Summary
Total advisories: 725 ↓ (last month: 732).
Important conclusions from this month report are:
- 2022 was a record-breaking year with the highest number of Secunia Advisories reported, however 2023 is shaping up to destroy that previous record since we are already +22% Year-to-date.
- Advisories for 88 unique vendors, 337 unique products and 410 unique product versions reported this month.
- Almost 54.48% of all vulnerabilities reported in this month have a “Remote Attack Vector” (last month 52.19%)
- The Secunia Research Team reported 16 Extremely critical advisories this month. (Last month: 😎
- A whopping 17 Zero-Day Advisories reported. (last month :8)
- Microsoft Patch Tuesday reported 136 CVE’s, Secunia research team summarized these into 17 Advisories.
- Over 1,731 unique CVE’s (last month: 1,741) were covered in the 725 Advisories.
- Threat Intelligence indicates again that more Moderately Critical Vulnerabilities are targeted by hackers.
- More than half of all advisories are disclosed by 4 vendors (Amazon 18,62%, Oracle 13.84%, SUSE 13.67%, Ubuntu 12.36%)
- Interestingly some these vendors are also the ones with the most rejected advisories:
- Amazon: 30 out of 113 advisories were rejected by the Secunia Research Team
- SUSE: 15 out of 83 advisories were rejected.
- Juniper and NetApp are contributing to exactly 50% of all Networking related Advisories this month.
Last month we reported that 77.46% of all Secunia Advisories had a Threat (exploits, malware, ransomware, etc.) associated with them, this month the number has been higher to 80%
Using Threat Intelligence is going to help you with prioritizing what needs to be patched immediately.
Software Vulnerability – and Patch Management is becoming more and more important.
Due to the ongoing global threats, attacks on critical infrastructures in many countries are increasing.
Back in 2019 (just before Covid) patching was recommended within 30 days (or 14 days for CVSS score 7 or higher)
Right now, hackers can deploy exploits within 1 week and even within 24 hours . This means that organizations need to prioritize even better to quickly patch vulnerabilities (especially the ones with threats associated with them)
