New answers tagged

0

Getting a CVE and "releasing it" doesn't mean exploitation will happen, they'd also have to release details on the vulnerability. Also it is less then ideal to go "CVE shopping" when one CNA isn't playing nice, if that occurs please go directly to Mitre, cve-assign@mitre.org and notify them so they can poke the CNA and if no movement then hopefully Mitre ...


0

Currently the NVD only pulls from the Mitre CVE database, this will be changing, but for now if Mitre doesn't have an entry written up, it won't be in the NVD database. As for Mitre I know we (Red Hat) have assigned over a thousand CVEs that aren't in the Mitre Database, and even some of the CVEs Mitre assigns (e.g. on oss-security@ mailing list) aren't in ...


0

Just an update, this process is changing, in addition to "evidence based" CVEs there will be "request based" CVEs (to be honest it's already a practice I have done for more then a few of the 5000 CVE's I have issued, certain people I trust to make requests properly and I don't require a lot of evidence because they have a history of doing their CVE requests ...


0

CVEs are for vulnerabilities in software that is shipped and then consumed, not for vulnerabilities in services (e.g. websites). So if a vulnerability in the service (e.g. a website) is in something that is widely available as a software package (e.g. a flaw that is at its root in Apache, or PHP or WordPress for example) then the flaw within that software ...


1

Alternatively (and sadly common) it means the vendor/reporter did not provide Mitre with enough information to write a proper description of the vulnerability.


1

If the vendor in question is a CNA (CVE Numbering Authority) then when you report a vulnerability to them they should promptly assign it a CVE # (this is standard operating procedure at Red Hat). If they fail to assign it a CVE then I would advise going to Mitre at cve-assign@mitre.org. If the vendor is not a CNA then you can request a CVE from Mitre at ...


1

CVEs are for vulnerabilities in software that is shipped and then consumed, not for vulnerabilities in services (e.g. websites). So if a vulnerability in the service (e.g. a website) is in something that is widely available as a software package (e.g. a flaw that is at its root in Apache, or PHP or WordPress for example) then the flaw within that software ...


0

Try this one (https://blogs.securiteam.com/index.php/archives/2543#more-2543), the advisory shows the vulnerable code and since it's an open source product the patch is available from the vendor source code (http://www.live555.com/liveMedia/public/).



Top 50 recent answers are included