August 2020
1,297 CVEs published, −37% on August 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 12911% of the 1,185 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 447 days after publication
- Vendors
- 4851,932 products
- Top weakness
- XSSCWE-79 · 153 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows 10 Version 2004, Windows 10 1909, Windows 1012113new
- 2IBMSecurity Guardium Data Encryption, Guardium Data Encryption, Guardium For Cloud Key Management744nonenew
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Net-snmp7451new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7231new
- 5CanonicalUbuntu Linux, Ubuntu, Apport6611new
- 6DebianDebian Linux5951new
- 7Ао «концерн Вниинс»Ос Он «стрелец»5521new
- 8CiscoNX-OS, Cisco Webex Meetings, Data Center Network Manager5322new
- 9IntelIntel Server Board S2600ST, Intel Server Board S2600BP, Intel Server Board S2600WF520nonenew
- 10npmKeystone, Highcharts, Tinymce4811nonenew
- 11GoogleAndroid, Asylo, Go-tpm4311nonenew
- 12FedoraprojectFedora, Selinux-policy4231new
- 13OpensuseLeap, Backports Sle, Opensuse Leap 15.13431new
- 14Red HatRed Hat Enterprise Linux, Cloudforms Management Engine, Cloudforms303nonenew
- 15Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop2931new
- 16AdobeAcrobat Dc, Acrobat Reader Dc, Adobe Acrobat and Reader2801new
- 17ArtifexGhostscript, Mujs260nonenew
- 18Artifex Software Inc.Ghostscript250nonenew
- 19Ао «ивк»Альт 8 Сп243nonenew
- 20F5BIG-IP Application Security Manager, BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager210nonenew
- 21MavenOrg.jenkins-ci.main:jenkins-core, Org.jenkins-ci.plugins:pipeline-maven, Net.sf.mpxj:mpxj212nonenew
- 22Fedora ProjectFedora1631new
- 23GoGo.etcd.io/etcd, Github.com/aws/aws-sdk-go, Github.com/hashicorp/vault161nonenew
- 24HuaweiFusioncompute, P30 Pro Firmware, P30 Firmware161nonenew
- 25JetbrainsYoutrack, Teamcity, Toolbox160nonenew
Severity
How this month's CVEs score on CVSS; 112 have no score yet. Severity is not exploitation.
- Critical129
- High512
- Medium510
- Low34
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS153
- CWE-787Out-of-bounds Write74
- CWE-20Improper Input Validation50
- CWE-125Out-of-bounds Read37
- CWE-287Improper Authentication33
- CWE-120Buffer Overflow32
- CWE-22Path Traversal32
- CWE-78OS Command Injection31
- CWE-89SQL Injection28
- CWE-269Improper Privilege Mgmt26
- CWE-352CSRF25
- CWE-200Information Exposure20
- CWE-306Missing Auth for Critical Function17
- CWE-119Memory Buffer Bounds16
- CWE-522Insufficiently Protected Credentials16
- CWE-862Missing Authorization16
- CWE-276Incorrect Default Permissions15
- CWE-400Resource Consumption15
- CWE-863Incorrect Authorization15
- CWE-918SSRF15
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems27819% of sector-tagged CVEs
- OSS Libraries18913% of sector-tagged CVEs
- Enterprise Software16911% of sector-tagged CVEs
- Networking Infrastructure1168% of sector-tagged CVEs
- Web & CMS Plugins1017% of sector-tagged CVEs
- Consumer Software876% of sector-tagged CVEs
- Hardware Firmware866% of sector-tagged CVEs
- Cloud & SaaS775% of sector-tagged CVEs
- Security Products705% of sector-tagged CVEs
- ICS / OT / IoT624% of sector-tagged CVEs
- Mobile Apps614% of sector-tagged CVEs
- Not yet classified65
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 125Out-of-bounds Read | 287Improper Authentication | 120Buffer Overflow | 22Path Traversal | 78OS Command Injection | 89SQL Injection | 269Improper Privilege Mgmt |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 3 | 12 | 1 | |||||||
| Microsoft Corp | 3 | 12 | 1 | |||||||
| IBM | 10 | 7 | 3 | 2 | 1 | 1 | 1 | 2 | ||
| Сообщество Свободного Программного Обеспечения | 1 | 16 | 2 | 4 | 6 | 3 | 2 | 2 | ||
| Ооо «русбитех-астра» | 1 | 16 | 2 | 4 | 6 | 2 | 2 | 2 | ||
| Canonical | 15 | 1 | 3 | 6 | 1 | 2 | ||||
| Debian | 15 | 1 | 5 | 6 | 3 | 2 | 1 | |||
| Canonical Ltd. | 15 | 1 | 3 | 6 | 1 | 2 | ||||
| Ао «концерн Вниинс» | 16 | 1 | 4 | 6 | 2 | 1 | ||||
| Intel | 1 | 5 | 6 | 3 | 5 | 9 | ||||
| Cisco | 8 | 1 | 13 | 2 | 2 | 1 | ||||
| Cisco Systems Inc. | 8 | 1 | 13 | 2 | 2 | 1 |
CVEs published in August 2020
10 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2020-17463FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.KEV9.8
- CVE-2020-17496vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplet...KEV9.8
- CVE-2020-24363TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obt...KEV8.8
- CVE-2020-3566Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityKEV8.6
- CVE-2020-1380Scripting Engine Memory Corruption VulnerabilityKEV7.8
- CVE-2020-1464Windows Spoofing VulnerabilityKEV7.8
- CVE-2020-3433Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking VulnerabilityKEV7.8
- CVE-2020-9715Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitatio...KEV7.8
- CVE-2019-5591A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.KEV6.5
- CVE-2020-1472Netlogon Elevation of Privilege VulnerabilityKEV5.5