{"id":2289,"date":"2022-08-10T16:38:30","date_gmt":"2022-08-10T20:38:30","guid":{"rendered":"https:\/\/shirishranjit.com\/blog1\/?page_id=2289"},"modified":"2022-08-17T12:16:10","modified_gmt":"2022-08-17T16:16:10","slug":"software-vulnerability-primer","status":"publish","type":"page","link":"https:\/\/shirishranjit.com\/blog1\/mlops\/mlsecops-blackduck-scanning\/software-vulnerability-primer","title":{"rendered":"Software Vulnerability Primer"},"content":{"rendered":"\n

National Institute of Standards and Technology (US Department of Commerce) has created a National Vulnerability database.<\/p>\n\n\n\n

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.\u00a0<\/p>NIST – NVD <\/cite><\/blockquote>\n\n\n\n

NVD Vulnerability Severity Ratings<\/h2>\n\n\n\n

NVD provides qualitative severity ratings of “Low”, “Medium”, and “High” for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.<\/p>\n\n\n\n

CVSS v2.0 Ratings<\/th> CVSS v3.0 Ratings<\/th><\/tr>
Severity<\/th>Base Score Range<\/th>Severity<\/th>Base Score Range<\/th><\/tr>
 <\/td> <\/td>None<\/td>0.0<\/td><\/tr>
Low<\/td>0.0-3.9<\/td>Low<\/td>0.1-3.9<\/td><\/tr>
Medium<\/td>4.0-6.9<\/td>Medium<\/td>4.0-6.9<\/td><\/tr>
High<\/td>7.0-10.0<\/td>High<\/td>7.0-8.9<\/td><\/tr>
 <\/td> <\/td>Critical<\/td>9.0-10.0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

References<\/p>\n\n\n\n