December 2019
1,881 CVEs published, +4% on November 2019 and +55% on December 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 25416% of the 1,589 with a CVSS score
- Added to CISA KEV
- 020 of this month's CVEs are in KEV, listed a median 849 days after publication
- Vendors
- 6542,591 products
- Top weakness
- Out-of-bounds WriteCWE-787 · 229 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AppleiPhone OS, IOS, Mac OS X248165new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Webkitgtk214132new
- 3Novell Inc.Opensuse Leap, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server16551new
- 4DebianDebian Linux, Devscripts, Debian Edu15918nonenew
- 5Red HatRed Hat Enterprise Linux, Enterprise Linux Workstation, Enterprise Linux Desktop13392new
- 6Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition1168nonenew
- 7FedoraprojectFedora, Sectool, Sssd11141new
- 8Ао «концерн Вниинс»Ос Он «стрелец»9641new
- 9SiemensSppa-t3000 MS3000 Migration Server, Sppa-t3000 Application Server, Sinec Infrastructure Network Services7826nonenew
- 10OpensuseLeap, Backports Sle, Opensuse746nonenew
- 11CanonicalUbuntu Linux, Ubuntu, Ubuntu Cobbler6761new
- 12Ао «ивк»Альт 8 Сп651nonenew
- 13Fedora ProjectFedora6121new
- 14GoogleChrome, Google Chrome, Android591nonenew
- 15QualcommQCS605 Firmware, SDM660 Firmware, SM8150 Firmware4812nonenew
- 16Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables4812nonenew
- 17MavenOrg.jenkins-ci.plugins:teamconcert, Org.jenkins-ci.plugins:websphere-deployer, Com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer4741new
- 18LinuxLinux Kernel410nonenew
- 19IntelIntel Converged Security and Manageability Engine, Converged Security Management Engine Firmware, Trusted Execution Engine Firmware402nonenew
- 20IBMCloud Pak System, Financial Transaction Manager, Cognos Analytics3441new
- 21MicrosoftWindows, Windows Server, Windows 103101new
- 22OracleMySQL Workbench, MySQL Enterprise Monitor, Graalvm Enterprise Edition3031new
- 23HuaweiS5700 Firmware, SVN5800-C Firmware, SVN5600 Firmware281nonenew
- 24JenkinsWebsphere Deployer, Team Concert, Jenkins Websphere Deployer Plugin280nonenew
- 25AdobeAcrobat Reader Dc, Acrobat Dc, Adobe Acrobat and Reader2719nonenew
Severity
How this month's CVEs score on CVSS; 292 have no score yet. Severity is not exploitation.
- Critical254
- High664
- Medium640
- Low31
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-787Out-of-bounds Write229
- CWE-79XSS165
- CWE-125Out-of-bounds Read83
- CWE-20Improper Input Validation79
- CWE-416Use After Free59
- CWE-287Improper Authentication53
- CWE-200Information Exposure44
- CWE-352CSRF42
- CWE-476NULL Pointer Dereference34
- CWE-120Buffer Overflow33
- CWE-78OS Command Injection31
- CWE-22Path Traversal30
- CWE-269Improper Privilege Mgmt28
- CWE-190Integer Overflow27
- CWE-89SQL Injection27
- CWE-119Memory Buffer Bounds23
- CWE-306Missing Auth for Critical Function23
- CWE-122Heap Buffer Overflow22
- CWE-276Incorrect Default Permissions21
- CWE-434Unrestricted File Upload21
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems47321% of sector-tagged CVEs
- Mobile Apps33815% of sector-tagged CVEs
- OSS Libraries27112% of sector-tagged CVEs
- Enterprise Software24211% of sector-tagged CVEs
- Web & CMS Plugins1426% of sector-tagged CVEs
- Hardware Firmware1246% of sector-tagged CVEs
- 9 smaller sectors536
- Not yet classified80
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 787Out-of-bounds Write | 79XSS | 125Out-of-bounds Read | 20Improper Input Validation | 416Use After Free | 287Improper Authentication | 200Information Exposure | 352CSRF | 476NULL Pointer Dereference | 120Buffer Overflow |
|---|---|---|---|---|---|---|---|---|---|---|
| Apple | 109 | 11 | 19 | 24 | 14 | 5 | 3 | 1 | 4 | |
| Сообщество Свободного Программного Обеспечения | 61 | 11 | 17 | 7 | 29 | 3 | 2 | 1 | 9 | |
| Novell Inc. | 63 | 6 | 8 | 5 | 24 | 2 | 2 | 5 | ||
| Debian | 21 | 11 | 10 | 6 | 14 | 3 | 4 | 7 | 1 | |
| Ооо «русбитех-астра» | 22 | 1 | 15 | 2 | 10 | 2 | 2 | 7 | ||
| Fedoraproject | 19 | 4 | 9 | 2 | 6 | 2 | 5 | 4 | 2 | |
| Red Hat | 26 | 7 | 4 | 4 | 4 | 2 | 2 | 3 | 3 | |
| Ао «концерн Вниинс» | 23 | 2 | 9 | 5 | 7 | 1 | 2 | 4 | ||
| Siemens | 22 | 2 | 2 | 1 | 15 | 7 | 1 | 3 | ||
| Opensuse | 11 | 1 | 7 | 3 | 9 | 1 | 5 | 1 | ||
| Red Hat Inc. | 20 | 1 | 3 | 3 | 4 | 2 | 2 | 2 | ||
| Ао «ивк» | 11 | 1 | 7 | 1 | 6 | 1 | 2 | 3 |