May 2013
358 CVEs published, −18% on April 2013 and −18% on May 2012. CISA added 0 to KEV.
2013 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2013 | January 2013: 443 CVEs | February 2013: 410 CVEs | March 2013: 446 CVEs | April 2013: 434 CVEs | May 2013: 358 CVEs | June 2013: 370 CVEs | July 2013: 500 CVEs | August 2013: 360 CVEs | September 2013: 475 CVEs | October 2013: 634 CVEs | November 2013: 399 CVEs | December 2013: 495 CVEs | 5,324−1% |
- Critical
- 10931% of the 356 with a CVSS score
- Added to CISA KEV
- 05 of this month's CVEs are in KEV, listed a median 3230 days after publication
- Vendors
- 100277 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 74 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AdobeAcrobat Reader, Acrobat, Adobe Air40381new
- 2CiscoUnified Customer Voice Portal, NX-OS, Prime Central For Hosted Collaboration Solution361nonenew
- 3MicrosoftPublisher, Internet Explorer, Windows Server 201236232new
- 4AppleItunes, iPhone OS, Quicktime3423nonenew
- 5OpensuseOpensuse25131new
- 6IBMInfosphere Optim Data Growth For Oracle E-business Suite, Sterling Secure Proxy, Lotus Notes211nonenew
- 7Red HatEnterprise Linux Eus, Enterprise Linux Workstation, Enterprise Linux Server20142new
- 8SuseLinux Enterprise Desktop, Linux Enterprise Server16141new
- 9GoogleChrome, Android, Google Chrome150nonenew
- 10GwosGroundwork Monitor150nonenew
- 11MozillaFirefox, Thunderbird Esr, Thunderbird1491new
- 12EmcRsa Archer Egrc, Documentum Records Manager, Documentum Taskspace122nonenew
- 13DebianDebian Linux1001new
- 14CanonicalUbuntu Linux, Telepathy-idle801new
- 15WiresharkWireshark80nonenew
- 16JoomlaJoomla\!60nonenew
- 17XenXen60nonenew
- 18ApacheSubversion50nonenew
- 19MoodleMoodle50nonenew
- 20PackagistMoodle/moodle, Zendframework/zendframework150nonenew
- 21InvensysWonderware Information Server42nonenew
- 22LinuxLinux Kernel401new
- 23LockonEc-cube40nonenew
- 24PyPIKeystone, Django40nonenew
- 25ElggElgg30nonenew
Severity
How this month's CVEs score on CVSS; 2 have no score yet. Severity is not exploitation.
- Critical109
- High55
- Medium173
- Low19
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds74
- CWE-26444
- CWE-39944
- CWE-79XSS42
- CWE-20Improper Input Validation38
- CWE-89SQL Injection16
- CWE-200Information Exposure14
- CWE-18913
- CWE-287Improper Authentication12
- CWE-416Use After Free9
- CWE-22Path Traversal7
- CWE-2557
- CWE-3104
- CWE-352CSRF4
- CWE-94Code Injection4
- CWE-162
- CWE-190Integer Overflow2
- CWE-134Format String1
- CWE-362Race Condition1
- CWE-6651
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems8622% of sector-tagged CVEs
- Consumer Software5614% of sector-tagged CVEs
- Mobile Apps4912% of sector-tagged CVEs
- Enterprise Software4712% of sector-tagged CVEs
- Networking Infrastructure4010% of sector-tagged CVEs
- Web & CMS Plugins3810% of sector-tagged CVEs
- Security Products349% of sector-tagged CVEs
- OSS Libraries195% of sector-tagged CVEs
- Not yet classified7
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 264 | 399 | 79XSS | 20Improper Input Validation | 89SQL Injection | 200Information Exposure | 189 | 287Improper Authentication | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | 33 | 1 | 1 | 1 | ||||||
| Cisco | 3 | 1 | 5 | 6 | 8 | 1 | 5 | |||
| Microsoft | 7 | 1 | 3 | 4 | 2 | 2 | 1 | 9 | ||
| Apple | 12 | 21 | 1 | |||||||
| Opensuse | 16 | 3 | 4 | |||||||
| IBM | 2 | 7 | 2 | 1 | 2 | 1 | 2 | |||
| Red Hat | 13 | 1 | 1 | 1 | ||||||
| Suse | 14 | 1 | ||||||||
| 2 | 1 | 8 | 1 | 1 | ||||||
| Gwos | 5 | 1 | 2 | 1 | 1 | |||||
| Mozilla | 3 | 3 | 4 | 1 | 1 | |||||
| Emc | 1 | 4 | 3 | 2 | 1 | 1 |
CVEs published in May 2013
5 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2013-2729Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerabil...KEV9.8
- CVE-2013-1347Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) i...KEV8.8
- CVE-2013-2094The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_ope...KEV8.4
- CVE-2013-3660The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Wi...KEV7.8
- CVE-2013-1675Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::...KEV6.5