5 ms·

Take a look at some of the links on this page: https://security-tracker.debian.org/tracker/CVE-2016-4448 https://security-tracker.debian.org/tracker/CVE-2016-4

Take a look at some of the links on this page: https://security-tracker.debian.org/tracker/CVE-2016-4448 https://security-tracker.debian.org/tracker/CVE-2016-4448

KajMagnus 10y ago
Thanks! This gives me the impression that the NVD RSS feed, or alternatively the cve.mitre.org changelog (they contain the same vulns, I think), is an okay vuln list to monitor, and that that one alone will be enough, now initially, when getting started. Because: The main source mentioned on the Debian tracker, seems to be cve.mitre.org. And at cve.mitre.org, there's this page: cve.mitre.org/cve/data_updates.html which recommends NVD or MITRE's own change log. More things that came to my mind, when looking at the sources linked from the Debian tracker: - NVD: lots of details on the vulnerability. In a format that looks easy to parse for a web scraper. - LWN.net: There's an email about the vuln, but it seems time consuming to read it and understand what to do with it (the email). - Vulnerability Notes Database (CERT): Found nothing about the vuln. - Exploit Database: Nothing. - Metasploit: Nothing. - Red Hat / Ubuntu / Gentoo /SuSE / Mageia feels a bit too distro specific to monitor now initially. - Full Disclosure & Bugtraq: Nothing, vs "too many" detailed emails, sometimes about individual product versions. B.t.w. how kind of security-tracker.debian.org to include all those Source links :-) Ok, initially, it'll be NVD's RSS feed, or MITRE's change log, e.g.: https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08.html https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08.... + some other Git repositories not yet popular enough (?) to be included by MITRE, and some Javascript + Java & Scala stuff that I use.
- ashitlerferad 10y ago
  Some more possible sources: https://anonscm.debian.org/viewvc/secure-testing/check-external/sources.ini?view=markup https://anonscm.debian.org/viewvc/secure-testing/check-exter...
  - KajMagnus 10y ago
    Thanks, via that link I found: https://nodesecurity.io/advisories https://nodesecurity.io/advisories which is what I was hoping for (for client side vulns). Not all the vulns in that advisory list get CVE numbers, so that list should be monitored in addition to CVE/NVD. And to me those JS vulns are important, for example, there was recently an XSS bug in a HTML sanitizer I'm planning to use. (I actually went to https://nodesecurity.io/ https://nodesecurity.io/ a while ago, looking for a vulnerabilities feed, but didn't see / react-to the Advisories link at the top of the page, so I thought they didn't have any advisories list, or vuln feed.) (The other lists seem to get CVE numbers (and will thus be included in MITRE and NVD, right). Or if they don't, they seem a bit too niche right now + I don't use them myself, so I'll skip them, for now.)
ahazred8ta 10y ago
The Distributed Weakness Filing (DWF) Project covers vulnerabilities which are not tracked by the main CVE system. https://github.com/distributedweaknessfiling/DWF-Database https://github.com/distributedweaknessfiling/DWF-Database
- KajMagnus 10y ago
  Ok, thanks for mentioning it. I'm getting the impression that almost all DWF entries in the end get a CVE number? Looking on this page: https://github.com/distributedweaknessfiling/DWF-Database/blob/master/DWF-Database-2016.csv https://github.com/distributedweaknessfiling/DWF-Database/bl... , I don't see any entry without a CVE number (except for some at the top, but they're in some 'REPLACED' status). I'll probably skip this source, at least initially — seems a bit much work, to somehow analyze the DWF files, in order to find only a small (?) number of additional vulns.

Take a look at some of the links on this page: https://security-tracker.debian.org/tracker/CVE-2016-4448 https://security-tracker.debian.org/tracker/CVE-2016-4448

KajMagnus 10y ago

Thanks! This gives me the impression that the NVD RSS feed, or alternatively the cve.mitre.org changelog (they contain the same vulns, I think), is an okay vuln list to monitor, and that that one alone will be enough, now initially, when getting started. Because: The main source mentioned on the Debian tracker, seems to be cve.mitre.org. And at cve.mitre.org, there's this page: cve.mitre.org/cve/data_updates.html which recommends NVD or MITRE's own change log. More things that came to my mind, when looking at the sources linked from the Debian tracker: - NVD: lots of details on the vulnerability. In a format that looks easy to parse for a web scraper. - LWN.net: There's an email about the vuln, but it seems time consuming to read it and understand what to do with it (the email). - Vulnerability Notes Database (CERT): Found nothing about the vuln. - Exploit Database: Nothing. - Metasploit: Nothing. - Red Hat / Ubuntu / Gentoo /SuSE / Mageia feels a bit too distro specific to monitor now initially. - Full Disclosure & Bugtraq: Nothing, vs "too many" detailed emails, sometimes about individual product versions. B.t.w. how kind of security-tracker.debian.org to include all those Source links :-) Ok, initially, it'll be NVD's RSS feed, or MITRE's change log, e.g.: https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08.html https://cassandra.cerias.purdue.edu/CVE_changes/CVE.2016.08.... + some other Git repositories not yet popular enough (?) to be included by MITRE, and some Javascript + Java & Scala stuff that I use.

ashitlerferad 10y ago
Some more possible sources: https://anonscm.debian.org/viewvc/secure-testing/check-external/sources.ini?view=markup https://anonscm.debian.org/viewvc/secure-testing/check-exter...
- KajMagnus 10y ago
  Thanks, via that link I found: https://nodesecurity.io/advisories https://nodesecurity.io/advisories which is what I was hoping for (for client side vulns). Not all the vulns in that advisory list get CVE numbers, so that list should be monitored in addition to CVE/NVD. And to me those JS vulns are important, for example, there was recently an XSS bug in a HTML sanitizer I'm planning to use. (I actually went to https://nodesecurity.io/ https://nodesecurity.io/ a while ago, looking for a vulnerabilities feed, but didn't see / react-to the Advisories link at the top of the page, so I thought they didn't have any advisories list, or vuln feed.) (The other lists seem to get CVE numbers (and will thus be included in MITRE and NVD, right). Or if they don't, they seem a bit too niche right now + I don't use them myself, so I'll skip them, for now.)

ahazred8ta 10y ago

The Distributed Weakness Filing (DWF) Project covers vulnerabilities which are not tracked by the main CVE system. https://github.com/distributedweaknessfiling/DWF-Database https://github.com/distributedweaknessfiling/DWF-Database

KajMagnus 10y ago
Ok, thanks for mentioning it. I'm getting the impression that almost all DWF entries in the end get a CVE number? Looking on this page: https://github.com/distributedweaknessfiling/DWF-Database/blob/master/DWF-Database-2016.csv https://github.com/distributedweaknessfiling/DWF-Database/bl... , I don't see any entry without a CVE number (except for some at the top, but they're in some 'REPLACED' status). I'll probably skip this source, at least initially — seems a bit much work, to somehow analyze the DWF files, in order to find only a small (?) number of additional vulns.