February 2018
1,350 CVEs published, −21% on January 2018 and +26% on February 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 25819% of the 1,334 with a CVSS score
- Added to CISA KEV
- 03 of this month's CVEs are in KEV, listed a median 1366 days after publication
- Vendors
- 4911,264 products
- Top weakness
- Improper Input ValidationCWE-20 · 184 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Hewlett Packard EnterpriseIntelligent Management Center (Imc) Plat, Matrix Operating Environment, System Management Homepage For Windows and Linux18636nonenew
- 2HPIntelligent Management Center, HPE Intelligent Management Center Plat, Matrix Operating Environment18536nonenew
- 3DebianDebian Linux117221new
- 4HuaweiDP300 Firmware, TE60 Firmware, TE50 Firmware711nonenew
- 5Huawei Technologies Co., Ltd.Dp300,rp200,te30,te40,te50,te60, Dp300,ips Module,ngfw Module,nip6300,nip6600,nip6800,rp200,svn5600,svn5800,svn5800-c,semg9811,secospace Usg6300,secospace Usg6500,secospace Usg6600,te30,te40,te50,te60,usg9500,usg9520,usg9560,usg9580,vp9660,viewpoint 8660,viewpoint 9030,espace U1981, Ips,module,ngfw,module,nip6300,nip6600,secospace,usg6300,secospace,usg6500,secospace,usg6600,usg9500711nonenew
- 6MicrosoftWindows 10, Windows Server 2016, Windows 7580nonenew
- 7GoogleAndroid, Chrome, Chrome OS563nonenew
- 8IBMTririga Application Platform, Client Application Access, Notes514nonenew
- 9CanonicalUbuntu Linux, Ubuntu, Apport5091new
- 10Microsoft CorporationWindows, Microsoft Edge, Chakracore, Microsoft Edge490nonenew
- 11Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, SAM2P, Libxml245141new
- 12AdobeAcrobat, Acrobat Dc, Acrobat Reader4441new
- 13Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition4081new
- 14SapInternet Graphics Server, Hana Extended Application Services, Sap Netweaver361nonenew
- 15CiscoData Center Analytics Framework, Unified Communications Manager, RV132W Firmware3251new
- 16Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop3281new
- 17MavenOrg.jenkins-ci.main:jenkins-core, Com.fasterxml.jackson.core:jackson-databind, Org.apache.geode:geode-core286nonenew
- 18ApacheGeode, Jmeter, Cloudstack264nonenew
- 19AtlassianCrucible, Bamboo, Fisheye261nonenew
- 20Sap SeSap Internet Graphics Server, Sap Hana Extended Application Services, Sap Crm Webclient Ui260nonenew
- 21QuestNetvault Backup, Quest Netvault Backup2524nonenew
- 22Apache Software FoundationApache Geode, Apache Jmeter, Apache Tomcat244nonenew
- 23Dell TechnologiesNetvault Backup2424nonenew
- 24WiresharkWireshark241nonenew
- 25JiangminAntivirus210nonenew
Severity
How this month's CVEs score on CVSS; 16 have no score yet. Severity is not exploitation.
