February 2015
496 CVEs published, −33% on January 2015 and +11% on February 2014. CISA added 0 to KEV.
2015 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 | January 2015: 737 CVEs | February 2015: 496 CVEs | March 2015: 457 CVEs | April 2015: 558 CVEs | May 2015: 417 CVEs | June 2015: 499 CVEs | July 2015: 644 CVEs | August 2015: 625 CVEs | September 2015: 499 CVEs | October 2015: 739 CVEs | November 2015: 368 CVEs | December 2015: 567 CVEs | 6,606−18% |
- Critical
- 8517% of the 486 with a CVSS score
- Added to CISA KEV
- 04 of this month's CVEs are in KEV, listed a median 2610 days after publication
- Vendors
- 220434 products
- Top weakness
- XSSCWE-79 · 71 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftInternet Explorer, Windows 8.1, Windows Rt 8.157382new
- 2OpensuseOpensuse, Evergreen4911new
- 3CiscoIOS, Webex Meetings Server, Prime Infrastructure441nonenew
- 4CanonicalUbuntu Linux, Ubuntu431nonenew
- 5Red HatEnterprise Linux Workstation, Enterprise Linux Desktop, Enterprise Linux Server3121new
- 6FedoraprojectFedora280nonenew
- 7DebianDebian Linux250nonenew
- 8IBMTivoli Storage Manager, Maximo For Nuclear Power, Change and Configuration Management Database250nonenew
- 9FreetypeFreetype200nonenew
- 10AdobeFlash Player19191new
- 11MozillaFirefox, Thunderbird, Firefox Esr190nonenew
- 12OracleSolaris160nonenew
- 13FortinetFortiauthenticator, Forticlient, Fortios110nonenew
- 14OwncloudOwncloud Server, Owncloud100nonenew
- 15MavenOrg.apache.ws.security:wss4j, Org.mindrot:jbcrypt, Org.python:jython-standalone911new
- 16GoogleChrome, Email, Android71nonenew
- 17SiemensRuggedcom Firmware, Simatic Step 7, Wincc72nonenew
- 18McafeeData Loss Prevention Endpoint, Email Gateway, Mcafee Agent60nonenew
- 19DlinkDap-1320, Dir-645 Firmware, Dcs-931l Firmware531new
- 20MitKerberos 552nonenew
- 21ApacheActivemq, Qpid, Tomcat40nonenew
- 22ClamavClamav40nonenew
- 23EmcDocumentum D2, Captiva Capture, Unisphere Central41nonenew
- 24FreebsdFreebsd40nonenew
- 25GnuGlibc, Cpio, Grep40nonenew
Severity
How this month's CVEs score on CVSS; 10 have no score yet. Severity is not exploitation.
- Critical85
- High93
- Medium275
- Low33
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS71
- CWE-26455
- CWE-39955
- CWE-200Information Exposure42
- CWE-119Memory Buffer Bounds38
- CWE-89SQL Injection29
- CWE-20Improper Input Validation23
- CWE-352CSRF19
- CWE-22Path Traversal14
- CWE-31012
- CWE-362Race Condition9
- CWE-284Improper Access Control7
- CWE-196
- CWE-1895
- CWE-174
- CWE-2544
- CWE-287Improper Authentication4
- CWE-74Injection4
- CWE-125Out-of-bounds Read3
- CWE-77Command Injection3
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems14825% of sector-tagged CVEs
- Enterprise Software6912% of sector-tagged CVEs
- Web & CMS Plugins6812% of sector-tagged CVEs
- Networking Infrastructure6411% of sector-tagged CVEs
- OSS Libraries559% of sector-tagged CVEs
- Consumer Software458% of sector-tagged CVEs
- Security Products356% of sector-tagged CVEs
- 7 smaller sectors81
- Not yet classified21
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 264 | 399 | 200Information Exposure | 119Memory Buffer Bounds | 89SQL Injection | 20Improper Input Validation | 352CSRF | 22Path Traversal | 310 |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 1 | 8 | 37 | 2 | 1 | |||||
| Opensuse | 3 | 3 | 2 | 15 | 2 | |||||
| Cisco | 6 | 4 | 4 | 4 | 1 | 14 | 3 | |||
| Canonical | 2 | 2 | 1 | 18 | ||||||
| Red Hat | 6 | 1 | 4 | 1 | ||||||
| Fedoraproject | 1 | 1 | 2 | 13 | ||||||
| Debian | 1 | 2 | 10 | 1 | ||||||
| IBM | 6 | 4 | 1 | 6 | 2 | 2 | ||||
| Freetype | 1 | 10 | ||||||||
| Adobe | 3 | |||||||||
| Adobe Systems Inc. | 3 | |||||||||
| Mozilla | 1 | 1 | 2 | 5 |
CVEs published in February 2015
4 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2015-0313Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute ...KEV9.8
- CVE-2015-1427The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafte...KEV9.8
- CVE-2015-2051The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.KEV8.8
- CVE-2015-0071Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."KEV6.5