I am conducting a study about the different vulnerability disclosure policies in an effort to determine how long it takes for a given vendor to issue a fix/patch, depending on how a given vulnerability was disclosed. The problem is, I have a hard time to identify "fully disclosed" vulnerabilities (vendor was not notified prior to public disclosure). It seems that responsible disclosure is the norm nowadays, to the point that when a security researcher does not notify the vendor and fully discloses a vulnerability, people go crazy about it (this tweet and all the articles that followed). Note that I am not an advocate of either policies, I am simply conducting research as objectively as possible.
Does anybody know if it is possible to retrieve all vulnerabilities that were published following a full disclosure policy? Maybe someone out there has done this apparently tedious work and is willing to share it :) Or there is a website / tool that I don't know about that does just that.
If not, I guess I would have to look at each vulnerability entry (for a given vendor, of course), analyze the disclosure timeline (if any), find out when the patch was issued, and if vulnerability disclosure and patch release turn out to be on the same day --> responsible disclosure, and if patch release is on a later date --> full disclosure (or the vendor went past the 45 days deadline from CERT, for instance). Time consuming? Definitely. Realistic? Probably not. But would the results be accurate in your opinion?