Jump to content

National Vulnerability Database

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Madssnake (talk | contribs) at 02:07, 24 October 2022 (Added a citation). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. NVD includes databases of security checklists, security related software flaws, misconfigurations, product names, and impact metrics. NVD supports the Information Security Automation Program (ISAP).

On Friday March 8, 2013, the database was taken offline after it was discovered that the system used to run multiple government sites had been compromised by a software vulnerability of Adobe ColdFusion.[1][2]

In June 2017, threat intel firm Recorded Future revealed that the median lag between a CVE2 being revealed to ultimately being published to the NVD is 7 days and that 75% of vulnerabilities are published unofficially before making it to the NVD, giving attackers time to exploit the vulnerability.[3]

In addition to providing a list of Common Vulnerabilities and Exposures (CVEs), the NVD scores vulnerabilities using the Common Vulnerability Scoring System (CVSS)[4] which is based on a set of equations using metrics such as access complexity and availability of a remedy.[5]

See also

References

  1. ^ at 17:55, Jack Clark in San Francisco 14 Mar 2013. "Downed US vuln catalog infected for at least TWO MONTHS". www.theregister.co.uk. Retrieved 2019-10-29.{{cite web}}: CS1 maint: numeric names: authors list (link)
  2. ^ "US national vulnerability database hacked."
  3. ^ "75% of Vulns Shared Online Before NVD Publication". Dark Reading. Retrieved 2019-10-29.
  4. ^ Zhang, Su; Ou, Xinming; Caragea, Doina (2015-12-31). "Predicting Cyber Risks through National Vulnerability Database". Information Security Journal: A Global Perspective. 24 (4–6): 194–206. doi:10.1080/19393555.2015.1111961. ISSN 1939-3555.
  5. ^ "NVD - CVSS v2 Equations". nvd.nist.gov. Archived from the original on 2013-12-21.


Stub icon

This United States government–related article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=National_Vulnerability_Database&oldid=1117883408"