December 2018
1,212 CVEs published, +8% on December 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 17515% of the 1,173 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 1339 days after publication
- Vendors
- 4901,382 products
- Top weakness
- XSSCWE-79 · 207 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition133111new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Freeware Advanced Audio Decoder 2, Libvnc130132new
- 3DebianDebian Linux127141new
- 4GoogleChrome, Android, Google Chrome10451new
- 5Red HatEnterprise Linux Workstation, Enterprise Linux Server, Enterprise Linux Desktop8592new
- 6CanonicalUbuntu Linux, Ubuntu779nonenew
- 7IBMSecurity Access Manager Appliance, Security Access Manager, Security Guardium650nonenew
- 8MicrosoftWindows Server 2019 (Server Core Installation), Windows 10, Windows Server 20194023new
- 9Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Basesystem, Suse Linux Enterprise Desktop3901new
- 10MavenOrg.jenkins-ci.main:jenkins-core, Org.apache.nifi:nifi, Org.hswebframework.web:hsweb-commons3491new
- 11Ао «концерн Вниинс»Ос Он «стрелец»332nonenew
- 12Google Inc.Android322nonenew
- 13OpensuseLeap, Libsolv, Backports Sle321nonenew
- 14FedoraprojectFedora, Sssd292nonenew
- 15InfovistaVistaportal260nonenew
- 16SiemensSinumerik 828d V4.7 Firmware, Sinumerik 840d Sl V4.8 Firmware, Sinumerik 840d Sl V4.7 Firmware254nonenew
- 17LibrawLibraw210nonenew
- 18Ао "нппкт"Осон Основа Оnyx211nonenew
- 19Libraw LlcLibraw190nonenew
- 20PackagistPhpmyadmin/phpmyadmin, Craftcms/cms, Evolutioncms/evolution190nonenew
- 21AudiocodingFreeware Advanced Audio Decoder 2, Freeware Advanced Audio Coder180nonenew
- 22Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Mobile, Snapdragon Wear162nonenew
- 23AsustorData Master151nonenew
- 24Drobo5n2 Firmware146nonenew
- 25FacebookHhvm, Proxygen, Whatsapp For Windows Phone144nonenew
Severity
How this month's CVEs score on CVSS; 39 have no score yet. Severity is not exploitation.
- Critical175
- High434
- Medium548
- Low16
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS207
- CWE-787Out-of-bounds Write92
- CWE-200Information Exposure77
- CWE-20Improper Input Validation67
- CWE-119Memory Buffer Bounds59
- CWE-125Out-of-bounds Read42
- CWE-522Insufficiently Protected Credentials35
- CWE-476NULL Pointer Dereference34
- CWE-611XXE34
- CWE-22Path Traversal32
- CWE-416Use After Free32
- CWE-89SQL Injection31
- CWE-352CSRF29
- CWE-190Integer Overflow26
- CWE-78OS Command Injection26
- CWE-400Resource Consumption18
- CWE-732Incorrect Permissions17
- CWE-835Infinite Loop14
- CWE-269Improper Privilege Mgmt13
- CWE-287Improper Authentication13
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems33521% of sector-tagged CVEs
- OSS Libraries23515% of sector-tagged CVEs
- Enterprise Software20813% of sector-tagged CVEs
- Web & CMS Plugins1439% of sector-tagged CVEs
- Mobile Apps1167% of sector-tagged CVEs
- Cloud & SaaS875% of sector-tagged CVEs
- Hardware Firmware815% of sector-tagged CVEs
- Networking Infrastructure805% of sector-tagged CVEs
- 7 smaller sectors261
- Not yet classified70
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 200Information Exposure | 20Improper Input Validation | 119Memory Buffer Bounds | 125Out-of-bounds Read | 522Insufficiently Protected Credentials | 476NULL Pointer Dereference | 611XXE | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Ооо «русбитех-астра» | 1 | 27 | 2 | 4 | 15 | 10 | 16 | |||
| Сообщество Свободного Программного Обеспечения | 2 | 21 | 3 | 9 | 16 | 10 | 16 | |||
| Debian | 6 | 23 | 6 | 14 | 7 | 7 | 8 | 1 | 1 | |
| 1 | 33 | 4 | 11 | 4 | 6 | 1 | 1 | |||
| Red Hat | 18 | 4 | 8 | 3 | 4 | 3 | 1 | |||
| Canonical | 1 | 10 | 1 | 2 | 9 | 10 | 8 | |||
| IBM | 12 | 12 | 4 | 1 | 4 | |||||
| Canonical Ltd. | 1 | 6 | 2 | 2 | 5 | 3 | 6 | |||
| Google Inc | 18 | 5 | 2 | |||||||
| Microsoft | 3 | 9 | 1 | 2 | ||||||
| Microsoft Corp | 3 | 9 | 1 | 2 | ||||||
| Novell Inc. | 13 | 1 | 4 | 4 | 2 | 1 | 1 |