February 2018
1,350 CVEs published, −21% on January 2018 and +26% on February 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 25819% of the 1,334 with a CVSS score
- Added to CISA KEV
- 03 of this month's CVEs are in KEV, listed a median 1366 days after publication
- Vendors
- 4911,264 products
- Top weakness
- Improper Input ValidationCWE-20 · 184 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Hewlett Packard EnterpriseIntelligent Management Center (Imc) Plat, Matrix Operating Environment, System Management Homepage For Windows and Linux18636nonenew
- 2HPIntelligent Management Center, HPE Intelligent Management Center Plat, Matrix Operating Environment18536nonenew
- 3DebianDebian Linux117221new
- 4HuaweiDP300 Firmware, TE60 Firmware, TE50 Firmware711nonenew
- 5Huawei Technologies Co., Ltd.Dp300,rp200,te30,te40,te50,te60, Dp300,ips Module,ngfw Module,nip6300,nip6600,nip6800,rp200,svn5600,svn5800,svn5800-c,semg9811,secospace Usg6300,secospace Usg6500,secospace Usg6600,te30,te40,te50,te60,usg9500,usg9520,usg9560,usg9580,vp9660,viewpoint 8660,viewpoint 9030,espace U1981, Ips,module,ngfw,module,nip6300,nip6600,secospace,usg6300,secospace,usg6500,secospace,usg6600,usg9500711nonenew
- 6MicrosoftWindows 10, Windows Server 2016, Windows 7580nonenew
- 7GoogleAndroid, Chrome, Chrome OS563nonenew
- 8IBMTririga Application Platform, Client Application Access, Notes514nonenew
- 9CanonicalUbuntu Linux, Ubuntu, Apport5091new
- 10Microsoft CorporationWindows, Microsoft Edge, Chakracore, Microsoft Edge490nonenew
- 11Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, SAM2P, Libxml245141new
- 12AdobeAcrobat, Acrobat Dc, Acrobat Reader4441new
- 13Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition4081new
- 14SapInternet Graphics Server, Hana Extended Application Services, Sap Netweaver361nonenew
- 15CiscoData Center Analytics Framework, Unified Communications Manager, RV132W Firmware3251new
- 16Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop3281new
- 17MavenOrg.jenkins-ci.main:jenkins-core, Com.fasterxml.jackson.core:jackson-databind, Org.apache.geode:geode-core286nonenew
- 18ApacheGeode, Jmeter, Cloudstack264nonenew
- 19AtlassianCrucible, Bamboo, Fisheye261nonenew
- 20Sap SeSap Internet Graphics Server, Sap Hana Extended Application Services, Sap Crm Webclient Ui260nonenew
- 21QuestNetvault Backup, Quest Netvault Backup2524nonenew
- 22Apache Software FoundationApache Geode, Apache Jmeter, Apache Tomcat244nonenew
- 23Dell TechnologiesNetvault Backup2424nonenew
- 24WiresharkWireshark241nonenew
- 25JiangminAntivirus210nonenew
Severity
How this month's CVEs score on CVSS; 16 have no score yet. Severity is not exploitation.
- Critical258
- High558
- Medium495
- Low23
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-20Improper Input Validation184
- CWE-79XSS149
- CWE-89SQL Injection97
- CWE-200Information Exposure96
- CWE-119Memory Buffer Bounds82
- CWE-125Out-of-bounds Read62
- CWE-787Out-of-bounds Write60
- CWE-352CSRF32
- CWE-476NULL Pointer Dereference32
- CWE-22Path Traversal30
- CWE-416Use After Free26
- CWE-502Deserialization26
- CWE-190Integer Overflow25
- CWE-611XXE22
- CWE-78OS Command Injection20
- CWE-287Improper Authentication19
- CWE-835Infinite Loop19
- CWE-400Resource Consumption14
- CWE-732Incorrect Permissions13
- CWE-77213
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software41021% of sector-tagged CVEs
- Operating Systems35518% of sector-tagged CVEs
- Networking Infrastructure26013% of sector-tagged CVEs
- OSS Libraries22011% of sector-tagged CVEs
- Mobile Apps1297% of sector-tagged CVEs
- Web & CMS Plugins1297% of sector-tagged CVEs
- Security Products1076% of sector-tagged CVEs
- 8 smaller sectors245
- Not yet classified74
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 20Improper Input Validation | 79XSS | 89SQL Injection | 200Information Exposure | 119Memory Buffer Bounds | 125Out-of-bounds Read | 787Out-of-bounds Write | 352CSRF | 476NULL Pointer Dereference | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Hewlett Packard Enterprise | 86 | 9 | 3 | 20 | 3 | 3 | 1 | 4 | ||
| HP | 86 | 8 | 3 | 20 | 4 | 3 | 1 | 4 | ||
| Debian | 9 | 2 | 2 | 11 | 13 | 6 | 9 | 1 | ||
| HP Inc. | 69 | 1 | 1 | 2 | ||||||
| Huawei | 16 | 1 | 18 | 7 | 4 | 1 | ||||
| Huawei Technologies Co., Ltd. | 16 | 1 | 18 | 7 | 4 | 1 | ||||
| Microsoft | 3 | 10 | 4 | 16 | 1 | |||||
| 7 | 1 | 8 | 6 | 1 | 8 | 1 | ||||
| IBM | 1 | 12 | 1 | 12 | 2 | |||||
| Canonical | 3 | 1 | 3 | 4 | 1 | 8 | ||||
| Microsoft Corporation | 2 | 9 | 16 | 1 | ||||||
| Сообщество Свободного Программного Обеспечения | 1 | 2 | 4 | 3 | 4 | 3 |