A piece of software and or hardware designed to detect the presence of vulnerabilities in an IT system.

learn more… | top users | synonyms

0
votes
2answers
25 views

Vulnerability management solution evaluation criteria

We are planning for a vulnerability management solution, so I am looking out for evaluation criteria between the well known solutions like Nessus, Qualys and Nexpose. If anyone could share such ...
2
votes
1answer
591 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
-1
votes
1answer
109 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their customers....
1
vote
0answers
159 views

Can I use OpenVAS to keep up with Cisco security advisories?

I'm assuming this question is more security-centric so I'm posting it here instead of server fault. I'm new to automated vulnerability scanning and I'm trying to wrap my head around what OpenVAS does ...
1
vote
0answers
67 views

Matching vulnerabilities with upstream versions

How am I supposed to match vulnerabilities with services fingerprint, with string like these? Is there a public database to match these versions with original versions? > 5.5.29-0ubuntu0.12.04.1 &...
1
vote
0answers
302 views

Tomcat 7 and ETags

I recently got updated by InfoSec that we need to be careful about ETags using Apache WebServer (HTTPD) as they reveal inode and can be exploited especially in NFS etc. But I am moving to Tomcat 7. ...
0
votes
0answers
21 views

Where can I find the w3af attack plugins?

I am reading the documentation of w3af (a famous and very practical program to scan web servers for vulnerabilities). There I read that there is type of plugin called "attack plugins", but I can't ...
0
votes
0answers
32 views

Is there a way to link STIGs to CCEs?

A federal customer sent us a list of vulnerabilities for one of our RHEL6 systems that was generated by the Security Content Automation Protocol (SCAP) Compliance Checker (SSC). The findings are ...
0
votes
0answers
136 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
0
votes
0answers
90 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...