May 2019
1,366 CVEs published. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 26019% of the 1,340 with a CVSS score
- Added to CISA KEV
- 014 of this month's CVEs are in KEV, listed a median 1045 days after publication
- Vendors
- 4802,508 products
- Top weakness
- XSSCWE-79 · 181 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AdobeAcrobat Dc, Adobe Acrobat and Reader, Acrobat Reader Dc20778nonenew
- 2CiscoNX-OS, Cisco NX-OS Software, Firepower Threat Defense982nonenew
- 3MicrosoftWindows Server, Windows Server 2016, Windows8033new
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Freeimages6510nonenew
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition487nonenew
- 6Schneider ElectricModicon Quantum, Modicon Quantum Safety Controller, Plc Simulator4281new
- 7Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Open Buildservice Development Tools, Suse Openstack Cloud414nonenew
- 8QualcommMDM9206 Firmware, MDM9607 Firmware, MDM9650 Firmware4112nonenew
- 9Schneider-electricModicon Quantum Firmware, Modicon Premium Firmware, Modicon M580 Firmware4181new
- 10OpensuseLeap, Backports, Backports Sle384nonenew
- 11IntelIntel Celeron J Series, Intel Celeron N Series, Intel Converged Security and Manageability Engine3531new
- 12MavenOrg.jenkins-ci.plugins:artifactory, Org.apache.jspwiki:jspwiki-main, Org.apache.jspwiki:jspwiki-war342nonenew
- 13Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables3112nonenew
- 14GoogleChrome, Google Chrome, Android303nonenew
- 15IBMSpectrum Control, Spectrum Control Standard Edition, API Connect301nonenew
- 16CanonicalUbuntu, Ubuntu Linux295nonenew
- 17DebianDebian Linux285nonenew
- 18Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Virtualization275nonenew
- 19Fedora ProjectFedora264nonenew
- 20FedoraprojectFedora264nonenew
- 21GitLabGitLab265nonenew
- 22npmRemarkable, Harp, Webpack-bundle-analyzer260nonenew
- 23SiemensSimatic Wincc \(Tia Portal\), Simatic Wincc Runtime Professional, Simatic Wincc (Tia Portal)2351new
- 24CybozuGaroon201nonenew
- 25Cybozu, Inc.Cybozu Garoon201nonenew
Severity
How this month's CVEs score on CVSS; 26 have no score yet. Severity is not exploitation.
- Critical260
- High560
- Medium511
- Low9
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS181
- CWE-125Out-of-bounds Read120
- CWE-787Out-of-bounds Write105
- CWE-416Use After Free81
- CWE-20Improper Input Validation57
- CWE-22Path Traversal50
- CWE-200Information Exposure45
- CWE-89SQL Injection40
- CWE-78OS Command Injection37
- CWE-119Memory Buffer Bounds34
- CWE-352CSRF28
- CWE-476NULL Pointer Dereference24
- CWE-732Incorrect Permissions22
- CWE-190Integer Overflow19
- CWE-284Improper Access Control19
- CWE-400Resource Consumption19
- CWE-502Deserialization18
- CWE-798Hard-coded Credentials18
- CWE-287Improper Authentication16
- CWE-434Unrestricted File Upload16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Consumer Software23614% of sector-tagged CVEs
- Operating Systems22514% of sector-tagged CVEs
- Enterprise Software17811% of sector-tagged CVEs
- OSS Libraries17711% of sector-tagged CVEs
- Networking Infrastructure15710% of sector-tagged CVEs
- Hardware Firmware1318% of sector-tagged CVEs
- ICS / OT / IoT1157% of sector-tagged CVEs
- Web & CMS Plugins936% of sector-tagged CVEs
- Security Products835% of sector-tagged CVEs
- Not yet classified59
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 125Out-of-bounds Read | 787Out-of-bounds Write | 416Use After Free | 20Improper Input Validation | 22Path Traversal | 200Information Exposure | 89SQL Injection | 78OS Command Injection | 119Memory Buffer Bounds |
|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | 2 | 80 | 36 | 61 | 2 | 8 | ||||
| Adobe Systems Inc. | 2 | 48 | 31 | 56 | 2 | 6 | ||||
| Cisco | 5 | 1 | 18 | 6 | 3 | 2 | 13 | 5 | ||
| Cisco Systems Inc. | 5 | 1 | 17 | 6 | 2 | 2 | 11 | 5 | ||
| Microsoft | 7 | 21 | 1 | 3 | 1 | |||||
| Microsoft Corp | 7 | 21 | 3 | |||||||
| Сообщество Свободного Программного Обеспечения | 3 | 7 | 7 | 7 | 6 | 2 | 3 | 3 | ||
| Ооо «русбитех-астра» | 2 | 5 | 5 | 4 | 5 | 3 | 2 | 1 | ||
| Schneider Electric | 2 | 2 | 3 | 1 | 1 | |||||
| Novell Inc. | 5 | 5 | 4 | 3 | 3 | |||||
| Qualcomm | 2 | 6 | 1 | 3 | 6 | |||||
| Schneider-electric | 2 | 2 | 2 | 1 | 1 |
CVEs published in May 2019
34 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2019-11510In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitra...KEV10.0
- CVE-2017-18368The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is acce...KEV9.8
- CVE-2018-14839LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.KEV9.8
- CVE-2018-7841A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.KEV9.8
- CVE-2019-0708A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specia...KEV9.8
- CVE-2019-11634Citrix Workspace App before 1904 for Windows has Incorrect Access Control.KEV9.8
- CVE-2019-3568A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Andro...KEV9.8
- CVE-2019-9670mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.KEV9.8
- CVE-2019-9874Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitr...KEV9.8
- CVE-2018-4063An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in...KEV8.8
- CVE-2019-0903A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.KEV8.8
- CVE-2019-9875Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST para...KEV8.8
- CVE-2019-0863An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.KEV7.8
- CVE-2018-13383A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may ...KEV4.3
- CVE-2018-19989In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php so...9.8
- CVE-2019-5434An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability...9.8
- CVE-2019-7816ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead to arbitrary code e...9.8
- CVE-2019-8387MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.9.8
- CVE-2019-9653NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacters to handle_load_config.php.9.8
- CVE-2018-14729The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code.8.8
- CVE-2019-11569Veeam ONE Reporter 9.5.0.3201 allows CSRF.8.8
- CVE-2019-7111Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerabilit...8.8
- CVE-2019-7125Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a heap overflow vulnerability. Succ...8.8
- CVE-2019-7761Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and ...8.8
- CVE-2019-7820Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and ...8.8
- CVE-2018-4048An exploitable local privilege elevation vulnerability exists in the file system permissions of the `Temp` directory in GOG Galaxy 1.2.48.36 (Windows 64-bit Installer). An attacker can overwrite ex...7.8
- CVE-2019-5526VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may allow attackers wit...7.8
- CVE-2018-12296Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POS...7.5
- CVE-2019-7109Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability...6.5
- CVE-2019-8404An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacke...6.5
- CVE-2019-0221The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled ...6.1
- CVE-2019-3402The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scri...6.1
- CVE-2019-8390qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.6.1
- CVE-2019-8391qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.6.1