In this case, I have a list of names and versions, but not access to any source code or binaries. E.g.
- ComponentA 2.6.6
- ComponentB 1.1
- ComponentC 0.12
The list is more than 300 components long, so an automated process would be preferred :-)
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There are a number of solutions here, depending upon the types of components involved. Are these code dependencies? Are they open source? If not, how well-used are they? If they aren't code dependencies, what types of software are they?
All of these questions point to different areas to look. To start with, I'd recommend familiarizing yourself with NIST's and MITRE's CVE databases. They're both great. For scanning tools, check out OWASP's list of vuln scanners, which might point you in the right direction.
For more detailed help, let us know more about the types of components involved so that we can give more guidance. This particular question defines an entire industry of software and subfield of cybersecurity, so without more detail the answer is going to be pretty broad.