First question on here so please be as gentle as you can :-)
I've been looking around for any writings or papers on a standard for classifying vulnerabilities. Not from a severity/risk/impact point of view but categorising such as grouping all the 'missing patches', 'weak authentication management', egress/ingress rules for networks and alike. Now I know that plenty of people have done this work already, myself included. What I am interested to know is if anyone has done something on a more formal/standard footing?
Long question, all responses warmly welcomed.