Tag: Vulnerability Databases
-
Why Anaconda INC Doesn’t Fully Understand CVEs
It’s worrisome that in 2020 we still have people in influential technical roles that don’t understand CVE. A friend told me earlier this year he was in a meeting where someone said that CVE IDs are assigned in order, so CVE-2020-9500 meant there were 9500 vulns in 2020 so far. Of course that is not…
-
Our Reports Clickbait? No. Click Here To Find Out Why…
[This was originally posted to the Risk Based Security blog (now 404 and no IA copy), with contributions from Jake Kouns.] Last week, we published our 2018 mid-year report that included an overview of the vulnerabilities that we have tracked and included in VulnDB. We highlighted a key takeaway from the report in the title:…
-
Thoughts about CNNVD vs. US NVD
[This was originally published on RiskBasedSecurity.com in the 2017 Q3 Vulnerability QuickView report.] In October, Bill Ladd of Recorded Future released a study comparing CVE and the U.S. NationalVulnerability Database (NVD) with China’s National Vulnerability Database (CNNVD). This report, titled“The Dragon Is Winning: U.S. Lags Behind Chinese Vulnerability Reporting” was covered by John Leyden inThe…
-
2017 End-of-year Reports Based on CVE Data
[These were notes I took in 2017 and never got around to finishing. I have done some general formatting / cleanup to round out the sentences and such, but not much else. Given I made a prediction at the time, I am opting to publish this but backdate is accordingly. The general issue of CVE…
-
Rebuttal: Dark Reading’s “9” Sources for Tracking New Vulnerabilities
[This was originally published on the OSVDB blog.] Earlier today, Sean Martin published an article on Dark Reading titled “9 Sources For Tracking New Vulnerabilities“. Spanning 10 pages, likely for extra ad revenue, the sub-title reads: Keeping up with the latest vulnerabilities — especially in the context of the latest threats — can be a…
-
CVE/NVD: The High Price of ‘Free’
[This was originally published for RiskBasedSecurity.com. I can’t find the original on archive.org and this was written too long ago to have access to the original Google Doc.] Vulnerability Intelligence (VI) is not a new offering by any stretch of the imagination. However, in the past few years VI has gained more attention and become…
-
OSVDB – How many people work on this project?
[This was originally published on the OSVDB blog.] We are occasionally asked how many people work on OSVDB. This question comes from those familiar with the project, and potential customers of our vulnerability intelligence feed. Back in the day, I had no problem answering it quickly and honestly. For years we limped along with one…
-
We’re Doing the Unthinkable
[This was originally published on the OSVDB blog.] Anyone who knows me in the context of vulnerability databases will find this post a tad shocking, even if they have endured my rants about it before. For the first time ever, I am making it policy that we will no longer put any priority on Vulnerability…
-
Buying Into the Bias: Why Vulnerability Statistics Suck [Abstract]
[This was originally published on the OSVDB blog.] Last week, Steve Christey and I gave a presentation at Black Hat Briefings 2013 in Las Vegas about vulnerability statistics. We submitted a brief whitepaper on the topic, reproduced below, to accompany the slides that are now available. Buying Into the Bias: Why Vulnerability Statistics SuckBy Steve…
-
Our Straw House: Vulnerabilities
I was asked by RVAsec to fill in as a last minute replacement for a speaker that canceled. The topic of Vulnerability Databases (VDBs) is very familiar to me, so the only trick was cramming an intricate topic into about 50 minutes. Overall, I attempt to enumerate the serious weaknesses in most VDBs that make…