How to find out what vulnerabilities X product has had/has?

Question

Canonical question regarding the best way of obtaining information on what vulnerabilities X product has had/has. Other identical or significantly similar questions should be closed as a duplicate of this one. This is as per Schroeders suggestion in the following How should questions be handled that are part on-topic and part off-topic?

• What is the most effective / best method for obtaining information in regards to what vulnerabilities X device has or has had?
• Is there anything else I can do short of checking the security advisories page?
• What if there is no security advisory page where else can I go?
• What are some good resources I can use to find such vulnerabilities?

Answer 1

What is the most effective / best method for obtaining information in regards to what vulnerabilities X device has or has had?

Checking the vendor's security advisories page is always a good start, anything they know about will usually go on there. As an example, here is a link to the Cisco Security Advisories page.

---

Is there anything else I can do short of checking the security advisories page?

Yes, there is. For example, any "major" vulnerabilities will be assigned a CVE these will also be very helpful in identifying whether or not a specific product has X vulnerability or not. A good resource for this is CVE Details

---

What if there is no security advisory page where else can I go?

If there isn't a security advisory on the vendor page then a few things could be applicable.

• The vendor doesn't yet know if they are affected.
• They're not aware of the vulnerability.
• They aren't affected.

What should you do in this scenario? A good idea would be to contact the Vendors support teams. Going back to the Cisco example you could use Cisco TAC. This would be applicable to all vendors, if there is no public information on the device in question your best chance is to contact their support teams and find out.

If they are not aware of the vulnerability it would be a good idea to inform them of the issue, especially if you found it whilst doing some digging and it appears obscure. If you cannot find any resources from the vendor themselves (whether they know about it or not) inform them, I can almost safely say it will help. In the Cisco example, you could contact Product Security Incident Response Team

---

What are some good resources I can use to find such vulnerabilities?

There are a lot of websites you can use other than the ones mentioned, the two below might also be helpful as mentioned by @Elsadek.

• SecurityFocus
• ExploitDB

You could also use CVE checkers as mentioned by @Forest.

• CVECheck-Tool
• CVEChecker

Another idea might be to subscribe to a security mailing list like the one below originally mentioned by @Forest.

Open Source Security Mailing List

This specifically is quite generalised however there are ones you could use which are more specific, as I mentioned earlier you could subscribe to Ciscos for example.

Answer 2

A good strategy would be to subscribe to the security mailing list for the technology stack you are operating, this can be done via the vendor websites or using updated third party vulnerability databases like SecurityFocus and Exploits Database.

On SecurityFocus you can browse vulnerabilities history by vendor and product version.

What if there is no security advisory page where else can I go?

In this case you are probably among the users who first discovered the vulnerability, or less probably you've been accidentally informed of an undisclosed vulnerability.

In this case the only thing you have to do (if you are a good guy :)) is to contact the vendor.

Answer 3

I agree with all of the above. In addition you can use https://vulners.com/ to search for a product (even with a specific version number).

Vulners basically enumerates CVE's and vulnerability reports as well as security focused blogs and posts from across the internet. You can then search for anything that may be contained in these documents.

I started using it due to their robust API, which makes things even easier. I believe they have a method of setting up a vulnerability scanner as well.

Answer 4

There are multiple utilities which can check installed software against the public CVE database, such as cve-check-tool and cvechecker. These tools will compare your reported software versions against known vulnerable versions, but will not attempt to exploit your software. Many Linux distributions also keep a list of distribution-specific security advisories. Their package managers can often be configured to log instances when you are using software with a known security issue.

You can also look on various advisory websites. Some, like cvedetails, are easy to search through but not always up to date or complete. More vendor-specific advisories such as DSA for Debian go into more detail and are more comprehensive. You can also simply search the name and version of your software along with the word "cve" to get many relevant results. This is what I often do. Another technique is to read the security mailing list for the software or a more general security-oriented mailing list like oss-sec, which discusses vulnerabilities for popular open source software.

Answer 5

Generally, exploits are given CVE numbers which can be searched for on https://www.cvedetails.com/ you can look at exploits by vendor, by product, etc.