July 2018
2,225 CVEs published, +23% on June 2018 and +69% on July 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 25812% of the 2,167 with a CVSS score
- Added to CISA KEV
- 05 of this month's CVEs are in KEV, listed a median 1414 days after publication
- Vendors
- 9902,667 products
- Top weakness
- Integer OverflowCWE-190 · 478 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL Server, MySQL, Outside In Technology2198nonenew
- 2AdobeAcrobat Dc, Acrobat Reader Dc, Adobe Acrobat 2017168402new
- 3Red HatEnterprise Linux Workstation, Enterprise Linux Desktop, Enterprise Linux Server14071new
- 4DebianDebian Linux, Devscripts127211new
- 5IBMRational Quality Manager, Rational Collaborative Lifecycle Management, Rational Rhapsody Design Manager951nonenew
- 6CanonicalUbuntu Linux, Ubuntu9318nonenew
- 7FoxitsoftwareFoxit Reader, Phantompdf, Foxit Phantompdf841nonenew
- 8Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libgit282181new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»6521nonenew
- 10Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Snapdragon Mobile, Snapdragon Wear596nonenew
- 11MicrosoftEdge, Microsoft Edge, Chakracore5631new
- 12MavenOrg.jenkins-ci.main:jenkins-core, Io.undertow:undertow-core, Org.keycloak:keycloak-core554nonenew
- 13[unknown]Kernel, Ansible, Kernel:542nonenew
- 14GoogleAndroid, Android Studio464nonenew
- 15LinuxLinux Kernel, Kernel, Kernel:430nonenew
- 16CiscoVedge-100 Firmware, Vbond Orchestrator, Vedge-1000 Firmware378nonenew
- 17NetappOncommand Insight, Oncommand Workflow Automation, Snapcenter372nonenew
- 18npmBootstrap, Angular-redactor, Bootstrap-sass3110nonenew
- 19Schneider-electricU.motion Builder, IBP519-1ER Firmware, IBPS110-1ER Firmware254nonenew
- 20Schneider Electric SeU.motion, U.motion Builder, Pelco Sarix Professional V1244nonenew
- 21ApacheHTTP Server, Kafka, Spark215nonenew
- 22Apache Software FoundationApache Kafka, Apache Tomcat Native, HTTP Server215nonenew
- 23NugetMicrosoft.chakracore, Bootstrap.sass, Bootstrap2101new
- 24PyPIAnsible, Mercurial, Aubio203nonenew
- 25PackagistDolibarr/dolibarr, Twbs/bootstrap, Moodle/moodle1971new
Severity
How this month's CVEs score on CVSS; 58 have no score yet. Severity is not exploitation.
- Critical258
- High1,207
- Medium664
- Low38
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-190Integer Overflow478
- CWE-79XSS173
- CWE-125Out-of-bounds Read163
- CWE-787Out-of-bounds Write117
- CWE-20Improper Input Validation112
- CWE-200Information Exposure84
- CWE-119Memory Buffer Bounds76
- CWE-416Use After Free76
- CWE-70455
- CWE-843Type Confusion48
- CWE-22Path Traversal44
- CWE-89SQL Injection37
- CWE-352CSRF34
- CWE-476NULL Pointer Dereference34
- CWE-287Improper Authentication29
- CWE-732Incorrect Permissions22
- CWE-295Improper Certificate Validation19
- CWE-78OS Command Injection19
- CWE-306Missing Auth for Critical Function18
- CWE-400Resource Consumption16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems41116% of sector-tagged CVEs
- OSS Libraries34513% of sector-tagged CVEs
- Consumer Software30412% of sector-tagged CVEs
- Databases2469% of sector-tagged CVEs
- Enterprise Software2459% of sector-tagged CVEs
- Web & CMS Plugins1225% of sector-tagged CVEs
- Networking Infrastructure1134% of sector-tagged CVEs
- 8 smaller sectors490
- Not yet classified337
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 190Integer Overflow | 79XSS | 125Out-of-bounds Read | 787Out-of-bounds Write | 20Improper Input Validation | 200Information Exposure | 119Memory Buffer Bounds | 416Use After Free | 704 | 843Type Confusion |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 2 | ||||||||
| Oracle Corporation | ||||||||||
| Adobe | 1 | 76 | 38 | 2 | 5 | 27 | 7 | |||
| Red Hat | 3 | 6 | 9 | 13 | 22 | 6 | 7 | 1 | 2 | |
| Debian | 9 | 2 | 15 | 16 | 13 | 7 | 5 | 5 | ||
| IBM | 54 | 1 | 20 | |||||||
| Foxitsoftware | 1 | 4 | 1 | 2 | 3 | 1 | 29 | 46 | 45 | |
| Canonical | 5 | 1 | 7 | 15 | 5 | 2 | 3 | 3 | ||
| Foxit | 1 | 4 | 1 | 2 | 3 | 1 | 27 | 46 | 45 | |
| Сообщество Свободного Программного Обеспечения | 6 | 10 | 14 | 8 | 3 | 7 | ||||
| Oracle Corp. | ||||||||||
| Ооо «русбитех-астра» | 3 | 1 | 8 | 6 | 9 | 3 | 3 | 4 |
CVEs published in July 2018
34 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004KEV9.8
- CVE-2018-4990Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbi...KEV8.8
- CVE-2018-5002Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.KEV7.8
- CVE-2018-8298A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCo...KEV7.5
- CVE-2018-9276An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command inje...KEV7.2
- CVE-2016-5649Netgear DGN2200 and DGND3700 disclose the administrator password9.8
- CVE-2017-3197GIGABYTE BRIX UEFI firmware fails to securely implement BIOS write protection9.8
- CVE-2018-1000613Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('U...9.8
- CVE-2018-11542A Remote Command Execution (RCE) vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows for the execution of arbitrary commands via an unspecified vector. It affects the...9.8
- CVE-2018-12785Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to ar...9.8
- CVE-2018-12804Adobe Connect versions 9.7.5 and earlier have an Authentication Bypass vulnerability. Successful exploitation could lead to session hijacking.9.8
- CVE-2018-14064The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80.9.8
- CVE-2018-14328Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for /dashboard/addplan, /dashboard/paywit...9.8
- CVE-2018-14364GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab p...9.8
- CVE-2018-0706Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.8.8
- CVE-2018-5040Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to ar...8.8
- CVE-2018-5041Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to ar...8.8
- CVE-2018-5052Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to ar...8.8
- CVE-2017-0929DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network re...7.5
- CVE-2018-4962Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead...7.5
- CVE-2018-4969Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead...7.5
- CVE-2018-4975Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead...7.5
- CVE-2018-4976Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead...7.5
- CVE-2018-5006Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.7.5
- CVE-2018-8171A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, AS...7.5
- CVE-2018-0949A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "Internet Explorer Security Feature Bypass Vulnerability." T...6.5
- CVE-2018-1002202zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This v...6.5
- CVE-2017-18343The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as ...6.1
- CVE-2018-1002200plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction....5.5
- CVE-2018-1002203unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during ex...5.5
- CVE-2018-1002206SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extractio...5.5
- CVE-2018-1002208SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction...5.5
- CVE-2018-8289An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This...4.3
- CVE-2018-8297An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This...4.3