Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs?

Thx

share|improve this question

NVD covers a lot of vulnerabilities. Aside from those you also have:

They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities.

Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which might not get disclosed.

share|improve this answer
    
Yeah. I have seen those websites, but does it mean that, every known vulnerabilities is assigned to a CVE number today ? Or is there a few rebels that does not want to join the CVE numbering ? – Mathieu Leiv Dec 9 '13 at 9:11
2  
@MathieuLeiv in an ideal world everyone would follow complete "full disclosure" etiquette this is unfortunatly not always the case; exploit-db.com is a good one to keep an eye on also as well as seclists.org/fulldisclosure – Oneiroi Dec 9 '13 at 9:22
    
@MathieuLeiv If you check out exploit-db.com you will see that there are many vulns without CVEs. On the other hand, there are CVEs which correspond to multiple vulns... – buherator Dec 9 '13 at 12:30

Currently the NVD only pulls from the Mitre CVE database, this will be changing, but for now if Mitre doesn't have an entry written up, it won't be in the NVD database. As for Mitre I know we (Red Hat) have assigned over a thousand CVEs that aren't in the Mitre Database, and even some of the CVEs Mitre assigns (e.g. on oss-security@ mailing list) aren't in the database after weeks/months, there's a huge backlog.

The good news is that for Open Source at least the DWF Project (Distributed Weakness Filing Project https://distributedweaknessfiling.org) will be addressing this and more.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.