November 2013
399 CVEs published, −37% on October 2013 and −10% on November 2012. CISA added 0 to KEV.
2013 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2013 | January 2013: 443 CVEs | February 2013: 410 CVEs | March 2013: 446 CVEs | April 2013: 434 CVEs | May 2013: 358 CVEs | June 2013: 370 CVEs | July 2013: 500 CVEs | August 2013: 360 CVEs | September 2013: 475 CVEs | October 2013: 634 CVEs | November 2013: 399 CVEs | December 2013: 495 CVEs | 5,324−1% |
- Critical
- 5213% of the 394 with a CVSS score
- Added to CISA KEV
- 05 of this month's CVEs are in KEV, listed a median 3052 days after publication
- Vendors
- 152317 products
- Top weakness
- XSSCWE-79 · 63 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1CiscoIOS, Adaptive Security Appliance Software, Wireless Lan Controller341nonenew
- 2IBMLotus Sametime, Java, Websphere Application Server343nonenew
- 3MicrosoftInternet Explorer, Windows 8, Windows Xp23113new
- 4LinuxLinux Kernel2201new
- 5FfmpegFfmpeg2016nonenew
- 6OpensuseOpensuse170nonenew
- 7Red HatEnterprise Linux, Openstack, Red Hat Enterprise Linux170nonenew
- 8GoogleChrome, Web Toolkit152nonenew
- 9CanonicalUbuntu Linux, Maas130nonenew
- 10DebianDebian Linux121nonenew
- 11SapNetweaver, Netweaver Development Infrastructure, Netweaver Logviewer112nonenew
- 12HPLoadrunner, Integrated Lights-out 4, Integrated Lights-out Firmware102nonenew
- 13SybaseAdaptive Server Enterprise103nonenew
- 14Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux101nonenew
- 15EmcDocument Sciences Xpression, Documentum Digital Asset Manager, Documentum Administrator90nonenew
- 16PyPISalt, Nova, Keystone93nonenew
- 17Gentoo Foundation Inc.Gentoo Linux70nonenew
- 18NovellZenworks Configuration Management, Suse Studio Onsite, Suse Linux Enterprise Debuginfo71nonenew
- 19DlinkDes-3800, Des-3800 Firmware, Dsl-2740b601new
- 20LockonEc-cube60nonenew
- 21OpenstackGrizzly, Havana, Folsom60nonenew
- 22PineappMail-secure, Mail-secure 5099sk60nonenew
- 23SaltstackSalt63nonenew
- 24MoodleMoodle50nonenew
- 25MozillaNetwork Security Services, Seamonkey, Firefox50nonenew
Severity
How this month's CVEs score on CVSS; 5 have no score yet. Severity is not exploitation.
- Critical52
- High63
- Medium235
- Low44
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS63
- CWE-119Memory Buffer Bounds59
- CWE-26447
- CWE-20Improper Input Validation46
- CWE-200Information Exposure20
- CWE-22Path Traversal16
- CWE-352CSRF15
- CWE-18914
- CWE-39914
- CWE-94Code Injection13
- CWE-89SQL Injection11
- CWE-31010
- CWE-2557
- CWE-287Improper Authentication4
- CWE-594
- CWE-190Integer Overflow2
- CWE-362Race Condition2
- CWE-1161
- CWE-326Inadequate Encryption1
- CWE-416Use After Free1
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems11425% of sector-tagged CVEs
- Enterprise Software7517% of sector-tagged CVEs
- Networking Infrastructure5312% of sector-tagged CVEs
- OSS Libraries5312% of sector-tagged CVEs
- Web & CMS Plugins358% of sector-tagged CVEs
- Security Products276% of sector-tagged CVEs
- Mobile Apps194% of sector-tagged CVEs
- Cloud & SaaS184% of sector-tagged CVEs
- 6 smaller sectors42
- Not yet classified15
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 119Memory Buffer Bounds | 264 | 20Improper Input Validation | 200Information Exposure | 22Path Traversal | 352CSRF | 189 | 399 | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Cisco | 2 | 9 | 6 | 12 | 2 | 2 | ||||
| IBM | 12 | 2 | 6 | 3 | 2 | 1 | ||||
| Microsoft | 10 | 1 | 2 | 5 | 1 | 1 | ||||
| Linux | 9 | 2 | 2 | 2 | 4 | 2 | ||||
| Ffmpeg | 12 | 3 | 4 | |||||||
| Opensuse | 1 | 3 | 3 | 1 | 2 | 1 | 1 | |||
| Red Hat | 3 | 2 | 2 | 1 | ||||||
| 1 | 2 | 1 | 1 | 2 | 4 | |||||
| Canonical | 1 | 3 | 2 | 2 | 1 | 1 | 2 | |||
| Debian | 1 | 2 | 1 | 1 | 1 | 1 | ||||
| Sap | 2 | 1 | 2 | 2 | 1 | |||||
| HP | 1 | 1 |
CVEs published in November 2013
5 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2013-3918The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 S...KEV8.8
- CVE-2013-6282The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the cont...KEV8.8
- CVE-2013-3906GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows re...KEV7.8
- CVE-2013-5065NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.KEV7.8
- CVE-2013-5223Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpServer1 parameter to...KEV5.4