January 2021
1,970 CVEs published, +22% on December 2020 and −1% on January 2020. CISA added 0 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 20213% of the 1,537 with a CVSS score
- Added to CISA KEV
- 09 of this month's CVEs are in KEV, listed a median 361 days after publication
- Vendors
- 5663,119 products
- Top weakness
- XSSCWE-79 · 190 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1OracleMySQL, MySQL Server, Vm VirtualBox169111new
- 2CiscoCisco RV130, Cisco Small Business RV Series Router Firmware, RV110W Firmware15610nonenew
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Openjpeg120154new
- 4Ао "нппкт"Осон Основа Оnyx112144new
- 5Ао «концерн Вниинс»Ос Он «стрелец»99144new
- 6Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition96144new
- 7MicrosoftWindows 10 Version 2004, Windows 10, Windows 10 20048601new
- 8IBMRhapsody Model Manager, Engineering Lifecycle Optimization, Engineering Lifecycle Management844nonenew
- 9DebianDebian Linux8292new
- 10GoogleChrome, Google Chrome, Android78163new
- 11Ао «ивк»Альт 8 Сп, Альт 8 Сп Сервер, Альт Сп 1076111new
- 12FedoraprojectFedora, Extra Packages For Enterprise Linux7292new
- 13NetappOncommand Workflow Automation, Oncommand Insight, Snapcenter7241new
- 14Red HatRed Hat Enterprise Linux, Red Hat Software Collections, Enterprise Linux5783new
- 15MavenCom.fasterxml.jackson.core:jackson-databind, Org.jenkins-ci.main:jenkins-core, Com.mikesamuel:json-sanitizer5261new
- 16Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Server For Sap Applications4382new
- 17npmJointjs, Asciitable.js, Async-git364nonenew
- 18SiemensJT2GO, Teamcenter Visualization, Solid Edge SE2021362nonenew
- 19CanonicalUbuntu, Linux Kernel, Remote-login-service3473new
- 20Crates.ioRaw-cpuid, Abi_stable, Late-static344nonenew
- 21QualcommQET5100, WCD9341, QCA6574A3415nonenew
- 22Qualcomm, Inc.Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer Iot, Snapdragon Industrial Iot, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking3415nonenew
- 23Ао «нтц Ит Роса»Rosa Virtualization, Роса Хром, Роса Кобальт3211new
- 24PackagistMoodle/moodle, Mautic/core, Wp-premium/gravityforms3062new
- 25Sap3d Visual Enterprise Viewer, Business Warehouse, Commerce Cloud271nonenew
Severity
How this month's CVEs score on CVSS; 433 have no score yet. Severity is not exploitation.
- Critical202
- High695
- Medium616
- Low24
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS190
- CWE-787Out-of-bounds Write186
- CWE-12171
- CWE-20Improper Input Validation59
- CWE-269Improper Privilege Mgmt53
- CWE-22Path Traversal45
- CWE-125Out-of-bounds Read42
- CWE-502Deserialization39
- CWE-78OS Command Injection39
- CWE-89SQL Injection37
- CWE-416Use After Free33
- CWE-120Buffer Overflow28
- CWE-352CSRF28
- CWE-119Memory Buffer Bounds26
- CWE-400Resource Consumption24
- CWE-863Incorrect Authorization20
- CWE-362Race Condition18
- CWE-476NULL Pointer Dereference18
- CWE-122Heap Buffer Overflow17
- CWE-434Unrestricted File Upload17
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems34416% of sector-tagged CVEs
- Enterprise Software33716% of sector-tagged CVEs
- OSS Libraries28814% of sector-tagged CVEs
- Networking Infrastructure23011% of sector-tagged CVEs
- Databases1758% of sector-tagged CVEs
- Web & CMS Plugins1356% of sector-tagged CVEs
- Mobile Apps1005% of sector-tagged CVEs
- Hardware Firmware944% of sector-tagged CVEs
- Security Products824% of sector-tagged CVEs
- 6 smaller sectors255
- Not yet classified90
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 121 | 20Improper Input Validation | 269Improper Privilege Mgmt | 22Path Traversal | 125Out-of-bounds Read | 502Deserialization | 78OS Command Injection | 89SQL Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Oracle | 2 | 1 | 3 | 12 | ||||||
| Cisco | 18 | 61 | 61 | 26 | 1 | 2 | 12 | 7 | ||
| Cisco Systems Inc. | 18 | 61 | 61 | 26 | 1 | 2 | 12 | 7 | ||
| Oracle Corp. | 1 | |||||||||
| Oracle Corporation | ||||||||||
| Сообщество Свободного Программного Обеспечения | 3 | 18 | 1 | 5 | 1 | 3 | 8 | 12 | 1 | |
| Ао «нппкт» | 2 | 21 | 4 | 1 | 3 | 8 | 12 | |||
| Ао «концерн Вниинс» | 2 | 22 | 4 | 1 | 8 | 11 | ||||
| Ооо «русбитех-астра» | 2 | 16 | 4 | 1 | 3 | 8 | 1 | |||
| IBM | 17 | 2 | 1 | 4 | 1 | |||||
| Microsoft | 1 | 33 | 1 | 1 | ||||||
| Microsoft Corp | 1 | 33 | 1 |
CVEs published in January 2021
12 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2020-29557An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.KEV9.8
- CVE-2021-3129Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_content...KEV9.8
- CVE-2021-3199Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.KEV9.8
- CVE-2020-16017Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTM...KEV9.6
- CVE-2020-16013Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.KEV8.8
- CVE-2020-6572Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.KEV8.8
- CVE-2021-1647Microsoft Defender Remote Code Execution VulnerabilityKEV7.8
- CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends w...KEV7.8
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST APIKEV7.5
- CVE-2020-36193Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.KEV7.5
- CVE-2020-35131Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON ...9.8
- CVE-2021-1678Windows Print Spooler Spoofing Vulnerability8.8