, Firefox Esr, Thunderbird2113nonenew
- 13IBM Corp.IBM DB2, Websphere Application Server, Business Process Manager151nonenew
- 14NovellSuse Linux Enterprise Desktop, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit149nonenew
- 15EmcDocumentum Digital Asset Manager, Documentum Taskspace, Documentum Administrator112nonenew
- 16SuseLinux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit1084new
- 17JuniperJunos, Junos Space81nonenew
- 18RubygemsActivesupport, Jquery-ujs, Paperclip70nonenew
- 19MariaDBMariaDB60nonenew
- 20Dell TechnologiesEmc Documentum Taskspace, Emc Documentum Administrator, Emc Documentum Digital Asset Management51nonenew
- 21HospiraLifecare Pcainfusion Firmware, Lifecare PCA3, Lifecare Pca Infusion System51nonenew
- 22ApacheHTTP Server, Struts40nonenew
- 23RubyonrailsRails, Jquery-ujs, Jquery-rails40nonenew
- 24SapSap Netweaver, Enterprise Central Component, Afaria41nonenew
- 25WvwareLibwmf40nonenew
Severity
How this month's CVEs score on CVSS; 7 have no score yet. Severity is not exploitation.
- Critical126
- High99
- Medium358
- Low54
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds108
- CWE-200Information Exposure44
- CWE-79XSS44
- CWE-20Improper Input Validation31
- CWE-26428
- CWE-284Improper Access Control25
- CWE-39922
- CWE-352CSRF16
- CWE-25415
- CWE-1713
- CWE-416Use After Free10
- CWE-89SQL Injection9
- CWE-787Out-of-bounds Write8
- CWE-197
- CWE-3107
- CWE-22Path Traversal6
- CWE-77Command Injection6
- CWE-190Integer Overflow4
- CWE-2554
- CWE-269Improper Privilege Mgmt4
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Databases19225% of sector-tagged CVEs
- Operating Systems14819% of sector-tagged CVEs
- Consumer Software10714% of sector-tagged CVEs
- Mobile Apps9612% of sector-tagged CVEs
- Networking Infrastructure729% of sector-tagged CVEs
- Enterprise Software506% of sector-tagged CVEs
- Web & CMS Plugins334% of sector-tagged CVEs
- OSS Libraries324% of sector-tagged CVEs
- 6 smaller sectors42
- Not yet classified4
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 200Information Exposure | 79XSS | 20Improper Input Validation | 264 | 284Improper Access Control | 399 | 352CSRF | 254 | 17 |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 6 | 2 | 1 | 2 | 1 | 6 | ||||
| Adobe | 20 | 7 | 1 | 6 | ||||||
| Oracle Corp. | ||||||||||
| Adobe Systems Inc. | 20 | 5 | ||||||||
| Apple | 38 | 6 | 1 | 1 | 5 | 5 | 1 | 7 | ||
| Microsoft | 26 | 11 | 1 | 3 | 7 | 2 | 1 | |||
| Cisco | 1 | 1 | 5 | 7 | 6 | 1 | 14 | 11 | ||
| Microsoft Corp | 25 | 10 | 1 | 1 | 6 | 2 | 1 | |||
| Debian | 8 | 1 | 1 | 2 | 1 | 2 | 3 | 7 | ||
| Opensuse | 7 | 3 | 2 | 1 | 1 | 3 | 3 | |||
| Canonical | 6 | 1 | 1 | 1 | 5 | |||||
| Red Hat | 4 | 1 | 1 | 1 | 2 | 3 | 2 |