September 2018
1,209 CVEs published, +14% on August 2018 and −2% on September 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 16614% of the 1,172 with a CVSS score
- Added to CISA KEV
- 03 of this month's CVEs are in KEV, listed a median 1292 days after publication
- Vendors
- 5321,509 products
- Top weakness
- XSSCWE-79 · 169 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1DebianDebian Linux1026nonenew
- 2Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop9211new
- 3GoogleAndroid, Chrome, Google Chrome840nonenew
- 4CanonicalUbuntu Linux, Ubuntu6661new
- 5MicrosoftWindows 10, Windows Server 2016, Windows 10 Servers6511new
- 6Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Snapdragon Automobile, Snapdragon Mobile652nonenew
- 7Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Open Vswitch656nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»525nonenew
- 9IBMRational Engineering Lifecycle Manager, Websphere Portal, Websphere Application Server401nonenew
- 10SamsungSth-eth-250 Firmware, Smartthings Hub Sth-eth-250, Galaxy Apps234nonenew
- 11IntelConverged Security Management Engine Firmware, Intel Converged Security and Manageability Engine, Active Management Technology Firmware212nonenew
- 12MavenOrg.apache.tika:tika-core, Org.elasticsearch:elasticsearch, Org.apache.karaf:apache-karaf211nonenew
- 13Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Basesystem, Suse Linux Enterprise Server191nonenew
- 14AdobeColdfusion, Acrobat Dc, Acrobat Reader Dc1861new
- 15PackagistElefant/cms, Smarty/smarty, Gleez/cms185nonenew
- 16OpensuseLeap172nonenew
- 17Ао «концерн Вниинс»Ос Он «стрелец»173nonenew
- 18QualcommSD450 Firmware, SD430 Firmware, SD425 Firmware162nonenew
- 19RubygemsActionpack, Rails-html-sanitizer, Smart_proxy_dynflow161nonenew
- 20TP-LinkTl-wr886n Firmware, Eap Controller161nonenew
- 21ApacheTika, Spamassassin, Mesos141nonenew
- 22ArtifexGhostscript, Gpl Ghostscript, Mupdf140nonenew
- 23NugetMicrosoft.chakracore, Microsoft.aspnetcore.all, Microsoft.data.odata141nonenew
- 24Apache Software FoundationApache Tika, Apache Spamassassin, Apache Karaf131nonenew
- 25ImagemagickImagemagick132nonenew
Severity
How this month's CVEs score on CVSS; 37 have no score yet. Severity is not exploitation.
- Critical166
- High493
- Medium504
- Low9
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS169
- CWE-20Improper Input Validation84
- CWE-200Information Exposure75
- CWE-119Memory Buffer Bounds71
- CWE-787Out-of-bounds Write64
- CWE-89SQL Injection51
- CWE-125Out-of-bounds Read50
- CWE-352CSRF44
- CWE-22Path Traversal41
- CWE-78OS Command Injection27
- CWE-732Incorrect Permissions25
- CWE-476NULL Pointer Dereference23
- CWE-94Code Injection21
- CWE-190Integer Overflow20
- CWE-287Improper Authentication20
- CWE-416Use After Free20
- CWE-400Resource Consumption18
- CWE-434Unrestricted File Upload16
- CWE-120Buffer Overflow15
- CWE-611XXE13
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems34522% of sector-tagged CVEs
- OSS Libraries21613% of sector-tagged CVEs
- Web & CMS Plugins17411% of sector-tagged CVEs
- Enterprise Software15610% of sector-tagged CVEs
- Mobile Apps1218% of sector-tagged CVEs
- Hardware Firmware1077% of sector-tagged CVEs
- Networking Infrastructure775% of sector-tagged CVEs
- ICS / OT / IoT714% of sector-tagged CVEs
- Consumer Software654% of sector-tagged CVEs
- 6 smaller sectors186
- Not yet classified84
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 20Improper Input Validation | 200Information Exposure | 119Memory Buffer Bounds | 787Out-of-bounds Write | 89SQL Injection | 125Out-of-bounds Read | 352CSRF | 22Path Traversal | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Debian | 2 | 24 | 11 | 4 | 10 | 5 | 3 | 1 | ||
| 1 | 17 | 6 | 17 | 6 | 9 | |||||
| Red Hat | 3 | 23 | 13 | 1 | 5 | 4 | 2 | |||
| Microsoft | 4 | 9 | 15 | 1 | 11 | |||||
| Qualcomm, Inc. | 5 | 1 | 13 | 7 | 8 | |||||
| Сообщество Свободного Программного Обеспечения | 1 | 5 | 1 | 6 | 6 | 10 | 1 | 1 | ||
| Microsoft Corp | 4 | 8 | 15 | 1 | 11 | |||||
| Canonical | 4 | 3 | 5 | 6 | 5 | 1 | ||||
| Ооо «русбитех-астра» | 1 | 3 | 1 | 4 | 4 | 8 | ||||
| IBM | 7 | 2 | 4 | 1 | 2 | |||||
| Canonical Ltd. | 2 | 1 | 3 | 3 | 7 | 2 | ||||
| Red Hat | 1 | 7 | 6 | 2 | 2 |
CVEs published in September 2018
10 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2018-15961Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to ar...KEV9.8
- CVE-2018-14634An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalat...KEV7.8
- CVE-2018-8440An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects W...KEV7.8
- CVE-2018-16283The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.9.8
- CVE-2018-17281There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2...7.5
- CVE-2018-17283Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leverage...7.5
- CVE-2018-8474A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Feature Bypass Vulnerability." This affe...7.5
- CVE-2018-8424An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects W...6.5
- CVE-2018-12234A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML resp...6.1
- CVE-2018-17051K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php.6.1