October 2010
435 CVEs published, +45% on September 2010 and +23% on October 2009. CISA added 0 to KEV.
2010 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2010 | January 2010: 319 CVEs | February 2010: 308 CVEs | March 2010: 515 CVEs | April 2010: 520 CVEs | May 2010: 408 CVEs | June 2010: 493 CVEs | July 2010: 344 CVEs | August 2010: 383 CVEs | September 2010: 301 CVEs | October 2010: 435 CVEs | November 2010: 280 CVEs | December 2010: 361 CVEs | 4,667−18% |
- Critical
- 12529% of the 434 with a CVSS score
- Added to CISA KEV
- 01 of this month's CVEs are in KEV, listed a median 5458 days after publication
- Vendors
- 120248 products
- Top weakness
- Improper Input ValidationCWE-20 · 45 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OraclePeoplesoft and Jdedwards Product Suite, Opensolaris, Solaris795nonenew
- 2MicrosoftOffice, Excel, Word4830nonenew
- 3AdobeAcrobat Reader, Acrobat, Shockwave Player3733nonenew
- 4IBMDB2, Tivoli Storage Manager Fastback, Informix Dynamic Server298nonenew
- 5SunJdk, Jre, Sdk2718nonenew
- 6HPSystems Insight Manager, Insight Control Virtual Machine Management, Insight Control Server Migration232nonenew
- 7PyPIPyftpdlib, ZODB3150nonenew
- 8G.rodolaPyftpdlib140nonenew
- 9GoogleChrome136nonenew
- 10MozillaFirefox, Seamonkey, Thunderbird1371new
- 11Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux90nonenew
- 12OperaOpera Browser81nonenew
- 13Red HatEnterprise Mrg, Red Hat Enterprise Linux80nonenew
- 14ApacheQpid, Apr-util, AXIS271nonenew
- 15RealnetworksRealplayer, Realplayer Sp77nonenew
- 16OpensuseOpensuse61nonenew
- 17SapBusinessobjects62nonenew
- 18TYPO3TYPO350nonenew
- 19CmsmadesimpleCMS Made Simple40nonenew
- 20DebianDebian Linux, Mono-debugger40nonenew
- 21DovecotDovecot40nonenew
- 22InfradeadOpenconnect40nonenew
- 23LinuxLinux Kernel40nonenew
- 24XeleranceOpenswan40nonenew
- 25ApereoPhpcas30nonenew
Severity
How this month's CVEs score on CVSS; 1 have no score yet. Severity is not exploitation.
- Critical125
- High38
- Medium247
- Low24
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-20Improper Input Validation45
- CWE-119Memory Buffer Bounds43
- CWE-26429
- CWE-94Code Injection25
- CWE-79XSS24
- CWE-39917
- CWE-200Information Exposure10
- CWE-22Path Traversal7
- CWE-362Race Condition6
- CWE-3105
- CWE-352CSRF5
- CWE-1894
- CWE-287Improper Authentication4
- CWE-78OS Command Injection4
- CWE-190Integer Overflow3
- CWE-593
- CWE-2552
- CWE-89SQL Injection2
- CWE-161
- CWE-4041
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 20Improper Input Validation | 119Memory Buffer Bounds | 264 | 94Code Injection | 79XSS | 399 | 200Information Exposure | 22Path Traversal | 362Race Condition | 310 |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | |||||||||
| Microsoft | 13 | 4 | 4 | 14 | 1 | 2 | 5 | |||
| Adobe | 8 | 20 | 1 | 2 | ||||||
| IBM | 2 | 3 | 4 | 3 | 1 | 7 | ||||
| Sun | ||||||||||
| HP | 7 | |||||||||
| PyPI | 2 | 3 | 1 | 2 | 4 | |||||
| G.rodola | 2 | 3 | 1 | 2 | 3 | |||||
| 5 | ||||||||||
| Mozilla | 3 | 1 | 1 | 1 | 2 | |||||
| Opera | 3 | 1 | 2 | 1 | 1 | |||||
| Сообщество Свободного Программного Обеспечения | 2 | 1 | 2 | 1 | 2 |
CVEs published in October 2010
2 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2010-3765Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote att...KEV9.8
- CVE-2010-0219Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easie...10.0