Where or how can I find a list of only unpatched security exploits for an out-of-support operating system? I want to be sure I can inform server owners of the actual risks of staying on an obsolete OS. I can get a list of all CVEs, but I have been unable to filter for patch status.
-
Can you filter by date? It might not be an all-inclusive list then, but it's a start. – Iszi Jul 5 '16 at 19:33
-
Cve details does not let you filter by date after the end of life, if I could find a database that does it would be helpful – Eric Jul 5 '16 at 20:19
Typically, what I do is run a Vulnerability scan on the machine. That covers more than just the unpatchable exploits and can get into things like lack of support for newer protocols or newer crypto standards.
A scan will show the list of exploits specific to that machine as well as the other weaknesses that it might be subject to.
In addition, a scanner will rank the severity of the risks, which will make it easier to communicate to stakeholders.
I know that you were asking for a database before, but a scanner contains this database, and it filters it for the specific target.
answered Jul 6 '16 at 14:24
CVE Details states there were 414 vulnerabilities reported with 98 patches. Be advised a service pack may have fixed many vulnerabilities so the numbers are not indicative of Windows 2003 still containing 316 vulnerabilities (414-98). This also could never include zero days, nor third party vulnerabilities (e.g., Adobe, JAVA, etc)
