February 2019
908 CVEs published, −33% on February 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 13916% of the 862 with a CVSS score
- Added to CISA KEV
- 06 of this month's CVEs are in KEV, listed a median 1117 days after publication
- Vendors
- 4291,353 products
- Top weakness
- XSSCWE-79 · 121 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Sdl, Rdesktop130221new
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition12918nonenew
- 3DebianDebian Linux, Tmpreaper12126nonenew
- 4CanonicalUbuntu Linux, Ubuntu11023nonenew
- 5Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop8316nonenew
- 6GoogleAndroid, Google Chrome, Chrome682nonenew
- 7FedoraprojectFedora593nonenew
- 8Novell Inc.Opensuse Leap, Suse Linux Enterprise Software Development Kit, Suse Linux Enterprise Server508nonenew
- 9OpensuseLeap, Backports Sle, Package Hub4812nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»454nonenew
- 11ZoneminderZoneminder355nonenew
- 12MozillaFirefox, Firefox Esr, Thunderbird3412nonenew
- 13CiscoHyperflex Hx Data Platform, Cisco Hyperflex Hx-series, Telepresence Management Suite311nonenew
- 14MavenOrg.jenkins-ci.plugins:job-import-plugin, Io.jenkins.blueocean:blueocean, Org.jenkins-ci.plugins:script-security312nonenew
- 15Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile293nonenew
- 16NetappSolidfire, Hci Management Node, Storage Automation Store286nonenew
- 17IBMSecurity Identity Governance and Intelligence, Bigfix Compliance, Security Identity Manager272nonenew
- 18AndroidAndroid261nonenew
- 19Ао "нппкт"Осон Основа Оnyx250nonenew
- 20JenkinsJob Import, Jenkins Job Import Plugin, Jenkins Script Security Plugin241nonenew
- 21Ics-certLcds Laquis Scada, PR100088 Modbus Gateway, Wecon Levistudiou225nonenew
- 22QualcommSd 820a Firmware, MDM9650 Firmware, Sd 835 Firmware223nonenew
- 23Fedora ProjectFedora200nonenew
- 24DlinkDir-878, Dir-878 Firmware, Dir-823g Firmware194nonenew
- 25npmM-server, Bootstrap-sass, Defaults-deep196nonenew
Severity
How this month's CVEs score on CVSS; 46 have no score yet. Severity is not exploitation.
- Critical139
- High361
- Medium345
- Low17
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS121
- CWE-125Out-of-bounds Read66
- CWE-787Out-of-bounds Write65
- CWE-119Memory Buffer Bounds37
- CWE-20Improper Input Validation37
- CWE-22Path Traversal37
- CWE-352CSRF30
- CWE-200Information Exposure27
- CWE-89SQL Injection27
- CWE-416Use After Free25
- CWE-476NULL Pointer Dereference21
- CWE-78OS Command Injection18
- CWE-190Integer Overflow16
- CWE-287Improper Authentication15
- CWE-94Code Injection15
- CWE-25414
- CWE-434Unrestricted File Upload13
- CWE-400Resource Consumption12
- CWE-74Injection11
- CWE-770Allocation Without Limits10
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems28521% of sector-tagged CVEs
- OSS Libraries21316% of sector-tagged CVEs
- Enterprise Software1179% of sector-tagged CVEs
- Web & CMS Plugins1068% of sector-tagged CVEs
- ICS / OT / IoT937% of sector-tagged CVEs
- Consumer Software796% of sector-tagged CVEs
- Networking Infrastructure786% of sector-tagged CVEs
- Mobile Apps766% of sector-tagged CVEs
- Security Products756% of sector-tagged CVEs
- Hardware Firmware584% of sector-tagged CVEs
- Not yet classified56
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 125Out-of-bounds Read | 787Out-of-bounds Write | 119Memory Buffer Bounds | 20Improper Input Validation | 22Path Traversal | 352CSRF | 200Information Exposure | 89SQL Injection | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 1 | 30 | 21 | 10 | 3 | 1 | 3 | 12 | ||
| Ооо «русбитех-астра» | 1 | 25 | 14 | 12 | 6 | 1 | 9 | |||
| Debian | 1 | 28 | 22 | 9 | 3 | 1 | 3 | 11 | ||
| Canonical | 28 | 14 | 14 | 1 | 1 | 7 | ||||
| Red Hat | 4 | 6 | 10 | 8 | 4 | 2 | 2 | 2 | 10 | |
| Canonical Ltd. | 18 | 10 | 10 | 1 | 1 | 1 | 3 | |||
| 1 | 10 | 16 | 3 | 5 | 1 | 11 | ||||
| Fedoraproject | 1 | 15 | 8 | 4 | 2 | 5 | ||||
| Novell Inc. | 20 | 4 | 4 | 1 | 2 | 2 | ||||
| Opensuse | 19 | 9 | 2 | 2 | 4 | |||||
| Ао «концерн Вниинс» | 14 | 8 | 5 | 1 | 2 | 1 | ||||
| Zoneminder | 26 | 1 | 4 |