June 2018
1,804 CVEs published. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 29216% of the 1,783 with a CVSS score
- Added to CISA KEV
- 03 of this month's CVEs are in KEV, listed a median 1383 days after publication
- Vendors
- 8572,803 products
- Top weakness
- Information ExposureCWE-200 · 188 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1npmServe, Sanitize-html, Express-cart35112nonenew
- 2HackeroneCoffeescript Node Module, Sanitize-html Node Module, Serve Node Module34011nonenew
- 3MozillaFirefox, Firefox Esr, Thunderbird3181101new
- 4CanonicalUbuntu, Ubuntu Linux22676nonenew
- 5DebianDebian Linux202911new
- 6Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»18768nonenew
- 7Red HatEnterprise Linux Workstation, Enterprise Linux Server, Enterprise Linux Desktop180881new
- 8Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop15461nonenew
- 9Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Liblouis, Linux141651new
- 10Ао «ивк»Альт Линукс Спт, Альт 8 Сп Сервер, Альт 8 Сп Рабочая Станция9749nonenew
- 11MavenOrg.bouncycastle:bcprov-jdk14, Org.bouncycastle:bcprov-jdk15, Org.bouncycastle:bcprov-jdk15on717nonenew
- 12CiscoNX-OS, Prime Collaboration, Prime Collaboration Provisioning63121new
- 13MicrosoftWindows 10, Windows Server 2016, Windows 10 Servers5901new
- 14AppleiPhone OS, Mac OS X, watchOS551nonenew
- 15QuestDisk Backup521nonenew
- 16GoogleAndroid, Boringssl, Chromecast Firmware400nonenew
- 17Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android320nonenew
- 18JenkinsJenkins, GitHub, Black Duck Hub290nonenew
- 19IBMWebsphere Mq, Infosphere Information Server, Security Access Manager251nonenew
- 20PackagistBaserproject/basercms, Symfony/symfony, Symfony/security223nonenew
- 21[unknown]389-ds-base, Python, Ovirt-engine202nonenew
- 22Ао «нтц Ит Роса»Роса Кобальт, Rosa Virtualization, Rosa Virtualization 3.0197nonenew
- 23OracleRetail Xstore Point of Service, Enterprise Manager Base Platform, Communications Cloud Native Core Automated Test Suite174nonenew
- 24LinuxLinux Kernel151nonenew
- 25OpensuseOpen Build Service, Leap, Obs-service-set_version140nonenew
Severity
How this month's CVEs score on CVSS; 21 have no score yet. Severity is not exploitation.
- Critical292
- High922
- Medium554
- Low15
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-200Information Exposure188
- CWE-20Improper Input Validation168
- CWE-22Path Traversal161
- CWE-79XSS160
- CWE-119Memory Buffer Bounds125
- CWE-310106
- CWE-311Missing Encryption106
- CWE-416Use After Free77
- CWE-78OS Command Injection72
- CWE-125Out-of-bounds Read60
- CWE-787Out-of-bounds Write55
- CWE-50641
- CWE-352CSRF35
- CWE-732Incorrect Permissions31
- CWE-89SQL Injection31
- CWE-400Resource Consumption29
- CWE-190Integer Overflow27
- CWE-287Improper Authentication26
- CWE-426Untrusted Search Path19
- CWE-269Improper Privilege Mgmt18
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 200Information Exposure | 20Improper Input Validation | 22Path Traversal | 79XSS | 119Memory Buffer Bounds | 310 | 311Missing Encryption | 416Use After Free | 78OS Command Injection | 125Out-of-bounds Read |
|---|---|---|---|---|---|---|---|---|---|---|
| npm | 44 | 9 | 129 | 17 | 101 | 104 | 3 | 1 | ||
| Hackerone | 42 | 8 | 128 | 15 | 99 | 104 | 2 | 1 | ||
| Mozilla | 38 | 54 | 1 | 13 | 54 | 2 | 61 | 9 | ||
| Debian | 14 | 21 | 5 | 2 | 33 | 2 | 2 | 47 | 11 | |
| Canonical Ltd. | 22 | 25 | 1 | 10 | 29 | 2 | 43 | 11 | ||
| Ооо «русбитех-астра» | 21 | 23 | 2 | 7 | 27 | 39 | 9 | |||
| Mozilla Corp. | 21 | 27 | 10 | 31 | 2 | 45 | 8 | |||
| Red Hat | 15 | 18 | 2 | 2 | 32 | 2 | 44 | 5 | ||
| Novell Inc. | 17 | 18 | 8 | 24 | 39 | 6 | ||||
| Сообщество Свободного Программного Обеспечения | 7 | 11 | 3 | 1 | 21 | 2 | 37 | 2 | 9 | |
| Canonical | 15 | 14 | 1 | 4 | 19 | 2 | 20 | 7 | ||
| Red Hat Inc. | 5 | 11 | 2 | 21 | 2 | 37 | 7 |
CVEs published in June 2018
18 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2018-6961VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled ...KEV8.1
- CVE-2016-9079A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This ...KEV7.5
- CVE-2018-0296A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in ...KEV7.5
- CVE-2017-16082A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would lik...9.8
- CVE-2018-11219An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.9.8
- CVE-2018-11714An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caus...9.8
- CVE-2018-12031Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmwar...9.8
- CVE-2018-1000600A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using a...8.8
- CVE-2018-11538servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.8.8
- CVE-2018-12293The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to vers...8.8
- CVE-2018-4200An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affect...8.8
- CVE-2018-8025CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being i...8.1
- CVE-2018-0598Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecifie...7.8
- CVE-2018-4241An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves ...7.8
- CVE-2017-7783If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resulting modal prompt will hang in a non-responsive state or cra...7.5
- CVE-2018-12604GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.7.5
- CVE-2018-8239An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects W...5.5
- CVE-2018-1121procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can ...3.9