March 2017
1,373 CVEs published, +28% on February 2017 and 4.1× March 2016. CISA added 0 to KEV.
2017 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2017 | January 2017: no snapshot | February 2017: 1,075 CVEs | March 2017: 1,373 CVEs | April 2017: no snapshot | May 2017: 4,155 CVEs | June 2017: no snapshot | July 2017: 1,313 CVEs | August 2017: 1,564 CVEs | September 2017: 1,238 CVEs | October 2017: 1,441 CVEs | November 2017: no snapshot | December 2017: 1,120 CVEs | 13,2798 of 12 months8/12 |
- Critical
- 13811% of the 1,302 with a CVSS score
- Added to CISA KEV
- 017 of this month's CVEs are in KEV, listed a median 1834 days after publication
- Vendors
- 4041,295 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 180 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows Server 2008 Service Pack 2, Windows Vista Service Pack 2, Windows Server 2008134313new
- 2Microsoft CorporationWindows Uniscribe, Browser, Office129112new
- 3ImagemagickImagemagick9710nonenew
- 4GoogleAndroid880nonenew
- 5Google Inc.Android830nonenew
- 6DebianDebian Linux716nonenew
- 7LinuxLinux Kernel671nonenew
- 8IBMQradar Security Information and Event Manager, Qradar Incident Forensics, Rational Rhapsody Design Manager5621new
- 9IBM CorporationQradar Siem, Rational Collaborative Lifecycle Management, Kenexa Lcms Premier On Cloud531nonenew
- 10OpensuseLeap, Opensuse379nonenew
- 11IntelVirusscan Enterprise Linux (Vsel), Mcafee Application Control (Mac), Anti-virus Engine (Ave)351nonenew
- 12McafeeVirusscan Enterprise, Application Control, Security Scan Plus352nonenew
- 13Jasper ProjectJasper340nonenew
- 14Imagemagick Studio LlcImagemagick325nonenew
- 15CiscoIOS XE, Cisco IOS, IOS3131new
- 16CanonicalUbuntu Linux, Ubuntu, Ubuntu Core295nonenew
- 17GnuBinutils, Glibc, Gnutls296nonenew
- 18Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libgd22981new
- 19FedoraprojectFedora200nonenew
- 20Opensuse ProjectLeap, Suse Linux Enterprise Software Development Kit, Suse Linux Enterprise Workstation Extension205nonenew
- 21PackagistMoodle/moodle, Mantisbt/mantisbt, Drupal/drupal201nonenew
- 22PyPIPlone, Glance, Cherrymusic202nonenew
- 23Revive-adserverRevive Adserver184nonenew
- 24QemuQemu171nonenew
- 25Podofo ProjectPodofo161nonenew
Severity
How this month's CVEs score on CVSS; 71 have no score yet. Severity is not exploitation.
- Critical138
- High536
- Medium612
- Low16
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds180
- CWE-79XSS178
- CWE-200Information Exposure124
- CWE-20Improper Input Validation95
- CWE-125Out-of-bounds Read63
- CWE-476NULL Pointer Dereference48
- CWE-26437
- CWE-352CSRF36
- CWE-190Integer Overflow34
- CWE-89SQL Injection32
- CWE-284Improper Access Control29
- CWE-787Out-of-bounds Write24
- CWE-287Improper Authentication22
- CWE-22Path Traversal18
- CWE-416Use After Free16
- CWE-39915
- CWE-400Resource Consumption13
- CWE-611XXE11
- CWE-18910
- CWE-77Command Injection10
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems46427% of sector-tagged CVEs
- OSS Libraries35620% of sector-tagged CVEs
- Enterprise Software1639% of sector-tagged CVEs
- Web & CMS Plugins1368% of sector-tagged CVEs
- Security Products1096% of sector-tagged CVEs
- Mobile Apps986% of sector-tagged CVEs
- Cloud & SaaS905% of sector-tagged CVEs
- Networking Infrastructure825% of sector-tagged CVEs
- Hardware Firmware684% of sector-tagged CVEs
- Not yet classified45
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 79XSS | 200Information Exposure | 20Improper Input Validation | 125Out-of-bounds Read | 476NULL Pointer Dereference | 264 | 352CSRF | 190Integer Overflow | 89SQL Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 40 | 4 | 38 | 12 | 1 | 1 | 1 | |||
| Microsoft Corp | 40 | 4 | 38 | 12 | 1 | 1 | 1 | |||
| Microsoft Corporation | 40 | 4 | 37 | 10 | 1 | 1 | 1 | |||
| Imagemagick | 36 | 12 | 7 | 6 | 1 | |||||
| Google Inc | 11 | 16 | 7 | 2 | 2 | |||||
| Google Inc. | 11 | 19 | 7 | 2 | 1 | |||||
| Debian | 9 | 4 | 1 | 7 | 11 | 2 | 1 | 1 | 2 | |
| Linux | 1 | 18 | 5 | 3 | 3 | 3 | 3 | |||
| IBM | 1 | 16 | 12 | 3 | 1 | 2 | 4 | |||
| IBM Corporation | 1 | 15 | 12 | 2 | 1 | 2 | 4 | |||
| 11 | 4 | 5 | 2 | |||||||
| Opensuse | 9 | 2 | 1 | 3 | 4 |
CVEs published in March 2017
33 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2014-3931fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.KEV9.8
- CVE-2017-3881A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affecte...KEV9.8
- CVE-2017-5638The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows...KEV9.8
- CVE-2017-7269Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrar...KEV9.8
- CVE-2017-0143The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607...KEV8.8
- CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607...KEV8.8
- CVE-2017-0145The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607...KEV8.8
- CVE-2017-0146The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607...KEV8.8
- CVE-2017-0149Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corr...KEV8.8
- CVE-2017-6334dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTT...KEV8.8
- CVE-2017-0148The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607...KEV8.1
- CVE-2017-0001The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 G...KEV7.8
- CVE-2017-0005The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 G...KEV7.8
- CVE-2017-0101The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 1...KEV7.8
- CVE-2017-0147The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607...KEV7.5
- CVE-2017-0022Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Serv...KEV6.5
- CVE-2017-0059Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerabili...KEV4.3
- CVE-2015-8556Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.10.0
- CVE-2014-7279The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equipment management authority" via TCP traffic to port 23.9.8
- CVE-2016-10166Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors rela...9.8
- CVE-2016-7406Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.9.8
- CVE-2016-8749Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.9.8
- CVE-2017-5674A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" ...9.8
- CVE-2017-6360QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.9.8
- CVE-2017-6361QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.9.8
- CVE-2017-6465Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doesn't check the response's length, lead...9.8
- CVE-2017-6506In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that ...9.8
- CVE-2017-6526An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi ...9.8
- CVE-2017-6558iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers to view and modify administrative rout...9.8
- CVE-2015-8813The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks ...8.2
- CVE-2016-8023Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to bypass server authent...8.1
- CVE-2016-8020Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafte...8.0
- CVE-2017-7309A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a c...4.8