Shawn Harvey’s Post

CVE_Prioritizer is a powerful tool that helps you prioritize vulnerability patching by combining CVSS, EPSS, and CISA's Known Exploited Vulnerabilities. It provides valuable insights into the likelihood of exploitation and the potential impact of vulnerabilities on your information system. https://lnkd.in/gvAVm4Pg #informationsecurity #github #cve #cisa

Vulnerability management is tough duty This article enumerates deficiencies in relying on a single, government-funded repository for vulnerability intelligence. The private sector is a better option. "The danger in having a central database of vulnerabilities is that it focuses attention on the content. ‘Vulnerabilities and their details can be found here.’ By implication, if a vulnerability isn’t included, it isn’t a vulnerability. This is simply wrong. Threat intelligence firm Flashpoint noted in March 2024 it was aware of 100,000 vulnerabilities with no CVE number and consequently no inclusion in NVD. More worryingly, it said that 330 of these vulnerabilities (with no CVE number) had been exploited in the wild."

CVE_Prioritizer is a powerful tool that helps you prioritize vulnerability patching by combining CVSS, EPSS, and CISA's Known Exploited Vulnerabilities. It provides valuable insights into the likelihood of exploitation and the potential impact of vulnerabilities on your information system.

Tired of Constant CVE Alerts? Build a Zero-CVE Strategy! 🔥 In this blog post by Kunal Verma, we'll learn how to create a robust defense against vulnerabilities and put an end to CVE fatigue. Embrace a more secure environment with practical insights and strategies! Read now 👇 https://lnkd.in/gUG76Dkc #CVE #ZeroCVE #DevSecOps

Streamline vulnerability patching with CVSS, EPSS, and CISA's Known Exploited Vulnerabilities. Prioritize actions based on real-time threat information, gain a competitive advantage, and stay informed about the latest trends.

Have you guys seen this CVE prio tool? Looks useful: Streamline vulnerability patching with CVSS, EPSS, and CISA's Known Exploited Vulnerabilities. Prioritize actions based on real-time threat information, gain a competitive advantage, and stay informed about the latest trends. Kudos Mario R.

Here are some excellent and practical recommendations from CISA to help your organisation to mitigate path traversal vulnerabilities https://lnkd.in/d_qERHJt

The headline is a bit alarmist, but a good time to remind you to: ▶️ review the required patches ▶️ perform your risk assessment ▶️ test your patches in a controlled environment ▶️ then roll out across the network It's important to note that just because a patch is not critical or important doesn't mean that I doesn't need to be installed. Many exploits are chained that take advantage of lower risk vulnerabilities first then escalate the attack. https://lnkd.in/eNve_eF6

Keeping up to date with all the latest vulnerabilities and patching your assets is getting harder, especially when you are running a business. According to data from Tenable, some of the top vulnerabilities from 2023 were going months without being remediated. If you want to read more about the prevalence of exploitable vulnerabilities in the wild, click here 👇

Look into your environment and check whether these 3 vulnerabilities exist or not. If they do, no matter whether their CVSS score is 1 or 10, or whether severity rating is medium/ low/ High, Patch it right away. Why Patch right away, because attackers are actively exploiting these vulns.