December 2018
1,212 CVEs published, +8% on December 2017. CISA added 0 to KEV.
2018 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2018 | January 2018: 1,715 CVEs | February 2018: 1,350 CVEs | March 2018: 2,306 CVEs | April 2018: no snapshot | May 2018: no snapshot | June 2018: 1,804 CVEs | July 2018: 2,225 CVEs | August 2018: 1,057 CVEs | September 2018: 1,209 CVEs | October 2018: 1,483 CVEs | November 2018: no snapshot | December 2018: 1,212 CVEs | 14,3619 of 12 months9/12 |
- Critical
- 17515% of the 1,173 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 1339 days after publication
- Vendors
- 4901,382 products
- Top weakness
- XSSCWE-79 · 207 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition133111new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Freeware Advanced Audio Decoder 2, Libvnc130132new
- 3DebianDebian Linux127141new
- 4GoogleChrome, Android, Google Chrome10451new
- 5Red HatEnterprise Linux Workstation, Enterprise Linux Server, Enterprise Linux Desktop8592new
- 6CanonicalUbuntu Linux, Ubuntu779nonenew
- 7IBMSecurity Access Manager Appliance, Security Access Manager, Security Guardium650nonenew
- 8MicrosoftWindows Server 2019 (Server Core Installation), Windows 10, Windows Server 20194023new
- 9Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Basesystem, Suse Linux Enterprise Desktop3901new
- 10MavenOrg.jenkins-ci.main:jenkins-core, Org.apache.nifi:nifi, Org.hswebframework.web:hsweb-commons3491new
- 11Ао «концерн Вниинс»Ос Он «стрелец»332nonenew
- 12Google Inc.Android322nonenew
- 13OpensuseLeap, Libsolv, Backports Sle321nonenew
- 14FedoraprojectFedora, Sssd292nonenew
- 15InfovistaVistaportal260nonenew
- 16SiemensSinumerik 828d V4.7 Firmware, Sinumerik 840d Sl V4.8 Firmware, Sinumerik 840d Sl V4.7 Firmware254nonenew
- 17LibrawLibraw210nonenew
- 18Ао "нппкт"Осон Основа Оnyx211nonenew
- 19Libraw LlcLibraw190nonenew
- 20PackagistPhpmyadmin/phpmyadmin, Craftcms/cms, Evolutioncms/evolution190nonenew
- 21AudiocodingFreeware Advanced Audio Decoder 2, Freeware Advanced Audio Coder180nonenew
- 22Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Mobile, Snapdragon Wear162nonenew
- 23AsustorData Master151nonenew
- 24Drobo5n2 Firmware146nonenew
- 25FacebookHhvm, Proxygen, Whatsapp For Windows Phone144nonenew
Severity
How this month's CVEs score on CVSS; 39 have no score yet. Severity is not exploitation.
- Critical175
- High434
- Medium548
- Low16
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS207
- CWE-787Out-of-bounds Write92
- CWE-200Information Exposure77
- CWE-20Improper Input Validation67
- CWE-119Memory Buffer Bounds59
- CWE-125Out-of-bounds Read42
- CWE-522Insufficiently Protected Credentials35
- CWE-476NULL Pointer Dereference34
- CWE-611XXE34
- CWE-22Path Traversal32
- CWE-416Use After Free32
- CWE-89SQL Injection31
- CWE-352CSRF29
- CWE-190Integer Overflow26
- CWE-78OS Command Injection26
- CWE-400Resource Consumption18
- CWE-732Incorrect Permissions17
- CWE-835Infinite Loop14
- CWE-269Improper Privilege Mgmt13
- CWE-287Improper Authentication13
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems33521% of sector-tagged CVEs
- OSS Libraries23515% of sector-tagged CVEs
- Enterprise Software20813% of sector-tagged CVEs
- Web & CMS Plugins1439% of sector-tagged CVEs
- Mobile Apps1167% of sector-tagged CVEs
- Cloud & SaaS875% of sector-tagged CVEs
- Hardware Firmware815% of sector-tagged CVEs
- Networking Infrastructure805% of sector-tagged CVEs
- 7 smaller sectors261
- Not yet classified70
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 200Information Exposure | 20Improper Input Validation | 119Memory Buffer Bounds | 125Out-of-bounds Read | 522Insufficiently Protected Credentials | 476NULL Pointer Dereference | 611XXE | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Ооо «русбитех-астра» | 1 | 27 | 2 | 4 | 15 | 10 | 16 | |||
| Сообщество Свободного Программного Обеспечения | 2 | 21 | 3 | 9 | 16 | 10 | 16 | |||
| Debian | 6 | 23 | 6 | 14 | 7 | 7 | 8 | 1 | 1 | |
| 1 | 33 | 4 | 11 | 4 | 6 | 1 | 1 | |||
| Red Hat | 18 | 4 | 8 | 3 | 4 | 3 | 1 | |||
| Canonical | 1 | 10 | 1 | 2 | 9 | 10 | 8 | |||
| IBM | 12 | 12 | 4 | 1 | 4 | |||||
| Canonical Ltd. | 1 | 6 | 2 | 2 | 5 | 3 | 6 | |||
| Google Inc | 18 | 5 | 2 | |||||||
| Microsoft | 3 | 9 | 1 | 2 | ||||||
| Microsoft Corp | 3 | 9 | 1 | 2 | ||||||
| Novell Inc. | 13 | 1 | 4 | 4 | 2 | 1 | 1 |
CVEs published in December 2018
18 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2018-1000861A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that a...KEV9.8
- CVE-2018-19323The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and wr...KEV9.8
- CVE-2018-20062An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index...KEV9.8
- CVE-2018-17480Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code...KEV8.8
- CVE-2018-19320The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functional...KEV7.8
- CVE-2018-19321The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to...KEV7.8
- CVE-2018-19322The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to...KEV7.8
- CVE-2018-8611An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7,...KEV7.8
- CVE-2018-8639An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windo...KEV7.8
- CVE-2018-8653A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affect...KEV7.5
- CVE-2018-19788A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.8.8
- CVE-2018-19650Local attackers can trigger a stack-based buffer overflow on vulnerable installations of Antiy-AVL ATool security management v1.0.0.22. An attacker must first obtain the ability to execute low-priv...7.8
- CVE-2018-20463An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. There is an arbitrary file read vulnerability via ../ directory traversal in query=php://filter/resource= in the jsmol.php query s...7.5
- CVE-2018-8033In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both...7.5
- CVE-2018-8625A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Internet ...7.5
- CVE-2018-1002009There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in...4.8
- CVE-2018-19507CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.4.8
- CVE-2018-8580An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request...4.3