February 2019
908 CVEs published, −33% on February 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 13916% of the 862 with a CVSS score
- Added to CISA KEV
- 06 of this month's CVEs are in KEV, listed a median 1117 days after publication
- Vendors
- 4291,353 products
- Top weakness
- XSSCWE-79 · 121 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Sdl, Rdesktop130221new
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition12918nonenew
- 3DebianDebian Linux, Tmpreaper12126nonenew
- 4CanonicalUbuntu Linux, Ubuntu11023nonenew
- 5Red HatEnterprise Linux Server, Enterprise Linux Workstation, Enterprise Linux Desktop8316nonenew
- 6GoogleAndroid, Google Chrome, Chrome682nonenew
- 7FedoraprojectFedora593nonenew
- 8Novell Inc.Opensuse Leap, Suse Linux Enterprise Software Development Kit, Suse Linux Enterprise Server508nonenew
- 9OpensuseLeap, Backports Sle, Package Hub4812nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»454nonenew
- 11ZoneminderZoneminder355nonenew
- 12MozillaFirefox, Firefox Esr, Thunderbird3412nonenew
- 13CiscoHyperflex Hx Data Platform, Cisco Hyperflex Hx-series, Telepresence Management Suite311nonenew
- 14MavenOrg.jenkins-ci.plugins:job-import-plugin, Io.jenkins.blueocean:blueocean, Org.jenkins-ci.plugins:script-security312nonenew
- 15Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile293nonenew
- 16NetappSolidfire, Hci Management Node, Storage Automation Store286nonenew
- 17IBMSecurity Identity Governance and Intelligence, Bigfix Compliance, Security Identity Manager272nonenew
- 18AndroidAndroid261nonenew
- 19Ао "нппкт"Осон Основа Оnyx250nonenew
- 20JenkinsJob Import, Jenkins Job Import Plugin, Jenkins Script Security Plugin241nonenew
- 21Ics-certLcds Laquis Scada, PR100088 Modbus Gateway, Wecon Levistudiou225nonenew
- 22QualcommSd 820a Firmware, MDM9650 Firmware, Sd 835 Firmware223nonenew
- 23Fedora ProjectFedora200nonenew
- 24DlinkDir-878, Dir-878 Firmware, Dir-823g Firmware194nonenew
- 25npmM-server, Bootstrap-sass, Defaults-deep196nonenew
Severity
How this month's CVEs score on CVSS; 46 have no score yet. Severity is not exploitation.
- Critical139
- High361
- Medium345
- Low17
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS121
- CWE-125Out-of-bounds Read66
- CWE-787Out-of-bounds Write65
- CWE-119Memory Buffer Bounds37
- CWE-20Improper Input Validation37
- CWE-22Path Traversal37
- CWE-352CSRF30
- CWE-200Information Exposure27
- CWE-89SQL Injection27
- CWE-416Use After Free25
- CWE-476NULL Pointer Dereference21
- CWE-78OS Command Injection18
- CWE-190Integer Overflow16
- CWE-287Improper Authentication15
- CWE-94Code Injection15
- CWE-25414
- CWE-434Unrestricted File Upload13
- CWE-400Resource Consumption12
- CWE-74Injection11
- CWE-770Allocation Without Limits10
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems28521% of sector-tagged CVEs
- OSS Libraries21316% of sector-tagged CVEs
- Enterprise Software1179% of sector-tagged CVEs
- Web & CMS Plugins1068% of sector-tagged CVEs
- ICS / OT / IoT937% of sector-tagged CVEs
- Consumer Software796% of sector-tagged CVEs
- Networking Infrastructure786% of sector-tagged CVEs
- Mobile Apps766% of sector-tagged CVEs
- Security Products756% of sector-tagged CVEs
- Hardware Firmware584% of sector-tagged CVEs
- Not yet classified56
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 125Out-of-bounds Read | 787Out-of-bounds Write | 119Memory Buffer Bounds | 20Improper Input Validation | 22Path Traversal | 352CSRF | 200Information Exposure | 89SQL Injection | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 1 | 30 | 21 | 10 | 3 | 1 | 3 | 12 | ||
| Ооо «русбитех-астра» | 1 | 25 | 14 | 12 | 6 | 1 | 9 | |||
| Debian | 1 | 28 | 22 | 9 | 3 | 1 | 3 | 11 | ||
| Canonical | 28 | 14 | 14 | 1 | 1 | 7 | ||||
| Red Hat | 4 | 6 | 10 | 8 | 4 | 2 | 2 | 2 | 10 | |
| Canonical Ltd. | 18 | 10 | 10 | 1 | 1 | 1 | 3 | |||
| 1 | 10 | 16 | 3 | 5 | 1 | 11 | ||||
| Fedoraproject | 1 | 15 | 8 | 4 | 2 | 5 | ||||
| Novell Inc. | 20 | 4 | 4 | 1 | 2 | 2 | ||||
| Opensuse | 19 | 9 | 2 | 2 | 4 | |||||
| Ао «концерн Вниинс» | 14 | 8 | 5 | 1 | 2 | 1 | ||||
| Zoneminder | 26 | 1 | 4 |
CVEs published in February 2019
16 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2017-18362ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attack...KEV9.8
- CVE-2018-20753Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attac...KEV9.8
- CVE-2019-9082ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=sys...KEV8.8
- CVE-2019-6340Drupal core - Highly critical - Remote Code ExecutionKEV8.1
- CVE-2018-20250In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated wit...KEV7.8
- CVE-2019-8394Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.KEV6.5
- CVE-2019-8917SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, un...9.8
- CVE-2019-8985On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause ...9.8
- CVE-2019-9020An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (hea...9.8
- CVE-2019-9021An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow...9.8
- CVE-2019-8942WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php ...8.8
- CVE-2019-6453mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UN...8.1
- CVE-2019-7298An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. T...8.1
- CVE-2019-9041An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if...7.2
- CVE-2018-20251In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as...5.5
- CVE-2018-18990LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive informatio...5.3