Tag Info

From the CVE FAQ: An information security vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. See the Terminology page for a complete explanation of how this term is used on the CVE Web site.   The intention of CVE is to be comprehensive with respect to all publicly known ...

The National Vulnerability Database offer searching the vulnerability database using the CVE number. The details include patch information as well as resource links for the available patch on the vendor's website (if patch is available). When you search a vulnerability, the details include a section called References to Advisories, Solutions, and Tools. In ...

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like: SecurityFocus: It usually references CVE. Patch status filed under "Solution". PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation". OSVDB: Has an option to search with CVE ID. Patch status filed under ...

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.

There are multiple ways to obtain a CVE. One could contact one of the CVE Numbering Authorities (CNA), an emergency response team (think CERT) or the CVE project. If the vendor of a product is listed as a CNA you must contact the vendor to obtain a CVE. Sufficient information must be provided to allow the CVE assigner to take a decision (provide the CVE, ...

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer. Copy-pasting again for easy reference: Common Vulnerabilities and Exposures project (CVE) http://seclists.org/fulldisclosure http://packetstormsecurity.org/ http://www.securityfocus.com/bid/ (BugTraq) http://www.exploit-db.com/ ...

If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet. If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.

There are two major points to make. The first is that a major strength of SELinux policy is to prevent exploitation of unknown vulnerabilities. Given that they are unknown, a CVE will not exist. The second is that permitting text relocation also permits an exploit to write and execute whatever code it would like to execute, or allows it to modify existing ...

My understanding is that issues that affect individual websites (say, an XSS on facebook) are not eligible for a CVE, though web applications are. So, an issue that only affects Facebook isn't, but an issue in a web application like WordPress would be. The application doesn't have to be popular - I once requested a CVE for an application that probably has ...

secunia makes a commercial product that does exactly what you want. "The Secunia VIM lets you create specific vulnerability management reports for different product categories across your entire IT infrastructure by filtering criteria. So you only get vulnerability alerts and intelligence relevant to your specific needs."