SD Papers

• Working on Common Vulnerability Scoring System v3 integration
  1 August 2016, by Security Database Team

  While working on Common Vulnerability Scoring System v3 implementation, we have to make choices.
  Some of them are easy, other tricky. As we already say, CVSSv3 and CVSSv2 can be affected to the same alert, and we must keep CVSSv2 for SCAP needs, and simply because some alerts does not have CVSSv3 (old alerts).
  We must propagate the right score (and only one per alert). We cannot deal with 2 scores like the NVD, our alerts are linked (see crosslinks demo)
  Alerts CVSS scoring priority (...)

• And Prev? What does that mean?
  14 March 2016, by Security Database Team

  Some of our data providers use these small typo to explain that a vulnerability affects multiple products and specially “previous version” of a product.
  For products like google chrome, we can understand that manually reference 3,000 chrome versions could be hard work. Nevertheless, data integrity is critical! For you, and our alerting system, it’s a big miss. So we have worked hard to find an automated way to tag all versions of a product impacted by a vulnerability. It’s starting today.
  We (...)

• CVSS v3 and Updates
  6 July 2015, by Security Database Team

  It’s been a year without posting, but not without work. Attentive user has found that we have put into production some changes, like CVSSv3, CPE search, and add some API. We also have added the possibility to change your monitoring email (Business and enterprise). And yes, we also have corrected some bugs ;) Let’s now talk about them.
  Common Vulnerability Scoring System v3 As you already may know, the Common Vulnerability Scoring System v3, also know as CVSS v3 is now available on First.org. (...)

• Code improvement and security, from good to great!
  28 July 2014, by Security Database Team

  After the last big update, we have decided to go into maintenance mode and made some code cleanup and rework. Minor change for you, but big update for us.
  First of all, we have rewritten our Session Management. It’s really interesting that "Session Encryption" does not use a "standard" nor PHP a session option that encrypt into memory...
  So we start to work on our own side. But, what encryption mechanism and what PHP module?
  Some sites help us with an interesting benchmark between Mcrypt (...)

• Customize your monitored Products by adding an Environmental CVSS vector
  18 June 2014, by Security Database Team

  Yes, it’s done! Now, you an customize your monitored products and add, for each one, a CVSS Environmental Vector! But, wait! What is an Environmental Vector and what it can do for you? Simple, lower or higher the score of an Alert, based on YOUR Environment!
  The basis Starting with the base, here is the definition of the CVSS Scoring system:
  “CVSS is composed of three metric groups: Base, Temporal, and Environmental, each consisting of a set of metrics. These metric groups are described as (...)

• 58.000+ Nessus files integration and vDNA API update
  17 February 2014, by Security Database Team

  Our Team have integrated 61.240 NASL files, 58.288 Nessus exploits (without marked deprecated or empty) with 190.370+ cpes and 149.850+ "Security-database" References into our database. Integration is done automatically each day, without human interaction like usual. And off course, we have added them to each alert, alert History, CPE, Dashboard, API...
  Like the last update, we have integrated Nessus Exploits into our database. Of course, we now display exploits information in each alerts (...)

• vDNA update and Snort Rules integration
  20 January 2014, by Security Database Team

  Happy new year 2014! Our Team have integrated 30.000+ Snort Rules into our database and have improved our vDNA API. Integration is done automatically each day, without human interaction like usual Of course, we have added them to each alert, alert History, CPE, Dashboard, API...
  Like our the last update, we have integrated Snort Rules into our database. Of course, we now display Rules information in each alerts and each CPE (Product or Version). At this time, 34 049 Snort Rules. As we (...)

• vDNA Crosslinks as Christmas gift
  18 December 2013, by Security Database Team

  vDNA Crosslinks allows you to gather +80.000 Security Alerts data from Security-Database and export it as JSON format. Exports provide related Alert information. By that we mean, all alerts linked to the first one at specified depth.
  We are proud to bring you our latest creation, vDNA Crosslinks. What alerts are linked to each other ? What is the vulnerability scoring propagation? We offer this information as JSON format and have built a demo website to play with, and perhaps, give you (...)

• CVE syntax is changing
  14 December 2013, by Security Database Team

  CVE syntax is changing on January 1, 2014. Be prepared, modify and test your code. This modification is not a big deal, the last 4 fixed digits became arbitrary digits with a minimum of 4 and without a maximum.
  "The new syntax for CVE Identifiers (CVE-IDs), which was determined in a recent vote by the CVE Editorial Board, will take effect on January 1, 2014. This announcement is being made now so that users will have enough time to change their processes and software to handle the new ID (...)

• Updates and IAVM Integration
  11 November 2013, by Security Database Team

  We are continuously working to improve our database quality. For that, we have updated, again, our internal engine, corrected the OpenVAS integration, enhanced our CPE detection, updated the Microsoft and Cert hourly update, enhanced the user dashboard with some graph and more... But we also have integrated IAVM (DISA) into our database and improved our vDNA API.
  Like OpenVAS on the last update, and as we promise, we have integrated the IAVM (Information Assurance Vulnerability Management) (...)

0 10 20 30 40