October 2018
1,483 CVEs published, +23% on September 2018 and +3% on October 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 18413% of the 1,470 with a CVSS score
- Added to CISA KEV
- 02 of this month's CVEs are in KEV, listed a median 1149.5 days after publication
- Vendors
- 4551,981 products
- Top weakness
- XSSCWE-79 · 199 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Server, Peoplesoft Enterprise Peopletools19810nonenew
- 2CiscoIOS XE, Webex Meetings Online, Webex Meetings Server1319nonenew
- 3CanonicalUbuntu Linux, Ubuntu, Linux Kernel, As Used In Ubuntu 18.04 Lts and Ubuntu 18.1010415nonenew
- 4AdobeAdobe Acrobat and Reader, Acrobat Dc, Acrobat Reader Dc1024nonenew
- 5DebianDebian Linux, Crossroads10112nonenew
- 6Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Systemd8410nonenew
- 7Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop7812nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7713nonenew
- 9IBMRational Quality Manager, Security Key Lifecycle Manager, Websphere Application Server632nonenew
- 10Qualcomm, Inc.Snapdragon Mobile, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, Snapdragon Mobile, Snapdragon Wear620nonenew
- 11QualcommSd 845 Firmware, Sd 835 Firmware, SDA660 Firmware610nonenew
- 12MicrosoftWindows 10, Windows 10 Servers, Windows Server 20165211new
- 13Novell Inc.Opensuse Leap, Suse Linux Enterprise Software Development Kit, Suse Linux Enterprise Server448nonenew
- 14FoxitsoftwareReader, Phantompdf, Foxit Reader410nonenew
- 15NetappSnapcenter, Oncommand Workflow Automation, Oncommand Insight412nonenew
- 16MozillaFirefox, Firefox Esr, Thunderbird329nonenew
- 17Ао «ивк»Альт Линукс Спт, Альт 8 Сп Рабочая Станция, Альт 8 Сп Сервер285nonenew
- 18GoogleAndroid272nonenew
- 19Google Inc.Android251nonenew
- 20JuniperJunos, Junos Space, Netscreen Screenos211nonenew
- 21Juniper NetworksJunos OS, Junos, Junos Space211nonenew
- 22MavenIo.vertx:vertx-core, Io.spray:spray-json_2.10, Io.spray:spray-json_2.11219nonenew
- 23Ао «нтц Ит Роса»Роса Хром, Роса Кобальт, Rosa Virtualization 3.0201nonenew
- 24F5BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Policy Enforcement Manager180nonenew
- 25F5 Networks, Inc.BIG-IP (Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator), BIG-IP (Apm), BIG-IP Afm180nonenew
Severity
How this month's CVEs score on CVSS; 13 have no score yet. Severity is not exploitation.
- Critical184
- High623
- Medium638
- Low25
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS199
- CWE-787Out-of-bounds Write92
- CWE-20Improper Input Validation91
- CWE-125Out-of-bounds Read86
- CWE-119Memory Buffer Bounds70
- CWE-416Use After Free61
- CWE-200Information Exposure58
- CWE-89SQL Injection42
- CWE-22Path Traversal40
- CWE-287Improper Authentication38
- CWE-352CSRF37
- CWE-476NULL Pointer Dereference28
- CWE-190Integer Overflow26
- CWE-732Incorrect Permissions25
- CWE-78OS Command Injection24
- CWE-400Resource Consumption22
- CWE-522Insufficiently Protected Credentials20
- CWE-269Improper Privilege Mgmt15
- CWE-26414
- CWE-434Unrestricted File Upload14
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems32817% of sector-tagged CVEs
- Networking Infrastructure21411% of sector-tagged CVEs
- Consumer Software20811% of sector-tagged CVEs
- Databases20711% of sector-tagged CVEs
- Enterprise Software19910% of sector-tagged CVEs
- OSS Libraries1689% of sector-tagged CVEs
- Web & CMS Plugins1648% of sector-tagged CVEs
- Hardware Firmware1065% of sector-tagged CVEs
- ICS / OT / IoT915% of sector-tagged CVEs
- Not yet classified68
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 125Out-of-bounds Read | 119Memory Buffer Bounds | 416Use After Free | 200Information Exposure | 89SQL Injection | 22Path Traversal | 287Improper Authentication |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | 1 | ||||||
| Oracle Corporation | 1 | |||||||||
| Oracle Corp. | 1 | 1 | 1 | |||||||
| Cisco | 12 | 4 | 38 | 1 | 2 | 5 | 1 | 4 | 2 | |
| Adobe | 5 | 32 | 42 | 3 | 8 | |||||
| Debian | 2 | 5 | 8 | 5 | 10 | 4 | 6 | 2 | 3 | |
| Canonical | 1 | 2 | 5 | 5 | 11 | 6 | 8 | 1 | ||
| Сообщество Свободного Программного Обеспечения | 1 | 4 | 7 | 3 | 6 | 5 | 6 | 2 | 2 | |
| Ооо «русбитех-астра» | 1 | 2 | 5 | 4 | 10 | 4 | 7 | 1 | 2 | |
| Cisco Systems Inc. | 4 | 2 | 24 | 2 | 4 | 1 | 4 | |||
| Red Hat | 1 | 3 | 5 | 2 | 7 | 6 | 5 | 2 | 2 | |
| IBM | 30 | 7 | 1 | 3 | 3 |
CVEs published in October 2018
11 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2018-14558An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03....KEV9.8
- CVE-2018-8453An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windo...KEV7.8
- CVE-2017-18349parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by...9.8
- CVE-2018-18834An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in mms/asn1/ber_encoder.c.9.8
- CVE-2018-3191Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easi...9.8
- CVE-2018-3245Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easi...9.8
- CVE-2018-17961Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE...8.6
- CVE-2018-18284Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.8.6
- CVE-2018-12851Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a heap overflow vulnerability. Successful exploitation could lead to ar...7.8
- CVE-2018-8495A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windo...7.5
- CVE-2018-14665A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log ...6.6