Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Which site/sites do you guys use to view details of security vulnerabilities?

share|improve this question

closed as too broad by Iszi, Noordung, Xander, Gilles, Rory Alsop Sep 15 at 7:26

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Thanks all for your answers. All answers look really useful. –  Nathan B. Dec 20 '10 at 14:19
2  
See also security.stackexchange.com/questions/829/… –  nealmcb Dec 20 '10 at 18:18

7 Answers 7

up vote 12 down vote accepted

I tend to start with http://secunia.com for vulns per-product or vendor, pick the CVE references up from there and then view the details on http://www.cvedetails.com

share|improve this answer
    
Accepted this one since cvedetails.com looks pretty useful and it provides links to OVAL definition details which is not available on other sites –  Nathan B. Dec 23 '10 at 9:28

I’m guessing since you asked this question you find it frequently mind-numbing to locate good vulnerability descriptions. I hate it when I get stuck chasing down the details of a single vuln when there are 100s or 1000s of additional vulns in play.

My favorite sources are the vendors that run decent advisory sites, like:

Red Hat: https://access.redhat.com/security/updates/active/
Microsoft: http://www.microsoft.com/technet/security/current.aspx
Apache: http://httpd.apache.org/security_report.html
...

If the vuln is one I discovered from probing a web app then I like to borrow OWASP’s vulnerability descriptions – in fact, OWASP’s Top 10 for 2010 PDF is especially nice for referencing or copying for reports because it’s pretty:
http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202010.pdf

If it is anything to do with an SSL Server then SSL Labs is great: https://www.ssllabs.com/
(w/description of scoring: https://www.ssllabs.com/downloads/SSL_Server_Rating_Guide_2009.pdf)

And of course most of the premium commercial vulnerability scanners offer good caches of vulnerability descriptions (e.g. http://www.rapid7.com/vulndb/index.jsp or Qualys (need an account))

Beyond that, sometimes pushing the effort to gather the vulnerability details for a particular vulnerability to the vendor is effective if you have a support contract.

share|improve this answer

I use primarly

  • Exploit-DB - Usually I use this for web exploits (like a fresh Joomla hack, or something similar)
  • Open-Source vulnerability database - Excellent for all kinds of products. I've found some old. but excellent hacks on this page
  • Secunia - For searching
  • Microsoft Technet - For some extra reading about the latest Microsoft issues
  • Google Reader - I subscribe to a lot of RSS feeds. If you connect to one feed which you find interesting, Google helps you find similar feeds in which is related.

Also it ususally pays off to visit the vendor homepage if your are looking for any trouble your apps could make. They usually post advisories where they show you what are the most critical issues.

share|improve this answer
1  
I keep forgetting about the OSVDB. It is a great resource. –  Scott Pack Dec 20 '10 at 13:35

I prefer to use the vendor sites for most information. Since I am often more interested in whether or not a patch or workaround exists, I find them to be most useful.

When the vendor site is not entirely useful, i.e. there is no patch/workaround and we still need to determine what level of compensating controls are necessary, I tend to use the following (in order)

  1. National Vulnerability Database
  2. Secunia
  3. exploit-db
share|improve this answer

Some other sources which always offer either workable exploits, or in-depth technical articles on lots of good stuff:

Also, see this post on securitytube:

http://questions.securitytube.net/questions/308/milw0rm-com-replacement

share|improve this answer

Being in Application Security, the website I use most frequently is Fortify Software

This site not only gives an explanation for what the vulnerability category is and how it can be used maliciously, it will frequently give code examples of good and bad practices for a given vulnerability in your language of choice.

This site is more directly related to source code, however even for basic web vulnerability explanations it definitely does the trick, and has helped me immensely when trying to convey to a client what exactly the vulnerability is, and at the same time provide examples to the developers for correction.

share|improve this answer

http://www.securityfocus.com

I found this site SecurityFocus to have good database of articles. All though sometimes you need to know what you looking for before you can find something solid.

For example, if you looking for vulnerabilities on Adobe Reader there are 0; if you pull up Adobe Acrobat, there are dozens that say Adobe Reader.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.