Feb 22, 2025
Has CWE Jumped the Shark?
seen from Macao SAR China
seen from New Zealand
seen from United States
seen from United States
seen from Australia
seen from United States
seen from Brazil
seen from United States
seen from United States
seen from Bangladesh
seen from United States
seen from United States
seen from Brazil
seen from United States
seen from United States
seen from South Korea
seen from Mexico
seen from China
seen from Germany
seen from United States
Has CWE Jumped the Shark?
Known Exploited Vulnerabilities (KEV) Thoughts - Part Two
This is part two of my thoughts on Known Exploited Vulnerabilities (KEV), and where it gets a lot more interesting! Please see the first blog before starting here. Automation / Eagerness To Add Reading vulnerability disclosures can be a grueling mission full of frustrations. Poorly written advisories, missing technical details, and errors make the life of a disclosure analyst exhausting (Want…
Will the Real 300,000 Stand Up?
Will the Real 300,000 Stand Up?
On September 27, 2022, Flashpoint’s VulnDB hit the 300,000th entry added to the database. Think about that and .. wow. I started the adventure of collecting vulnerabilities around 1993, back when it was all flat text files, and my hacker group used a FILES.BBS file as an index, pointing to many hundreds of other text files, each with one vulnerability. At the time our collection was impressive;…
View On WordPress
Commentary on Trend Micro's Linux Threat Report 2021
Commentary on Trend Micro's Linux Threat Report 2021 (cc @TrendMicro)
On August 23, 2021, Trend Micro released a report titled “Linux Threat Report 2021 1H” by Magno Logan and Pawan Kinger. The report is based on Trend Micro’s Smart Protection Network (SPN) which they call “the data lake for all detections across all Trend Micro’s products“. Basically, every security product they make that detects vulnerabilities and reports them back to Trend Micro can and is used…
View On WordPress
Perlroth and the History of Microsoft Vulns
Perlroth and the History of Microsoft Vulns
While reading “This Is How They Tell Me The World Ends“, early in the book I ran across a single line that made me double-take. I took a note to revisit it after a complete read since it was so early in the book. For those familiar with my blogs, I tend to write about vulnerability statistics and this one fits the bill. This blog is a bit different in that a single line provoked it, but…
View On WordPress
The Rundown: CVE IDs, Meanings, & Assumptions
The Rundown: CVE IDs, Meanings, & Assumptions
For almost two decades, CVE has been considered an industry standard for vulnerability tracking. A CVE ID can be affiliated with many vulnerabilities, in a format like CVE-2014-54321. Note my choice in ID, from 2014 with a consecutive set of numbers. That is because I specifically chose a ‘sample’ CVE that was set aside as an example of the CVE ID Syntax Change in 2014. This change occurred when…
View On WordPress
Vulnerability Counts Are a Moving Target
Vulnerability Counts Are a Moving Target
At the end of each year, we see articles covering how many vulnerabilities were disclosed the prior year. Because the articles are written about the same time of year, it gives a fairly good initial comparison from year to year; at least, on the surface. This is the foundation of statements such as “Security vulnerabilities in critical infrastructure up 600%”. My company, Risk Based Security,…
View On WordPress