The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
61 views

how are CVSS scores used in security risk management products?

From CVSS v2 complete guide : "Security (Risk) Management: Security Risk Management firms use CVSS scores as input to calculating an organization's risk or threat level. These firms use ...
2
votes
1answer
45 views

How to calculate CVSS of an attack so that it matches those in CVEs?

I have drawn an attack graph for a file-sharing application (eg. Dropbox) where a database stores details of virtual machines Eg. memory space left, etc. I've listed some possible attacks: The ...
4
votes
5answers
344 views

Vulnerability scoring systems

Our company is developing a web app that is used for e-commerce. We want to establish a more formal scoring system for any security related issues eventually reported by us or by our clients. The ...
2
votes
2answers
80 views

Does the CVSS impact score correpond to probability?

From http://nvd.nist.gov/cvsseq2.htm , I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact , 0.275 for partial ...
3
votes
1answer
65 views

CVSS Temporal Data

The CVSS standard has a "temporal" component that models the changing risk associated with a vulnerability over time, such as the publication of a working exploit. But NIST's NVD doesn't provide that ...