Vulners – Vulnerability Intelligence

Whatever is your use-case, you can get #vulnerabilities data from the Vulners database via three distinct functional tiers: — The vulnerabilities #database with data from hundreds of sources, all normalized to a unified machine-readable format, correlated and interconnected. Download raw data and build your own algorithms to process it. — A set of #api sits on top of the database and provides an efficient way to find vulnerabilities that affect particular versions of software. Integrate APIs to power your applications with Vulners data and vulnerabilities assessment logic. — Finally, use Vulners #opensource plugins and dashboards or out-of-the-box plugins to turn standard #itautomation software into a #vulnerabilitymanagement solution.

Vulners is proud to sponsor FIRST’s #Vuln4Cast happening this October 3-4 in Utrecht, Netherlands. We look forward to connecting with fellow cybersecurity enthusiasts and professionals. Will you be joining us for this insightful event? #informationsecurity #vulnerabilitymanagement #vulnerabilityassessment https://lnkd.in/dZiTc9zv

The National Institute of Standards and Technology (NIST) National Vulnerability Database (#NVD) announced planned maintenance stating next week with possible service interruptions. However, many of you must have noticed that they have been on an unannounced hiatus starting this past Friday. Since then, over 100 new #CVE have been published — follow the link to see the list https://lnkd.in/daw9TV8R At Vulners – Vulnerability Intelligence, we get new CVE directly from the CVE Program, interlink them with vendor security bulletins if they are available, and enrich the records from the sources like Cybersecurity and Infrastructure Security Agency #Vulnrichment and FIRST #EPSS. All this data is available both via UI and API in a normalized machine-readable format. #informationsecurity #vulnerabilityassessent #vulnerabilitymanagement

Want to learn how to effectively combine #EPSS and #CTI in vulnerability prioritisation metrics? Watch our webinar with Vulners – Vulnerability Intelligence and check out the slides below! #CyberSecurity #Vulnerability #ThreatIntelligence #CVE #CISO #threatintel #threatinformed #webinar

Here is a chance to recap of our webinar with Vulners – Vulnerability Intelligence and RST Cloud, where we explored advanced strategies for prioritizing #CVE by integrating #vulnerabilityintelligence and #threatIntelligence. Dive into the slides to learn how to identify which #vulnerabilities require immediate attention and which can be safely deprioritized. Key Takeaways: • Tailored Prioritization Approaches: Discover customized methods for prioritizing vulnerabilities based on unique company profiles and industries, with a real formula example. • Real Case Studies: Gain actionable knowledge from real-world examples of successful strategy implementation for virtual patching and proactive security measures. • Understanding Vulners AI Scoring: Explore the strengths and limitations of Vulners’ AI scoring systems. • Threat Analysis with RST Cloud: Leverage RST Cloud’s Threat Intelligence for comprehensive threat analysis and vulnerability severity assessment using a real formula example. • Automation Techniques: Learn how to automate the prioritization process for enhanced efficiency and accuracy. And check out the recording to enhance your vulnerability management strategies! https://lnkd.in/dWrWyCSb #informationsecurity #vulnerabilityassessment #vulnerabilitymanagement

Tom Alrich did a thoughtful article from my hustle yesterday comment, see it here https://lnkd.in/d3vvAE9J I did this plot to add some color. Basically, it takes all the #CVE published by Microsoft #CNA that affect #WindowsServer2022, here is the list for those who want to research further https://lnkd.in/dqDwna4g All these CVE come with the specific affected version ranges, shown in the blue. Unfortunately, these ranges mostly get lost in the National Institute of Standards and Technology (NIST) #NVD data, turning into a generic CPE. If you look at the picture carefully, you'd also see that one of NVD configurations includes a wrong version (https://lnkd.in/dH4d5g43) Also, this plot clearly shows the impact of the NVD slowdown — more than 20% of the CVE don't have affected configuration in NVD at all. This example focuses on where CNA data are superior to the NVD one. Obviously, NVD adds a lot of value in numerous instances when CNAs don't bother to specify versions in a machine-readable format. And this clearly shows that you need to use both CNA and NVD data when searching for #vulnerabilities — both of those aren't perfect, but the combination helps to compensate for deficiencies. Best thing — the new version of Vulners – Vulnerability Intelligence API lets you do just that. #informationsecurity #vulnerabilityassessment #vulnerabilitymanagement

🚀 Webinar Announcement! 🚀 Join us for an insightful webinar with Vulners – Vulnerability Intelligence and RST Cloud as we explore advanced strategies for prioritizing #CVEs by integrating #ThreatIntelligence. Learn how to identify which #vulnerabilities pose real threats and how to prioritize them effectively. 🗓️ Date: July 9, 2024 🕒 Time: 11:00 CEST/UTC+2 Key Takeaways: ✅ Tailored Prioritization Approaches ✅ Real Case Studies ✅ Insights into Vulners AI Scoring ✅ Threat Analysis with RST Cloud ✅ Automation Techniques Speakers: • Kir Ermakov, CEO of Vulners • Yury Sergeev, Founder of RST Cloud Don’t miss out on this opportunity to enhance your cybersecurity knowledge! #Cybersecurity #ThreatIntelligence #VulnerabilityManagement #Webinar

Historically, Vulners – Vulnerability Intelligence maintained a single data collection to cover #CVE records, primarily sourcing data from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), with additional sources added over time. However, in February 2024, NVD ceased to be a reliable source for #vulnerabilities data enrichment. This issue was exacerbated in early May 2024, when NVD went on an unannounced hiatus for five days, halting all data updates. Given that the CVE Program #CVEList is the original source of #CNA-provided data, and with the emergence of new enriched CVE data sources like Cybersecurity and Infrastructure Security Agency #Vulnrichment, which is gaining official #ADP status, we decided it was time to rethink how we handle CVE data in the Vulners database. Take a look at our new blog post for details. https://lnkd.in/dFJtC2eF

Great to see Vulners – Vulnerability Intelligence users keep vendors accountable using data we aggregate. You'd need to remove the ')' from the link in the comment to see the bulletin on Vulners website. #informationsecurity #vulnerabilityassessment #vulnerabilitymanagement https://lnkd.in/d6JB3CPx

With the release of a new CVE Record v5.1 by the CVE Program earlier this month, enabling #CNA to provide more comprehensive data about #CVE, it may appear that the path to replace #NVD as a fundamental component of #vulnerabilities data is open. We've been looking into this problem for a few months now and share our observations in this article. Basically, it is difficult to envision any way forward to replace the value NVD had been adding to the #vulnerabilitymanagement ecosystem with the available data from CNA now. They either need to step up their game, and then the federated system can become possible. Or we'd end up again over-relying on a single entity that might pick up the baton now. #informationsecurity #cybersecurity #vulnerabilityassessment https://lnkd.in/dEd_uNCK