November 2020
1,485 CVEs published, −8% on October 2020 and −18% on November 2019. CISA added 0 to KEV.
2020 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | January 2020: 1,984 CVEs | February 2020: 1,491 CVEs | March 2020: 1,810 CVEs | April 2020: no snapshot | May 2020: no snapshot | June 2020: 1,894 CVEs | July 2020: no snapshot | August 2020: 1,297 CVEs | September 2020: 2,258 CVEs | October 2020: 1,621 CVEs | November 2020: 1,485 CVEs | December 2020: 1,618 CVEs | 15,4589 of 12 months9/12 |
- Critical
- 16713% of the 1,256 with a CVSS score
- Added to CISA KEV
- 010 of this month's CVEs are in KEV, listed a median 365 days after publication
- Vendors
- 4892,638 products
- Top weakness
- XSSCWE-79 · 120 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows 10, Windows 10 1909, Windows 10 190311412new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Drupal101115new
- 3Intel2nd Generation Intel Xeon Scalable Processor, Active Management Technology Firmware, Active Management Technology964nonenew
- 4DebianDebian Linux95104new
- 5FedoraprojectFedora8245new
- 6GoogleChrome, Google Chrome, Android7293new
- 7Ао "нппкт"Осон Основа Оnyx6754new
- 8Ао «концерн Вниинс»Ос Он «стрелец»6243new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»5923new
- 10CiscoCisco SD-WAN, Cisco IoT Field Network Director (Iot-fnd), IoT Field Network Director505nonenew
- 11Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Container Platform5041new
- 12QualcommSDX55 Firmware, SM8150 Firmware, SM8250 Firmware4814nonenew
- 13Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables4814nonenew
- 14MavenOrg.jenkins-ci.plugins:active-directory, Org.craftercms:crafter-studio, Org.csanchez.jenkins.plugins:kubernetes476nonenew
- 15IBMSterling B2B Integrator, Cloud Pak For Security, Sterling File Gateway422nonenew
- 16OpensuseBackports Sle, Leap4233new
- 17Fedora ProjectFedora4142new
- 18PackagistMagento/community-edition, Moodle/moodle, Magento/project-community-edition3512new
- 19Novell Inc.Opensuse Leap, Suse Openstack Cloud Crowbar, Suse Enterprise Storage3443new
- 20npmSysteminformation, Axios, Browserless-chrome324nonenew
- 21NetappCloud Backup, Hci Compute Node Bios, Solidfire Bios3131new
- 22Schneider-electricInteractive Graphical Scada System, Ecostruxure Control Expert, Webreports302nonenew
- 23AdobeAcrobat Reader, Adobe Acrobat Reader 2017, Adobe Acrobat Reader 2020251nonenew
- 24Ао «ивк»Альт 8 Сп, Альт Сп 102442new
- 25Schneider ElectricWebreports, Ecostruxure Control Expert, Modicon M100232nonenew
Severity
How this month's CVEs score on CVSS; 229 have no score yet. Severity is not exploitation.
- Critical167
- High548
- Medium503
- Low38
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS120
- CWE-787Out-of-bounds Write74
- CWE-20Improper Input Validation59
- CWE-416Use After Free38
- CWE-125Out-of-bounds Read32
- CWE-22Path Traversal30
- CWE-287Improper Authentication28
- CWE-120Buffer Overflow27
- CWE-89SQL Injection27
- CWE-78OS Command Injection25
- CWE-434Unrestricted File Upload22
- CWE-269Improper Privilege Mgmt20
- CWE-190Integer Overflow18
- CWE-200Information Exposure18
- CWE-352CSRF18
- CWE-522Insufficiently Protected Credentials18
- CWE-798Hard-coded Credentials18
- CWE-918SSRF18
- CWE-276Incorrect Default Permissions17
- CWE-862Missing Authorization17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems33420% of sector-tagged CVEs
- OSS Libraries22413% of sector-tagged CVEs
- Hardware Firmware21112% of sector-tagged CVEs
- Enterprise Software17811% of sector-tagged CVEs
- Web & CMS Plugins1137% of sector-tagged CVEs
- Networking Infrastructure1076% of sector-tagged CVEs
- ICS / OT / IoT915% of sector-tagged CVEs
- Security Products845% of sector-tagged CVEs
- Mobile Apps835% of sector-tagged CVEs
- DevTools & CI694% of sector-tagged CVEs
- Not yet classified42
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 20Improper Input Validation | 416Use After Free | 125Out-of-bounds Read | 22Path Traversal | 287Improper Authentication | 120Buffer Overflow | 89SQL Injection | 78OS Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 5 | 6 | 1 | 1 | 1 | |||||
| Microsoft Corp | 5 | 6 | 1 | 1 | 1 | |||||
| Сообщество Свободного Программного Обеспечения | 1 | 19 | 4 | 17 | 6 | 2 | 5 | 3 | 1 | 2 |
| Intel | 4 | 9 | 2 | 7 | 1 | 1 | ||||
| Debian | 1 | 24 | 3 | 16 | 6 | 1 | 4 | 3 | 1 | 2 |
| Intel Corp. | 3 | 9 | 2 | 7 | 1 | 1 | ||||
| Fedoraproject | 1 | 20 | 4 | 16 | 4 | 1 | 1 | 1 | ||
| 26 | 4 | 21 | 3 | 2 | ||||||
| Ао «нппкт» | 18 | 4 | 15 | 2 | 3 | 1 | 1 | 2 | ||
| Ао «концерн Вниинс» | 21 | 3 | 15 | 2 | 2 | 1 | 1 | 1 | ||
| Ооо «русбитех-астра» | 17 | 1 | 10 | 3 | 1 | 2 | 1 | 1 | ||
| Cisco | 7 | 2 | 7 | 3 | 1 | 3 |
CVEs published in November 2020
10 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the...KEV9.8
- CVE-2020-14750Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14....KEV9.8
- CVE-2020-16846An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.KEV9.8
- CVE-2020-15999Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV9.6
- CVE-2020-16010Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafte...KEV9.6
- CVE-2020-4006VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.KEV9.1
- CVE-2020-13671Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP...KEV8.8
- CVE-2020-16009Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2020-17087Windows Kernel Local Elevation of Privilege VulnerabilityKEV7.8
- CVE-2020-28949Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.KEV7.8