March 2018
2,306 CVEs published, +71% on February 2018 and +68% on March 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 19915% of the 1,339 with a CVSS score
- Added to CISA KEV
- 022 of this month's CVEs are in KEV, listed a median 1436 days after publication
- Vendors
- 5131,905 products
- Top weakness
- XSSCWE-79 · 194 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1DebianDebian Linux107151new
- 2GoogleAndroid, Chrome OS7817nonenew
- 3CanonicalUbuntu Linux, Ubuntu, Screen-resolution-extra757nonenew
- 4MicrosoftWindows 10, Windows Server 2016, Windows Server 2008740nonenew
- 5Microsoft CorporationMicrosoft Sharepoint, Windows Kernel, Chakracore, Microsoft Edge740nonenew
- 6HuaweiDP300 Firmware, TE60 Firmware, TE30 Firmware720nonenew
- 7Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Rubygems, Linux72111new
- 8IBMRational Doors Next Generation, Rational Collaborative Lifecycle Management, Rational Quality Manager711nonenew
- 9Huawei Technologies Co., Ltd.Dp300; Rp200; Te30; Te40; Te50; TE60, Mate 9 Pro, Dp300; Ips Module; Ngfw Module; Nip6300; Nip6600; Rp200; S12700; S1700; S2700; S5700; S6700; S7700; S9700; Secospace Usg6300; Secospace Usg6500; Secospace Usg6600; Te30; Te40; Te50; Te60; Tp3106; Tp3206; Usg9500; Viewpoint 9030670nonenew
- 10Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»6510nonenew
- 11Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop636nonenew
- 12CiscoIOS XE, Cisco IOS XE, IOS62417new
- 13MavenOrg.jruby:jruby-stdlib, Org.apache.syncope:syncope-core, Org.keycloak:keycloak-core404nonenew
- 14NetiqIdentity Manager, Access Manager, Imanager301nonenew
- 15Dell EmcIsilon Onefs, Scaleio, Rsa Authentication Agent For Web For Iis, Rsa Authentication Agent For Web For Apache Web Server283nonenew
- 16Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Iot, Snapdragon Mobile, Snapdragon Iot, Snapdragon Mobile, Snapdragon Automobile2811nonenew
- 17LinuxLinux Kernel220nonenew
- 18Windows Optimization Master ProjectWindows Optimization Master210nonenew
- 19LibmingLibming200nonenew
- 20PackagistDrupal/core, Drupal/drupal, Simplesamlphp/saml22071new
- 21Ао «концерн Вниинс»Ос Он «стрелец»194nonenew
- 22ApacheHTTP Server, Syncope, Xerces-c\+\+182nonenew
- 23DellEmc Isilon, Emc Scaleio, Emc Isilon Onefs183nonenew
- 24Apache Software FoundationApache HTTP Server, HTTP Server, Apache Syncope172nonenew
- 25IobitAdvanced Systemcare Ultimate150nonenew
Severity
How this month's CVEs score on CVSS; 967 have no score yet. Severity is not exploitation.
- Critical199
- High551
- Medium555
- Low34
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS194
- CWE-20Improper Input Validation165
- CWE-200Information Exposure95
- CWE-119Memory Buffer Bounds78
- CWE-125Out-of-bounds Read77
- CWE-787Out-of-bounds Write56
- CWE-287Improper Authentication46
- CWE-352CSRF46
- CWE-22Path Traversal42
- CWE-476NULL Pointer Dereference40
- CWE-89SQL Injection28
- CWE-26425
- CWE-78OS Command Injection24
- CWE-416Use After Free22
- CWE-732Incorrect Permissions22
- CWE-798Hard-coded Credentials18
- CWE-190Integer Overflow17
- CWE-362Race Condition17
- CWE-434Unrestricted File Upload17
- CWE-611XXE17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems39221% of sector-tagged CVEs
- OSS Libraries24313% of sector-tagged CVEs
- Enterprise Software19711% of sector-tagged CVEs
- Mobile Apps1619% of sector-tagged CVEs
- Security Products1498% of sector-tagged CVEs
- Networking Infrastructure1317% of sector-tagged CVEs
- Web & CMS Plugins1247% of sector-tagged CVEs
- ICS / OT / IoT784% of sector-tagged CVEs
- 7 smaller sectors299
- Not yet classified57
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 20Improper Input Validation | 200Information Exposure | 119Memory Buffer Bounds | 125Out-of-bounds Read | 787Out-of-bounds Write | 287Improper Authentication | 352CSRF | 22Path Traversal | 476NULL Pointer Dereference |
|---|---|---|---|---|---|---|---|---|---|---|
| Debian | 6 | 7 | 1 | 10 | 13 | 14 | 2 | 1 | 3 | 14 |
| Microsoft | 13 | 3 | 9 | 2 | 16 | 1 | ||||
| Microsoft Corporation | 13 | 3 | 9 | 2 | 16 | 1 | ||||
| 19 | 12 | 23 | 16 | 4 | 3 | |||||
| Huawei | 13 | 7 | 9 | 10 | 4 | 1 | 3 | |||
| Сообщество Свободного Программного Обеспечения | 2 | 9 | 3 | 10 | 8 | 8 | 2 | 1 | 6 | |
| IBM | 18 | 2 | 20 | 1 | 2 | 3 | ||||
| Huawei Technologies Co., Ltd. | 10 | 7 | 9 | 9 | 4 | 1 | 3 | |||
| Canonical | 2 | 2 | 12 | 12 | 8 | 1 | 10 | |||
| Ооо «русбитех-астра» | 1 | 6 | 3 | 6 | 6 | 6 | 2 | 1 | 8 | |
| Cisco | 9 | 13 | 3 | 4 | 2 | 3 | 3 | |||
| Red Hat | 1 | 6 | 1 | 8 | 5 | 9 | 2 | 6 |