January 2020
1,984 CVEs published, +5% on December 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 24715% of the 1,665 with a CVSS score
- Added to CISA KEV
- 07 of this month's CVEs are in KEV, listed a median 786 days after publication
- Vendors
- 7663,578 products
- Top weakness
- XSSCWE-79 · 242 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleEnterprise Manager Base Platform, Vm VirtualBox, MySQL22272new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libxml2125181new
- 3Red HatRed Hat Enterprise Linux, Enterprise Linux, Enterprise Linux Desktop10113nonenew
- 4CanonicalUbuntu Linux, Ubuntu9181new
- 5Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition8110nonenew
- 6DebianDebian Linux80141new
- 7OpensuseLeap, Backports Sle, Factory765nonenew
- 8Ао «концерн Вниинс»Ос Он «стрелец»758nonenew
- 9Novell Inc.Opensuse Leap, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise Server646nonenew
- 10MicrosoftWindows Server, Windows Server 2016, Windows Server 20196143new
- 11Ао «ивк»Альт 8 Сп, Альт Сп 10592nonenew
- 12MavenOrg.jenkins-ci.main:jenkins-core, Org.opencastproject:opencast-kernel, Org.jenkins-ci.plugins:sounds568nonenew
- 13CiscoCisco Data Center Network Manager, Data Center Network Manager, Cisco IOS XR Software486nonenew
- 14GitLabGitLab, GitLab Ce/ee, GitLab Ee484nonenew
- 15FedoraprojectFedora, 389 Directory Server, Extra Packages For Enterprise Linux4591new
- 16MozillaFirefox, Firefox Esr, Thunderbird371nonenew
- 17PyPIPlone, Pillow, Opencv-contrib-python-headless375nonenew
- 18NetappActive Iq Unified Manager, Oncommand Workflow Automation, Oncommand Insight351nonenew
- 19PackagistMagento/community-edition, Magento/core, Dolibarr/dolibarr346nonenew
- 20QualcommSM8150 Firmware, SDM845 Firmware, SXR2130 Firmware2911nonenew
- 21GoogleAndroid, Chrome, Google Chrome281nonenew
- 22Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Wearables2811nonenew
- 23Ао "нппкт"Осон Основа Оnyx255nonenew
- 24IBMSecurity Secret Server, Mq Appliance, Qradar Security Information and Event Manager212nonenew
- 25JenkinsJenkins, Amazon EC2, Cloudbees210nonenew
Severity
How this month's CVEs score on CVSS; 319 have no score yet. Severity is not exploitation.
- Critical247
- High642
- Medium742
- Low34
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS242
- CWE-787Out-of-bounds Write86
- CWE-20Improper Input Validation65
- CWE-78OS Command Injection63
- CWE-200Information Exposure46
- CWE-269Improper Privilege Mgmt44
- CWE-22Path Traversal43
- CWE-352CSRF40
- CWE-89SQL Injection40
- CWE-125Out-of-bounds Read35
- CWE-287Improper Authentication35
- CWE-120Buffer Overflow34
- CWE-416Use After Free34
- CWE-434Unrestricted File Upload26
- CWE-522Insufficiently Protected Credentials25
- CWE-798Hard-coded Credentials23
- CWE-74Injection21
- CWE-400Resource Consumption20
- CWE-863Incorrect Authorization20
- CWE-295Improper Certificate Validation18
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems38117% of sector-tagged CVEs
- OSS Libraries29813% of sector-tagged CVEs
- Databases23411% of sector-tagged CVEs
- Enterprise Software21710% of sector-tagged CVEs
- Networking Infrastructure1708% of sector-tagged CVEs
- Web & CMS Plugins1708% of sector-tagged CVEs
- Security Products1185% of sector-tagged CVEs
- DevTools & CI1105% of sector-tagged CVEs
- Consumer Software1105% of sector-tagged CVEs
- Hardware Firmware864% of sector-tagged CVEs
- Not yet classified96
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 78OS Command Injection | 200Information Exposure | 269Improper Privilege Mgmt | 22Path Traversal | 352CSRF | 89SQL Injection | 125Out-of-bounds Read |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 3 | 4 | 1 | 1 | ||||||
| Oracle Corp. | 3 | 4 | 1 | |||||||
| Oracle Corporation | 1 | |||||||||
| Сообщество Свободного Программного Обеспечения | 5 | 21 | 6 | 4 | 1 | 2 | 1 | 1 | 7 | |
| Ооо «русбитех-астра» | 5 | 18 | 3 | 1 | 6 | |||||
| Debian | 4 | 10 | 2 | 1 | 1 | 1 | 2 | 4 | ||
| Opensuse | 2 | 14 | 2 | 1 | 9 | |||||
| Ао «концерн Вниинс» | 5 | 17 | 5 | 1 | 3 | |||||
| Canonical | 3 | 9 | 1 | 1 | 3 | |||||
| Novell Inc. | 3 | 14 | 3 | 2 | 1 | 1 | 1 | 3 | ||
| Red Hat | 6 | 9 | 3 | 1 | 2 | 1 | 1 | 2 | 2 | |
| Red Hat Inc. | 5 | 13 | 4 | 2 | 1 |
CVEs published in January 2020
7 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2020-0646A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.KEV9.8
- CVE-2020-2551Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12....KEV9.8
- CVE-2020-2555Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12...KEV9.8
- CVE-2020-7247smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrate...KEV9.8
- CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vuln...KEV8.2
- CVE-2020-0601A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed co...KEV8.1
- CVE-2020-0638An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim s...KEV7.8