Add support for Microsoft vulnerabilities and CVRF

[pombredanne]

MSFT releases their vulnerabilities using this CVRF format https://www.icasi.org/cvrf/

See https://github.com/Microsoft/MSRC-Microsoft-Security-Updates-API for details

@mschiffm https://github.com/mschiffm/cvrfparse is a library to likely handle this alright

[pombredanne]

See also the updated pointers for CVRF in https://github.com/nexB/vulnerablecode/issues/62#issuecomment-535420939

[sbs2001]

These are closed source vulnerabilities, isn't that out of scope of vulnerablecode ?

[haikoschol]

Microsoft ships quite a bit of OSS code these days. Having said that, I don't know whether this feed makes sense for VulnerableCode. Someone needs to do the research on it. :)

[sbs2001]

The data from the CVRF is basically https://portal.msrc.microsoft.com/en-us/security-guidance , majority of the vulnerabilities are of closed source Microsoft products like IE, Paint ,Windows etc. The only value these have are about .net vulnerabilities.

[pombredanne]

There is value in these after all. See ttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41032 It has unique information on affected NuGet versions that are not available elsewhere.