I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities.

Is anyone aware of any comprehensive data sources aside from the NVD/CVE DB that I might use instead of relying on each library's vendor/author? The NVD is far from comprehensive, and manually searching each site is tedious, so I'm hoping to find some better method (not product or service) to approach this.

  • 1
    Black Duck has the Open Hub: openhub.net/explore/projects
    – schroeder
    Commented Apr 5, 2016 at 14:30
  • This question likely won't go anywere as it's a bit of a product recommendation (which the mods in their wisdom have decided is off-topic) with that said you could also look at source clear (srcclr.com) as I believe their product covers this kind of area Commented Apr 5, 2016 at 14:56
  • 2
    I was concerned that people might interpret it that way, but I'm trying to carefully focus on information sources, not products that ingest them.
    – Jesse K
    Commented Apr 5, 2016 at 15:26

2 Answers 2


I did something similar a while back to ensure we were keeping up with security updates. It's all manual, though: I can't help you automate it but I can tell you how long it took me and give an example of what I ended up using.

The initial setup took a couple days (we use > 75 libraries), and since then it's just been an hour or less per week to maintain it (not counting the time to actually update the libraries we use). I ended up with a matrix in a spreadsheet, with a row for each library we used. Then the columns were:

  • version we use
  • last version I checked
  • NEWS file (any issues I identified from scanning the NEWS or other readme files provided by the library)
  • CVEs (known to exist in our version)
  • latest version available from our vendor (we don't pull directly from upstream)
  • status, which says "OK" if NEWS and CVEs are empty and latest-version-checked matches latest-version-available, or I manually set it to some other status like "needs future fix" or whatever is appropriate
  • notes

I filled out the table with our libraries and their versions, then downloaded the full CVE database in text format and used a good text editor to search it for each of our applications. If there were any CVEs for our libraries I listed them in the CVE column and added notes about the version where they were fixed and/or why they applied to us (or in the case of some well-known CVEs, why they didn't).

I also skimmed the NEWS files for most of the libraries that had newer versions available than what we were using, though I gave up on that after a while when it didn't yield anything useful that wasn't already captured in a CVE.

Then I subscribed to an RSS feed of newly-categorized CVEs. It's fairly low-volume, though bursty, so when new CVEs come in I quickly scan them for issues and update my spreadsheet if there's anything that applies to us.

I also made a cron job to scan a different list of newly-filed CVEs, but that didn't seem to add any value beyond what the NVD RSS feed provided.

  • Thanks for the feedback. This is more or less what I'm currently doing. However, there are a couple of problems I've identified with this approach. More than anything else, lots of vendors/authors never get CVE IDs for their security flaws, for example this one from angular.js: github.com/angular/angular.js/pull/13453 I can't even find a mention of angular in the NVD, but there is an entry in the (new to me) srcclr: srcclr.com/security/arbitrary-code-execution-through-svg/…
    – Jesse K
    Commented Apr 5, 2016 at 17:39
  • 2
    seen cve-search/cve-search ?
    – atdre
    Commented Apr 5, 2016 at 18:58
  • cve-search looks like it might be a useful tool to automate CVE searches, but it's still shy of a comprehensive approach to the problem.
    – Jesse K
    Commented Apr 6, 2016 at 16:10

Security Tracker has a search capability to comb multiple sources for reported vulnerabilities:


Good luck!

edit: sorry, ST doesn't search eternal sites, everything is internal to ST itself. I personally use it as one information source (free version). Not sure why I'm getting down voted.

  • I didn't downvote, but I suspect it's because the OP specifically asked for a method or process, not a product, service, or website. It would also help if you added some info about where ST gets its info from. Is it just a re-hash of the CVE db, or does it pull in something else? Commented Apr 6, 2016 at 13:22
  • Do you have a method for consuming data from ST that's non-manual?
    – Jesse K
    Commented Apr 6, 2016 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .