4 ms·

I always take CVSS scores with a grain of salt and assume that they could be very wrong in either direction.

• kstrauser 2y ago
  The final score is kind of a die roll, but I appreciate having at least a common vocabulary to discuss these. It also means that a given vendor can’t completely downplay they score. “Sure, it’s network accessible without authentication using wget, but we consider that a low.”
  • Avamander 2y ago
    Unfortunately now vendors can just say "we don't believe in assigning a score because the scoring system is broken" and that seems fine to some.
  • blablabla123 2y ago
    I agree, also I see this mostly as a tool. Sure there are more reports that don't necessarily have the highest quality. But just omitting those doesn't seem the correct approach.