March 2020
1,810 CVEs published, +21% on February 2020. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 32318% of the 1,771 with a CVSS score
- Added to CISA KEV
- 020 of this month's CVEs are in KEV, listed a median 603 days after publication
- Vendors
- 5444,329 products
- Top weakness
- XSSCWE-79 · 278 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleAndroid, Google Chrome, Chrome183432new
- 2MicrosoftWindows 10, Windows Server 2016, Windows 10 190911942new
- 3ChadhaajayPhpkb1180nonenew
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Rconfig92163new
- 5MavenCom.fasterxml.jackson.core:jackson-databind, Org.igniterealtime.openfire:parent, Fr.edf.jenkins.plugins:mac82161new
- 6DebianDebian Linux, Python-apt7716nonenew
- 7Red HatRed Hat Enterprise Linux, Ansible, Ansible Tower769nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»6592new
- 9GitLabGitLab517nonenew
- 10QualcommSM8150 Firmware, SXR1130 Firmware, QCS605 Firmware4723nonenew
- 11Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking4723nonenew
- 12Ао «концерн Вниинс»Ос Он «стрелец»4781new
- 13FedoraprojectFedora466nonenew
- 14AdobePhotoshop 2020, Photoshop Cc, Adobe Photoshop4217nonenew
- 15OpensuseLeap, Backports Sle, Factory393nonenew
- 16JenkinsJenkins, Mac, Jenkins Mac Plugin380nonenew
- 17npmBson, Vp-toolkit, Blamer3411nonenew
- 18IBMTivoli Netcool\/impact, Spectrum Protect Plus, Tivoli Netcool Impact331nonenew
- 19PackagistMoodle/moodle, Dolibarr/dolibarr, Froxlor/froxlor326nonenew
- 20WagoPFC200 Firmware, Wago PFC200, Wago PFC200 Firmware322nonenew
- 21CanonicalUbuntu Linux, Ubuntu, Python-apt3161new
- 22PyPIAnsible, Twisted, Python-apt316nonenew
- 23IntelIntel Graphics Driver, Graphics Driver, Intel(R) Graphics Drivers290nonenew
- 24Novell Inc.Opensuse Leap, Suse Package Hub For Suse Linux Enterprise, Suse Linux Enterprise Server For Sap Applications291nonenew
- 25Fedora ProjectFedora254nonenew
Severity
How this month's CVEs score on CVSS; 39 have no score yet. Severity is not exploitation.
- Critical323
- High732
- Medium673
- Low43
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS278
- CWE-787Out-of-bounds Write143
- CWE-78OS Command Injection75
- CWE-125Out-of-bounds Read64
- CWE-352CSRF60
- CWE-89SQL Injection56
- CWE-20Improper Input Validation53
- CWE-120Buffer Overflow50
- CWE-306Missing Auth for Critical Function46
- CWE-200Information Exposure40
- CWE-22Path Traversal37
- CWE-287Improper Authentication31
- CWE-862Missing Authorization30
- CWE-416Use After Free29
- CWE-434Unrestricted File Upload29
- CWE-269Improper Privilege Mgmt26
- CWE-502Deserialization24
- CWE-319Cleartext Transmission23
- CWE-476NULL Pointer Dereference23
- CWE-94Code Injection19
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems36916% of sector-tagged CVEs
- OSS Libraries29713% of sector-tagged CVEs
- Enterprise Software27212% of sector-tagged CVEs
- Web & CMS Plugins23010% of sector-tagged CVEs
- Mobile Apps2019% of sector-tagged CVEs
- Hardware Firmware1697% of sector-tagged CVEs
- Consumer Software1085% of sector-tagged CVEs
- DevTools & CI1085% of sector-tagged CVEs
- Networking Infrastructure1075% of sector-tagged CVEs
- ICS / OT / IoT1065% of sector-tagged CVEs
- Not yet classified61
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 78OS Command Injection | 125Out-of-bounds Read | 352CSRF | 89SQL Injection | 20Improper Input Validation | 120Buffer Overflow | 306Missing Auth for Critical Function | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 42 | 23 | 7 | 5 | 7 | 9 | 5 | |||
| Chadhaajay | 83 | 1 | 27 | |||||||
| Microsoft | 8 | 20 | 1 | |||||||
| Microsoft Corp | 7 | 20 | 2 | |||||||
| Сообщество Свободного Программного Обеспечения | 4 | 12 | 3 | 4 | 2 | 7 | 2 | 3 | ||
| Maven | 12 | 1 | 3 | 2 | 4 | 3 | ||||
| Debian | 2 | 12 | 3 | 3 | 2 | 3 | 4 | |||
| Ооо «русбитех-астра» | 1 | 9 | 4 | 1 | 5 | 1 | 3 | |||
| GitLab | 8 | 1 | 1 | 2 | ||||||
| Qualcomm | 10 | 8 | 3 | 14 | ||||||
| Qualcomm, Inc. | 10 | 8 | 3 | 14 | ||||||
| Ао «концерн Вниинс» | 1 | 8 | 3 | 1 | 1 |
CVEs published in March 2020
28 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Executi...KEV10.0
- CVE-2020-10181goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_...KEV9.8
- CVE-2020-10189Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfS...KEV9.8
- CVE-2020-5722The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell comma...KEV9.8
- CVE-2020-5847Unraid through 6.8.0 allows Remote Code Execution.KEV9.8
- CVE-2020-6207SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAge...KEV9.8
- CVE-2020-7961Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).KEV9.8
- CVE-2020-8599Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypa...KEV9.8
- CVE-2020-9054ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgiKEV9.8
- CVE-2019-17026Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability a...KEV8.8
- CVE-2020-10221lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.KEV8.8
- CVE-2020-8467A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An...KEV8.8
- CVE-2020-8468Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipu...KEV8.8
- CVE-2019-20500D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the ad...KEV7.8
- CVE-2020-0041In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges...KEV7.8
- CVE-2020-0069In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local...KEV7.8
- CVE-2020-0787An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Servic...KEV7.8
- CVE-2020-3950VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability...KEV7.8
- CVE-2020-5849Unraid 6.8.0 allows authentication bypass.KEV7.5
- CVE-2016-11021setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.KEV7.2
- CVE-2020-9547FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka iba...9.8
- CVE-2019-20501D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface, using shell metacharacters in the admi...7.8
- CVE-2020-10871In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances...5.3
- CVE-2020-10409The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/edit-template.php by adding a question ...4.8
- CVE-2020-10420The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/manage-comments.php by adding a questio...4.8
- CVE-2020-10422The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/manage-drafts.php by adding a question ...4.8
- CVE-2020-10445The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/report-article.php by adding a question...4.8
- CVE-2020-10469Reflected XSS in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.4.8