Enhance support for reporting of vulnerabilities during assessments

[coderpatros]

The basic idea is to evolve the vulnerability model for things like pentest reports, bug bounty programs, etc. In particular, it would be great to have reproduction steps in a machine readable format if possible.

[stevespringett]

@psiinon, is this something you'd be interested in providing feedback on?

The general idea is to enhance existing support for specifying vulnerabilities in CycloneDX which is defined here: https://cyclonedx.org/docs/1.4/json/#vulnerabilities

Vulnerabilities in CycloneDX are capable of representing vulns for both known vulns against components (e.g. CVEs) and unknown vulns against components and services. Its the unknown and services part that we really want to expand upon.

[psiinon]

@stevespringett count me in! Is there anything to look at right now? If not then np, just ping me when there is ... or if you want to discuss options etc :)

[stevespringett]

Fantastic. Thanks @psiinon. We don't have anything just yet, but here's a question... Does something already exist that we can build upon or incorporate in some way?

[psiinon]

I'm aware of a few false starts in this area but nothing that I think is worth building on .. but I'll double check...

[jkowalleck]

re https://github.com/CycloneDX/specification/issues/119#issuecomment-1098146744 @psiinon you might want to review #200