4 ms·

That's correct, vuls queries the package manager for installed packages, versions, and changelogs. It then compares the CVEs found in the changelogs to NVD. Th

That's correct, vuls queries the package manager for installed packages, versions, and changelogs. It then compares the CVEs found in the changelogs to NVD. There are certainly flaws in this approach; it's one of the reasons we intend to support multiple scanners. We started with vuls because clair wasn't released yet and we wanted to support more than containers.

wyldfire 10y ago
Are there any dynamic scanners that are designed like Vuls or Clair (I'm assuming they're both static)?
- jsulinski 10y ago
  I don't fully understand the question. clair does static analysis vuls uses a package manager and changelogs
  - wyldfire 10y ago
    Are there (any) dynamic analysis options available that would give a report similar in scope to clair or vuls?