December 2017
1,120 CVEs published, 2.1× December 2016. CISA added 0 to KEV.
2017 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2017 | January 2017: no snapshot | February 2017: 1,075 CVEs | March 2017: 1,373 CVEs | April 2017: no snapshot | May 2017: 4,155 CVEs | June 2017: no snapshot | July 2017: 1,313 CVEs | August 2017: 1,564 CVEs | September 2017: 1,238 CVEs | October 2017: 1,441 CVEs | November 2017: no snapshot | December 2017: 1,120 CVEs | 13,2798 of 12 months8/12 |
- Critical
- 22821% of the 1,106 with a CVSS score
- Added to CISA KEV
- 02 of this month's CVEs are in KEV, listed a median 1585 days after publication
- Vendors
- 4591,644 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 159 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AdobeAcrobat, Acrobat Dc, Acrobat Reader9517nonenew
- 2DebianDebian Linux, Most, Advanced Package Tool896nonenew
- 3GoogleAndroid8516nonenew
- 4IBMSecurity Guardium, Sterling File Gateway, Rational Doors Next Generation500nonenew
- 5CanonicalUbuntu Linux, Ubuntu482nonenew
- 6FoxitsoftwareFoxit Reader430nonenew
- 7Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android4312nonenew
- 8Google Inc.Android384nonenew
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition384nonenew
- 10AppleiPhone OS, Mac OS X, tvOS341nonenew
- 11MicrosoftChakracore, Edge, Internet Explorer341nonenew
- 12Microsoft CorporationChakracore, Microsoft Edge, Internet Explorer, Chakracore, Microsoft Edge, Internet Explorer341nonenew
- 13Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libxcursor344nonenew
- 14LinuxLinux Kernel260nonenew
- 15Red HatEnterprise Linux Server, Enterprise Linux Desktop, Enterprise Linux Workstation259nonenew
- 16HuaweiTE60 Firmware, TE50 Firmware, TE40 Firmware170nonenew
- 17TgsoftVir.it Explorer, Vir.it Explorer Lite170nonenew
- 18Huawei Technologies Co., Ltd.TE40, TE50, TE60160nonenew
- 19ImagemagickImagemagick161nonenew
- 20F5BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Analytics140nonenew
- 21F5 Networks, Inc.BIG-IP Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Gtm, Link Controller, Pem, Websafe, BIG-IP Apm, BIG-IP Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Link Controller, Pem, Websafe140nonenew
- 22IkarussecurityAnti.virus140nonenew
- 23SapSap Kernel, Business Application Software Integrated Solution, Sap Hana Extended Application Services131nonenew
- 24SynologyPhoto Station, Diskstation Manager, Diskstation Manager (Dsm)130nonenew
- 25NasmNetwide Assembler110nonenew
Severity
How this month's CVEs score on CVSS; 14 have no score yet. Severity is not exploitation.
- Critical228
- High538
- Medium325
- Low15
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds159
- CWE-89SQL Injection128
- CWE-79XSS121
- CWE-200Information Exposure92
- CWE-125Out-of-bounds Read76
- CWE-20Improper Input Validation74
- CWE-416Use After Free51
- CWE-74Injection32
- CWE-352CSRF22
- CWE-787Out-of-bounds Write20
- CWE-22Path Traversal19
- CWE-476NULL Pointer Dereference19
- CWE-70418
- CWE-78OS Command Injection16
- CWE-843Type Confusion14
- CWE-287Improper Authentication12
- CWE-426Untrusted Search Path12
- CWE-362Race Condition11
- CWE-77210
- CWE-190Integer Overflow8
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems30021% of sector-tagged CVEs
- Consumer Software18213% of sector-tagged CVEs
- Mobile Apps14010% of sector-tagged CVEs
- Enterprise Software1349% of sector-tagged CVEs
- OSS Libraries1279% of sector-tagged CVEs
- Web & CMS Plugins1067% of sector-tagged CVEs
- Security Products937% of sector-tagged CVEs
- Networking Infrastructure624% of sector-tagged CVEs
- 7 smaller sectors160
- Not yet classified116
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 89SQL Injection | 79XSS | 200Information Exposure | 125Out-of-bounds Read | 20Improper Input Validation | 416Use After Free | 74Injection | 352CSRF | 787Out-of-bounds Write |
|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | 27 | 7 | 3 | 27 | 9 | 5 | ||||
| Debian | 11 | 1 | 3 | 6 | 19 | 4 | 3 | 5 | 5 | |
| 21 | 11 | 3 | 10 | 14 | 1 | |||||
| IBM | 3 | 14 | 14 | 1 | 1 | 2 | ||||
| Canonical | 3 | 9 | 3 | 6 | 4 | |||||
| Foxit | 13 | 13 | 16 | |||||||
| Foxitsoftware | 13 | 13 | 16 | |||||||
| Qualcomm, Inc. | 21 | 1 | 2 | 3 | 10 | |||||
| Google Inc. | 10 | 1 | 7 | 1 | 1 | |||||
| Ооо «русбитех-астра» | 5 | 10 | 2 | 3 | ||||||
| Apple | 19 | 4 | 2 | 3 | ||||||
| Microsoft | 24 | 6 | 3 |
CVEs published in December 2017
20 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2017-15944Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management inte...KEV9.8
- CVE-2017-17562Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using u...KEV8.1
- CVE-2012-2576SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote ...9.8
- CVE-2014-8389cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM wi...9.8
- CVE-2017-17575FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.9.8
- CVE-2017-17590FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.9.8
- CVE-2017-17635MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.9.8
- CVE-2017-17731DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.9.8
- CVE-2017-17739The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files.9.8
- CVE-2017-17759Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service (by deleting the configuration) via a wc.dll?wwMaint~EditConfig reque...9.8
- CVE-2017-17932A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on ...9.8
- CVE-2017-16392An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions....8.8
- CVE-2017-16415An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions....8.8
- CVE-2017-16929The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a ...8.1
- CVE-2017-13867An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves th...7.8
- CVE-2017-13876An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves th...7.8
- CVE-2017-14969In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000084, a related issue to CVE-2017-17114.7.8
- CVE-2017-11890Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow an attack...7.5
- CVE-2017-11918ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how the scripting engin...7.5
- CVE-2017-17752Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version ...6.1