February 2017
1,075 CVEs published, 2.7× February 2016. CISA added 0 to KEV.
2017 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2017 | January 2017: no snapshot | February 2017: 1,075 CVEs | March 2017: 1,373 CVEs | April 2017: no snapshot | May 2017: 4,155 CVEs | June 2017: no snapshot | July 2017: 1,313 CVEs | August 2017: 1,564 CVEs | September 2017: 1,238 CVEs | October 2017: 1,441 CVEs | November 2017: no snapshot | December 2017: 1,120 CVEs | 13,2798 of 12 months8/12 |
- Critical
- 11811% of the 1,041 with a CVSS score
- Added to CISA KEV
- 02 of this month's CVEs are in KEV, listed a median 1847.5 days after publication
- Vendors
- 285798 products
- Top weakness
- Information ExposureCWE-200 · 131 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1IBMSecurity Access Manager 9.0 Firmware, Security Access Manager For Web 8.0 Firmware, Security Key Lifecycle Manager19210nonenew
- 2IBM CorporationKenexa Lms On Cloud, Access Manager, Key Lifecycle Manager18910nonenew
- 3AppleiPhone OS, IOS, Mac OS X1522nonenew
- 4GoogleAndroid, Chrome, Google Chrome781nonenew
- 5LinuxLinux Kernel561nonenew
- 6DebianDebian Linux545nonenew
- 7Google Inc.Android541nonenew
- 8CiscoUnified Communications Manager, Secure Access Control System, Secure Firewall Management Center352nonenew
- 9Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Busybox312nonenew
- 10AdobeFlash Player, Flash Player Desktop Runtime, Digital Editions242nonenew
- 11Libdwarf ProjectLibdwarf241nonenew
- 12MoxaNport P5150A Series Firmware, Nport 6100 Series Firmware, Nport 5x50a1-m12 Series Firmware225nonenew
- 13OpensuseLeap, Opensuse212nonenew
- 14FedoraprojectFedora195nonenew
- 15NvidiaGpu Driver, Tegra K1 CD570M-A1, Tegra K1 CD580M-A1190nonenew
- 16Nvidia CorporationWindows Gpu Display Driver, Gpu Display Driver, Linux Gpu Display Driver160nonenew
- 17GstreamerGstreamer140nonenew
- 18Red HatEnterprise Linux Workstation, Enterprise Linux Desktop, Enterprise Linux Server140nonenew
- 19GnuLibiberty, Coreutils, Ed120nonenew
- 20GraphicsmagickGraphicsmagick122nonenew
- 21NetappData Ontap, Oncommand Insight, E-series Santricity OS Controller123nonenew
- 22PackagistSimplesamlphp/simplesamlphp, Zendframework/zendframework, Simplesamlphp/saml2115nonenew
- 23EmcSmarts Network Configuration Manager, Documentum D2, Recoverpoint104nonenew
- 24PyPIPlone, HTML5LIB, Pycrypto102nonenew
- 25CanonicalUbuntu Linux92nonenew
Severity
How this month's CVEs score on CVSS; 34 have no score yet. Severity is not exploitation.
- Critical118
- High428
- Medium459
- Low36
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-200Information Exposure131
- CWE-119Memory Buffer Bounds130
- CWE-79XSS117
- CWE-20Improper Input Validation65
- CWE-125Out-of-bounds Read63
- CWE-26447
- CWE-284Improper Access Control41
- CWE-476NULL Pointer Dereference32
- CWE-787Out-of-bounds Write32
- CWE-190Integer Overflow30
- CWE-416Use After Free24
- CWE-89SQL Injection24
- CWE-352CSRF22
- CWE-22Path Traversal21
- CWE-25416
- CWE-287Improper Authentication14
- CWE-39913
- CWE-25512
- CWE-34612
- CWE-611XXE12
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software25220% of sector-tagged CVEs
- Mobile Apps23719% of sector-tagged CVEs
- Operating Systems21217% of sector-tagged CVEs
- OSS Libraries17514% of sector-tagged CVEs
- ICS / OT / IoT857% of sector-tagged CVEs
- Consumer Software605% of sector-tagged CVEs
- Networking Infrastructure544% of sector-tagged CVEs
- 7 smaller sectors168
- Not yet classified28
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 200Information Exposure | 119Memory Buffer Bounds | 79XSS | 20Improper Input Validation | 125Out-of-bounds Read | 264 | 284Improper Access Control | 476NULL Pointer Dereference | 787Out-of-bounds Write | 190Integer Overflow |
|---|---|---|---|---|---|---|---|---|---|---|
| IBM | 45 | 4 | 52 | 4 | 6 | 22 | ||||
| IBM Corporation | 44 | 4 | 50 | 4 | 6 | 22 | ||||
| Apple | 32 | 59 | 3 | 13 | 2 | 9 | 7 | 1 | ||
| Apple Inc. | 25 | 48 | 2 | 10 | 2 | 8 | 7 | 1 | ||
| 12 | 8 | 6 | 1 | 7 | 1 | 1 | 4 | 1 | ||
| Google Inc | 4 | 7 | 5 | 1 | 7 | 1 | 1 | 4 | 1 | |
| Linux | 5 | 3 | 1 | 1 | 8 | 1 | 1 | 2 | ||
| Debian | 13 | 2 | 12 | 1 | 4 | 5 | 4 | |||
| Google Inc. | 10 | 3 | 1 | 6 | 1 | 4 | 1 | |||
| Cisco | 3 | 4 | 7 | 11 | 2 | |||||
| Сообщество Свободного Программного Обеспечения | 2 | 4 | 6 | 3 | 3 | |||||
| Adobe | 1 | 1 | 8 | 7 | 1 |