2

I'm really interested in IT security and I would like to know how vulnerability reports work.

Is there a central database for those things? I often see CVE-XXX-XXX on disclosures, but I don't understand very well how the numbering works and which database keeps the information about that report.

What should one do to publish a new vulnerability report on the internet?

  • If one of the answers is helpful to you, you can accept it. If not, you can add a comment to the answer explaining why it does not help you. – paj28 Jan 20 '14 at 21:25
1

There are several organisations that maintain vulnerability databases. NIST's NVD is probably the most notable IMO

http://nvd.nist.gov/

CVEs are software flaws - Common Vulnerability Enumeration, but there are also other prefixes used, like CCE for Common Configuration Enumerations - which are misconfiguration based issues like easily guessed default passwords, and ports exposed by default etc.

0

CVE is the closest to a central database, although they describe themselves as "a dictionary, not a database".

It's aim is to provide a unique identifier for each known security issue. Before CVE there would often be confusion because names were used, so one network scanning tool might report "Buffer overrun in Windows Server Service", while another one would report "Code execution in Windows". CVE solves this problem by giving each issue a unique identifier like CVE-2008-4250. The take up of CVE is near universal - almost all vendors and researchers will contact CVE to obtain a unique number before issuing an advisory. One thing to be aware of is that it is not completely universal.

A CVE number corresponds to a known vulnerability in a particular piece of commercial or open source software. So, "cross-site scripting" is a generic issue and does not have it's own CVE (actually, that's what CWE is for). But "cross-site scripting in Apache Roller" would get a CVE. Vulnerabilities in bespoke software (e.g. XSS in Facebook) do not normally get a CVE.

CVE itself is not a detailed database. The database holds a brief description and references to other databases. For more detailed information, good sources are: Security Focus, Secunia, NIST, and the software vendor's advisories. If you're after exploits then Metasploit and Exploit DB are good places.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.