October 2019
1,799 CVEs published, +15% on September 2019 and +21% on October 2018. CISA added 0 to KEV.
2019 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2019 | January 2019: no snapshot | February 2019: 908 CVEs | March 2019: no snapshot | April 2019: no snapshot | May 2019: 1,366 CVEs | June 2019: no snapshot | July 2019: 1,752 CVEs | August 2019: 2,064 CVEs | September 2019: 1,568 CVEs | October 2019: 1,799 CVEs | November 2019: 1,802 CVEs | December 2019: 1,881 CVEs | 13,1408 of 12 months8/12 |
- Critical
- 24915% of the 1,627 with a CVSS score
- Added to CISA KEV
- 07 of this month's CVEs are in KEV, listed a median 887 days after publication
- Vendors
- 6302,613 products
- Top weakness
- XSSCWE-79 · 258 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL Server, MySQL, Java Se151101new
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition147221new
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Tightvnc140271new
- 4DebianDebian Linux, BIND9, Overkill115202new
- 5CanonicalUbuntu Linux, Ubuntu106122new
- 6CiscoSPA122 Firmware, Cisco Firepower Management Center, Cisco SPA112 2-port Phone Adapter892nonenew
- 7AdobeAcrobat Dc, Acrobat Reader Dc, Adobe Acrobat and Reader8622nonenew
- 8Red HatRed Hat Enterprise Linux, Enterprise Linux, Enterprise Linux Server86121new
- 9MavenCom.fasterxml.jackson.core:jackson-databind, Org.jenkins-ci.plugins:dynatrace-dashboard, Org.jenkins-ci.plugins:icescrum7313nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»71131new
- 11FedoraprojectFedora6781new
- 12Novell Inc.Opensuse Leap, Suse Linux Enterprise Module For Basesystem, Suse Linux Enterprise Server6591new
- 13OpensuseLeap, Backports Sle616nonenew
- 14MicrosoftWindows, Windows Server, Windows 10 18096022new
- 15NetappOncommand Workflow Automation, Active Iq Unified Manager, Snapcenter6051new
- 16Fedora ProjectFedora5181new
- 17JenkinsJenkins Dynatrace Application Monitoring Plugin, Kubernetes Ci, Jenkins Crx Content Package Deployer Plugin462nonenew
- 18IBMCloud Orchestrator, Security Guardium Big Data Intelligence, Security Directory Server410nonenew
- 19JetbrainsTeamcity, Youtrack, Upsource344nonenew
- 20AwesomemotiveEasy Digital Downloads320nonenew
- 21EasydigitaldownloadsAmazon S3, Attach Accounts To Orders, Commissions310nonenew
- 22TcpdumpTcpdump, Libpcap302nonenew
- 23FoxitsoftwareReader, Phantompdf, Foxit Studio Photo290nonenew
- 24SugarcrmSugarcrm291nonenew
- 25FusionpbxFusionpbx260nonenew
Severity
How this month's CVEs score on CVSS; 172 have no score yet. Severity is not exploitation.
- Critical249
- High656
- Medium658
- Low64
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS258
- CWE-89SQL Injection78
- CWE-125Out-of-bounds Read70
- CWE-787Out-of-bounds Write65
- CWE-20Improper Input Validation58
- CWE-22Path Traversal55
- CWE-416Use After Free54
- CWE-78OS Command Injection43
- CWE-200Information Exposure42
- CWE-352CSRF41
- CWE-119Memory Buffer Bounds37
- CWE-276Incorrect Default Permissions33
- CWE-306Missing Auth for Critical Function26
- CWE-120Buffer Overflow22
- CWE-434Unrestricted File Upload22
- CWE-94Code Injection22
- CWE-284Improper Access Control19
- CWE-319Cleartext Transmission18
- CWE-75518
- CWE-862Missing Authorization17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems35616% of sector-tagged CVEs
- OSS Libraries26212% of sector-tagged CVEs
- Networking Infrastructure22910% of sector-tagged CVEs
- Enterprise Software22810% of sector-tagged CVEs
- Web & CMS Plugins21610% of sector-tagged CVEs
- Consumer Software1678% of sector-tagged CVEs
- Databases1617% of sector-tagged CVEs
- Security Products1125% of sector-tagged CVEs
- DevTools & CI984% of sector-tagged CVEs
- 6 smaller sectors290
- Not yet classified101
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 125Out-of-bounds Read | 787Out-of-bounds Write | 20Improper Input Validation | 22Path Traversal | 416Use After Free | 78OS Command Injection | 200Information Exposure | 352CSRF |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 1 | 1 | 1 | |||||||
| Ооо «русбитех-астра» | 3 | 1 | 21 | 9 | 11 | 4 | 1 | |||
| Oracle Corp. | 1 | 1 | ||||||||
| Сообщество Свободного Программного Обеспечения | 6 | 2 | 23 | 8 | 7 | 3 | 1 | 1 | 2 | |
| Oracle Corporation | ||||||||||
| Debian | 7 | 21 | 5 | 9 | 3 | 2 | 1 | 1 | ||
| Cisco Systems Inc. | 18 | 9 | 16 | 2 | 5 | 4 | 2 | |||
| Adobe | 8 | 22 | 9 | 1 | 26 | 1 | ||||
| Cisco | 18 | 9 | 15 | 3 | 5 | 3 | 2 | |||
| Adobe Systems Inc. | 8 | 17 | 9 | 1 | 26 | |||||
| Maven | 3 | 1 | 1 | 9 | ||||||
| Ао «концерн Вниинс» | 2 | 1 | 5 | 4 | 1 | 1 |
CVEs published in October 2019
18 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2019-16278Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.KEV9.8
- CVE-2019-3010Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacke...KEV8.8
- CVE-2019-11043Underflow in PHP-FPM can lead to RCEKEV8.7
- CVE-2019-1315An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This C...KEV7.8
- CVE-2019-1322An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-...KEV7.8
- CVE-2019-2215A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does requi...KEV7.8
- CVE-2019-18187Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder o...KEV7.5
- CVE-2019-13335SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF.9.8
- CVE-2019-14931An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an at...9.8
- CVE-2019-17181A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system.9.8
- CVE-2019-17543LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead...8.1
- CVE-2019-17624"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (applicatio...7.8
- CVE-2019-17513An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted ...7.5
- CVE-2019-17612An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category s...7.2
- CVE-2019-12415In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local fi...5.5
- CVE-2019-2888Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: EJB Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily ex...5.3
- CVE-2019-17522A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.4.8
- CVE-2019-2940Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged att...2.3