I noticed that there are a list of Platforms/Vendors for which a CVE can be applied for.
What happens if I find a CVE for a proprietary platform (that is commercially available), is there a way to get a CVE assigned for it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Different vendors require different steps to be taken in order to get a CVE ID assigned for vulnerabilities.
If you check the MITRE CVE ID Request page here then you can follow the instructions to request an ID after locating the correct CVE Numbering Authority.
If the vendor is not specifically mentioned in any of the tables and a relevant CNA is not listed then you have to contact MITRE directly to request a CVE ID by filling out the form here.
I think the main thing here is to make sure you follow Responsible Disclosure:
Responsible disclosure is a computer security term describing a vulnerability disclosure model. It is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details.
If you just go and publish details of the vulnerability without giving the vendor enough time to put out a patch, you will actually be doing more damage than good because you will be enabling attackers to hack otherwise secure systems.
If this is your first time disclosing a vuln and it all seems a bit overwhelming then, as Ross Smith says, the MITRE organization than runs the CVE database can act as the mediator between you and the vendor.