vulnerablecode
vulnerablecode copied to clipboard
nexB
A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase...
The code at https://github.com/nexB/vulnerablecode/blob/3b3ea6d3e3a64a8504733c9fe5298f8d4734993b/vulnerabilities/importers/github.py#L116 needs some love. 1. npm has a namespace. 2. we should avoid if possible to single out a list of package type 3. golang may have...
The commit that **fixed** the vulnerability should also be included in the information provided. Anything that can lead to a [diff](https://git-scm.com/docs/git-diff) is valuable. This includes links to commits, pull requests...
We need a way to score the reliability of advisories, since multiple advisories for the same vulnerability may differ in significant details. First step is to identify the scoring criteria,...
Here's an example I retrieved from a VCIO UI query for `VCID-rxj4-rqm2-aaaf` (https://public.vulnerablecode.io/vulnerabilities/VCID-rxj4-rqm2-aaaf?search=VCID-rxj4-rqm2-aaaf) where the only difference is the presence or not of a trailing `/`: 
Temurin/Adoptium release notes document CVEs fixed per release. Some examples are: - https://adoptium.net/blog/2024/01/eclipse-temurin-8u402-11022-1710-and-2102-available/ - https://adoptium.net/blog/2023/08/eclipse-temurin-8u382-11020-1708-and-2002-available/ I could not find a list of "open" vulnerabilities
See also https://www.eclipse.org/security/known/
We've developed a private script that takes an SBOM/PURL inventory as input, vets the PURLs with the VulnerableCode DB, and outputs a vulnerability report as a `.xlsx` file. We plan...
While @pombredanne and I were reviewing the VCIO UI, it became clear that some of the data displayed in the `Fixed by packages` tab of the `Vulnerability details` page --...
I noticed recently when working with a range of PURLs and vulnerabilities that: - the content of the VCIO UI `summary` field (afaict this applies equally to the API responses)...