1

I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs?

Thx

Improve this question

3 Answers 3

Reset to default
4

NVD covers a lot of vulnerabilities. Aside from those you also have:

They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities.

Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which might not get disclosed.

Improve this answer
3
  • Yeah. I have seen those websites, but does it mean that, every known vulnerabilities is assigned to a CVE number today ? Or is there a few rebels that does not want to join the CVE numbering ?
    – Vladimir Leiv
    Dec 9, 2013 at 9:11
  • 2
    @MathieuLeiv in an ideal world everyone would follow complete "full disclosure" etiquette this is unfortunatly not always the case; exploit-db.com is a good one to keep an eye on also as well as seclists.org/fulldisclosure
    – Oneiroi
    Dec 9, 2013 at 9:22
  • @MathieuLeiv If you check out exploit-db.com you will see that there are many vulns without CVEs. On the other hand, there are CVEs which correspond to multiple vulns...
    – buherator
    Dec 9, 2013 at 12:30
0

Currently the NVD only pulls from the Mitre CVE database, this will be changing, but for now if Mitre doesn't have an entry written up, it won't be in the NVD database. As for Mitre I know we (Red Hat) have assigned over a thousand CVEs that aren't in the Mitre Database, and even some of the CVEs Mitre assigns (e.g. on oss-security@ mailing list) aren't in the database after weeks/months, there's a huge backlog.

The good news is that for Open Source at least the DWF Project (Distributed Weakness Filing Project https://distributedweaknessfiling.org) will be addressing this and more.

Improve this answer
0

Just to complementing @Kurt's answer: Just as he has commented about [NIST] NVD (National Vulnerability Database) which is an U.S. government repository vulnerability database, another vulnerability database that is provided by the MITRE Corp itself is "CVEDetails.com".

Aside from MITRE Corporation and other government resources, there are several others that I not know every of them, but I will list the bests I know:

The first one is IBM XForce Exchange1. This is one of the place where you can track vulnerabilities before it is published on MITRE CVE. The other source that are not so rare to leak some receive information about whose vulnerability is SecList2 because some people that discover the software flaw chooses to send an e-mail to Seclist before announce at cve.mitre.org – it required a subscription to take the alert on your e-mail.

The another one is CXSecurity3 and Seebug.org4, where can find some exploits or their write up which most of them are published before than exploit-db.com5

The others sources are:

  • SecurityFocus 6
  • SecurityTracker7
  • PacketStorm8
  • CERT Vulnerability Notes Database9
  • Japan Vulnerability Notes10
  • WordPress Vulnerability Database11
  • Skybox Vulnerability Center12

Caution: If you want to consume some information of these vulnerabilities databases mentioned above, I recommend you read their terms of conditions before use it to avoid some trouble.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .