September 2019
1,568 CVEs published, −24% on August 2019 and +30% on September 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 18812% of the 1,552 with a CVSS score
- Added to CISA KEV
- 011 of this month's CVEs are in KEV, listed a median 790 days after publication
- Vendors
- 6402,625 products
- Top weakness
- XSSCWE-79 · 226 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Chrome, Google Chrome3093nonenew
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Phpipam127201new
- 3CanonicalUbuntu Linux, Ubuntu8291new
- 4MicrosoftWindows, Windows 10, Windows 10 18038215new
- 5DebianDebian Linux78121new
- 6Ао «концерн Вниинс»Ос Он «стрелец»7010nonenew
- 7Novell Inc.Opensuse Leap, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise Server685nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition679nonenew
- 9MavenOrg.jenkins-ci.main:jenkins-core, Org.apache.jspwiki:jspwiki-war, Org.jenkins-ci.plugins:script-security596nonenew
- 10OpensuseLeap, Backports Sle, Backports576nonenew
- 11Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Container Platform553nonenew
- 12GitLabGitLab, Omnibus502nonenew
- 13FedoraprojectFedora4591new
- 14CiscoCisco IOS XE, IOS XE, IOS401nonenew
- 15JenkinsJenkins, Script Security, Jenkins Script Security Plugin392nonenew
- 16PackagistSilverstripe/framework, Librenms/librenms, Dolibarr/dolibarr384nonenew
- 17Fedora ProjectFedora3571new
- 18LinuxLinux Kernel, Kernel342nonenew
- 19IBMWebsphere Application Server, Websphere Extreme Scale, Security Key Lifecycle Manager310nonenew
- 20Ао «ивк»Альт 8 Сп, Альт 8 Сп Рабочая Станция, Альт 8 Сп Сервер281nonenew
- 21DellBsafe Micro-edition-suite, Rsa Bsafe Mes, Rsa Via Lifecycle and Governance222nonenew
- 22MozillaFirefox, Firefox Esr, Thunderbird222nonenew
- 23ApacheJspwiki, HTTP Server, Ofbiz207nonenew
- 24NetappSteelstore Cloud Integrated Storage, Solidfire, Hci Management Node206nonenew
- 25OracleEnterprise Manager Ops Center, Retail Xstore Point of Service, Peoplesoft Enterprise Peopletools195nonenew
Severity
How this month's CVEs score on CVSS; 16 have no score yet. Severity is not exploitation.
- Critical188
- High585
- Medium750
- Low29
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS226
- CWE-787Out-of-bounds Write143
- CWE-125Out-of-bounds Read139
- CWE-352CSRF71
- CWE-20Improper Input Validation62
- CWE-89SQL Injection52
- CWE-200Information Exposure42
- CWE-22Path Traversal42
- CWE-416Use After Free41
- CWE-476NULL Pointer Dereference35
- CWE-190Integer Overflow30
- CWE-90830
- CWE-269Improper Privilege Mgmt23
- CWE-522Insufficiently Protected Credentials23
- CWE-434Unrestricted File Upload22
- CWE-120Buffer Overflow21
- CWE-78OS Command Injection20
- CWE-862Missing Authorization20
- CWE-863Incorrect Authorization19
- CWE-306Missing Auth for Critical Function16
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Mobile Apps31216% of sector-tagged CVEs
- Operating Systems30016% of sector-tagged CVEs
- Web & CMS Plugins25813% of sector-tagged CVEs
- OSS Libraries24713% of sector-tagged CVEs
- Enterprise Software19410% of sector-tagged CVEs
- DevTools & CI1055% of sector-tagged CVEs
- Networking Infrastructure885% of sector-tagged CVEs
- ICS / OT / IoT834% of sector-tagged CVEs
- 7 smaller sectors262
- Not yet classified82
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 125Out-of-bounds Read | 352CSRF | 20Improper Input Validation | 89SQL Injection | 22Path Traversal | 200Information Exposure | 416Use After Free | 476NULL Pointer Dereference |
|---|---|---|---|---|---|---|---|---|---|---|
| 88 | 109 | 22 | 1 | 4 | 15 | 4 | ||||
| Сообщество Свободного Программного Обеспечения | 11 | 15 | 7 | 4 | 5 | 3 | 1 | 8 | 8 | |
| Microsoft | 4 | 9 | 2 | 7 | 1 | 11 | 1 | |||
| Microsoft Corp | 4 | 9 | 2 | 7 | 1 | 11 | 1 | |||
| Debian | 11 | 10 | 8 | 1 | 3 | 3 | 1 | 1 | 1 | |
| Ао «концерн Вниинс» | 4 | 11 | 3 | 4 | 3 | 4 | 1 | |||
| Novell Inc. | 3 | 8 | 5 | 4 | 1 | 1 | 8 | 3 | ||
| Ооо «русбитех-астра» | 4 | 9 | 3 | 2 | 2 | 1 | 5 | 3 | ||
| Canonical | 4 | 9 | 10 | 4 | 3 | 6 | ||||
| Maven | 16 | 1 | 1 | 1 | ||||||
| Opensuse | 1 | 10 | 2 | 3 | 1 | 1 | 4 | 4 | ||
| GitLab | 7 | 1 | 1 | 8 |
CVEs published in September 2019
16 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2019-16057The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.KEV9.8
- CVE-2019-16256Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or e...KEV9.8
- CVE-2019-16759vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.KEV9.8
- CVE-2019-16920Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device...KEV9.8
- CVE-2019-16928Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.KEV9.8
- CVE-2019-1297A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.KEV8.8
- CVE-2019-15949Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh sc...KEV8.8
- CVE-2019-1214An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Pr...KEV7.8
- CVE-2019-1215An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-20...KEV7.8
- CVE-2019-1253An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on ...KEV7.8
- CVE-2019-1367A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID...KEV7.5
- CVE-2016-10972The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.9.8
- CVE-2019-10709AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially privilege escalation via a crafted DeviceI...9.8
- CVE-2019-15029FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the malicious command into the database). T...8.8
- CVE-2019-9418In libstagefright, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interactio...6.5
- CVE-2019-16312s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.6.1