Collecting Information from CVE and MSB to write proof-of-concept

Question

I am currently interested in knowing how to write some proof-of-concept code for recent vulnerabilities that are released every month by the CVE and Microsoft Security Bulletin.

These websites list that vulnerabilities have occurred but they don't explain how the vulnerability works. For example Microsoft Security Bulletin has a very generic line describing how the vulnerability works-:

specially crafted Microsoft Word file

This doesn't give any information how the flaw works. CVE is also limited. I don't get the why information is not provided since the patch has already been released.

Are there resources anywhere on the web where I can get to know how recently released vulnerabilities work ?

Answer 1

When exploits are first posted on CVE or others, the exploit discoverer usually provides code/description/POC to the vendor of the affected product.

This allows them to build a fix or patch.

If the information was provided publicly, it would allow any attacker to build an exploit.

The information posted publicly is enough to let sysadmins understand what they need to do immediately, before a patch becomes available.