- Critical258
- High558
- Medium495
- Low23
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-20Improper Input Validation184
- CWE-79XSS149
- CWE-89SQL Injection97
- CWE-200Information Exposure96
- CWE-119Memory Buffer Bounds82
- CWE-125Out-of-bounds Read62
- CWE-787Out-of-bounds Write60
- CWE-352CSRF32
- CWE-476NULL Pointer Dereference32
- CWE-22Path Traversal30
- CWE-416Use After Free26
- CWE-502Deserialization26
- CWE-190Integer Overflow25
- CWE-611XXE22
- CWE-78OS Command Injection20
- CWE-287Improper Authentication19
- CWE-835Infinite Loop19
- CWE-400Resource Consumption14
- CWE-732Incorrect Permissions13
- CWE-77213
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software41021% of sector-tagged CVEs
- Operating Systems35518% of sector-tagged CVEs
- Networking Infrastructure26013% of sector-tagged CVEs
- OSS Libraries22011% of sector-tagged CVEs
- Mobile Apps1297% of sector-tagged CVEs
- Web & CMS Plugins1297% of sector-tagged CVEs
- Security Products1076% of sector-tagged CVEs
- 8 smaller sectors245
- Not yet classified74
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 20Improper Input Validation | 79XSS | 89SQL Injection | 200Information Exposure | 119Memory Buffer Bounds | 125Out-of-bounds Read | 787Out-of-bounds Write | 352CSRF | 476NULL Pointer Dereference | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Hewlett Packard Enterprise | 86 | 9 | 3 | 20 | 3 | 3 | 1 | 4 | ||
| HP | 86 | 8 | 3 | 20 | 4 | 3 | 1 | 4 | ||
| Debian | 9 | 2 | 2 | 11 | 13 | 6 | 9 | 1 | ||
| HP Inc. | 69 | 1 | 1 | 2 | ||||||
| Huawei | 16 | 1 | 18 | 7 | 4 | 1 | ||||
| Huawei Technologies Co., Ltd. | 16 | 1 | 18 | 7 | 4 | 1 | ||||
| Microsoft | 3 | 10 | 4 | 16 | 1 | |||||
| 7 | 1 | 8 | 6 | 1 | 8 | 1 | ||||
| IBM | 1 | 12 | 1 | 12 | 2 | |||||
| Canonical | 3 | 1 | 3 | 4 | 1 | 8 | ||||
| Microsoft Corporation | 2 | 9 | 16 | 1 | ||||||
| Сообщество Свободного Программного Обеспечения | 1 | 2 | 4 | 3 | 4 | 3 |
CVEs published in February 2018
34 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2018-0125A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code and...KEV9.8
- CVE-2018-6789An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.KEV9.8
- CVE-2018-4878A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of l...KEV7.8
- CVE-2018-1297When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.9.8
- CVE-2018-5987SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the...9.8
- CVE-2018-6892An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sync" client application listening on port 8888 can send a malicious payload ca...9.8
- CVE-2018-6911The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument (aka the command parameter).9.8
- CVE-2018-7251An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occ...9.8
- CVE-2018-7264The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and sign errors, allowing a remote attacker to execute arbitr...9.8
- CVE-2018-7297Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This ...9.8
- CVE-2018-7314SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429.9.8
- CVE-2018-7440An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an ...9.8
- CVE-2018-4888An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a...8.8
- CVE-2018-4890An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a...8.8
- CVE-2018-4902An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a...8.8
- CVE-2018-4910An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a...8.8
- CVE-2017-8946A Remote Code Execution vulnerability in HPE Aruba AirWave Glass version v1.0.0 and 1.0.1 was found.8.3
- CVE-2018-7254The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or ...7.8
- CVE-2014-8985Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vu...7.5
- CVE-2017-8982A Remote Authentication Restriction Bypass vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P4 was found.7.5
- CVE-2018-0834Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, ...7.5
- CVE-2018-0840Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 15...7.5
- CVE-2018-7284A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, th...7.5
- CVE-2018-7448Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step ...7.5
- CVE-2018-7441Leptonica through 1.75.3 uses hardcoded /tmp pathnames, which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race co...7.0
- CVE-2017-6198The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using ...6.5
- CVE-2018-4880An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result ...6.5
- CVE-2018-4893An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result ...6.5
- CVE-2018-4905An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result ...6.5
- CVE-2018-4914An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result ...6.5
- CVE-2018-7286An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash A...6.5
- CVE-2017-18188OpenRC opentmpfiles through 0.1.3, when the fs.protected_hardlinks sysctl is turned off, allows local users to obtain ownership of arbitrary files by creating a hard link inside a directory on whic...5.5
- CVE-2017-6193Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted image containing a malformed image size descriptor ...5.5
- CVE-2018-0853Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow an information disclosure vulnerability, due to how Office...3.3