August 2019
2,064 CVEs published, +18% on July 2019 and +95% on August 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 32616% of the 2,013 with a CVSS score
- Added to CISA KEV
- 06 of this month's CVEs are in KEV, listed a median 901.5 days after publication
- Vendors
- 7753,190 products
- Top weakness
- XSSCWE-79 · 458 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1CpanelCpanel2775nonenew
- 2AdobeAcrobat Dc, Acrobat Reader Dc, Adobe Acrobat and Reader11948nonenew
- 3MicrosoftWindows 10, Windows Server 2016, Windows Server 2019 (Server Core Installation)958nonenew
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Envoy95121new
- 5DebianDebian Linux88151new
- 6PackagistMagento/community-edition, Magento/product-community-edition, Bolt/bolt865nonenew
- 7MagentoMagento710nonenew
- 8CiscoIntegrated Management Controller Supervisor, Unified Computing System, Enterprise Nfv Infrastructure Software709nonenew
- 9CanonicalUbuntu Linux, Ubuntu, Apport697nonenew
- 10OpensuseLeap, Backports, Backports Sle512nonenew
- 11MavenOrg.opencms:opencms-core, Org.jenkins-ci.plugins:gitlab-oauth, Com.xebialabs.xlt.ci:xltestview-plugin4611new
- 12Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition468nonenew
- 13IBMInformix Dynamic Server, Informix Dynamic Server Enterprise Edition, Emptoris Spend Analysis453nonenew
- 14Ао «концерн Вниинс»Ос Он «стрелец»4571new
- 15Red HatRed Hat Enterprise Linux, Enterprise Linux, Jboss Enterprise Application Platform411nonenew
- 16FedoraprojectFedora, 389 Directory Server407nonenew
- 17LinuxLinux Kernel383nonenew
- 18BestwebsoftContact Form, Pdf \& Print, Visitors Online352nonenew
- 19NetappData Availability Services, H410C Firmware, Active Iq Unified Manager336nonenew
- 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise Server325nonenew
- 21Crates.ioSmallvec, Slice-deque, Ncurses3111nonenew
- 22GoogleAndroid, Nest Cam Iq Indoor Firmware, Cloud Messaging Notification252nonenew
- 23JenkinsJclouds, Jenkins GitLab Authentication Plugin, Jenkins Jclouds Plugin250nonenew
- 24Fedora ProjectFedora247nonenew
- 25ApacheTraffic Server, Apache Tika, Tika2102new
Severity
How this month's CVEs score on CVSS; 51 have no score yet. Severity is not exploitation.
- Critical326
- High726
- Medium902
- Low59
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS458
- CWE-20Improper Input Validation148
- CWE-787Out-of-bounds Write117
- CWE-352CSRF114
- CWE-89SQL Injection92
- CWE-125Out-of-bounds Read77
- CWE-200Information Exposure64
- CWE-416Use After Free50
- CWE-22Path Traversal49
- CWE-119Memory Buffer Bounds44
- CWE-78OS Command Injection39
- CWE-284Improper Access Control34
- CWE-287Improper Authentication32
- CWE-732Incorrect Permissions24
- CWE-26423
- CWE-94Code Injection22
- CWE-400Resource Consumption21
- CWE-601Open Redirect21
- CWE-862Missing Authorization20
- CWE-434Unrestricted File Upload19
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Enterprise Software53921% of sector-tagged CVEs
- Web & CMS Plugins48519% of sector-tagged CVEs
- OSS Libraries32513% of sector-tagged CVEs
- Operating Systems30512% of sector-tagged CVEs
- Consumer Software1596% of sector-tagged CVEs
- Networking Infrastructure1546% of sector-tagged CVEs
- 9 smaller sectors460
- Not yet classified94
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 20Improper Input Validation | 787Out-of-bounds Write | 352CSRF | 89SQL Injection | 125Out-of-bounds Read | 200Information Exposure | 416Use After Free | 22Path Traversal | 119Memory Buffer Bounds |
|---|---|---|---|---|---|---|---|---|---|---|
| Cpanel | 60 | 68 | 1 | 4 | 1 | 29 | 2 | |||
| Adobe | 1 | 33 | 33 | 24 | 4 | |||||
| Сообщество Свободного Программного Обеспечения | 2 | 2 | 7 | 2 | 2 | 14 | 13 | 3 | 2 | |
| Adobe Systems Inc. | 1 | 29 | 33 | 10 | 2 | |||||
| Microsoft | 2 | 8 | 19 | 2 | 13 | 1 | ||||
| Microsoft Corp | 2 | 8 | 17 | 2 | 12 | 1 | ||||
| Debian | 1 | 3 | 12 | 1 | 12 | 1 | 8 | 1 | 4 | |
| Packagist | 35 | 4 | 8 | 2 | 1 | 1 | ||||
| Magento | 28 | 3 | 6 | 1 | 1 | |||||
| Cisco | 4 | 22 | 2 | 1 | 1 | 8 | ||||
| Cisco Systems Inc. | 4 | 22 | 2 | 1 | 1 | 8 | ||||
| Canonical | 3 | 2 | 6 | 6 | 1 |
CVEs published in August 2019
11 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2019-0344Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'H...KEV9.8
- CVE-2019-11581There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on s...KEV9.8
- CVE-2019-15107An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.KEV9.8
- CVE-2019-15752Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a l...KEV7.8
- CVE-2019-13608Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.KEV7.5
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's ...KEV7.2
- CVE-2019-14346Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password.8.8
- CVE-2019-14259On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the "Time Service Settings web" interface ...8.0
- CVE-2019-1225Remote Desktop Protocol Server Information Disclosure Vulnerability7.5
- CVE-2019-15092The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported...7.3
- CVE-2018-19386SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button...6.1