CVE
What is CVE?
Common Vulnerabilities and Exposures, a catalog of publicly known cybersecurity vulnerabilities identified by unique CVE ID numbers.
Terms that appear alongside cve
Each of these is named in at least one of the same controls as cve. The number is how many controls name both.
- vulnerability 18 shared controls
- cisa 7 shared controls
- policy 6 shared controls
- vulnerability disclosure 6 shared controls
- penetration testing 6 shared controls
- remediation 5 shared controls
- vulnerability scanning 5 shared controls
- mitre 5 shared controls
Frameworks that govern cve
What the standards actually require on cve
Requirements naming cve across 6 standards, quoted from the control text.
Include the root cause or CWE in published CVEs so that design flaws can be analysed across the industry, even though complete records take extra time; CISA's Stakeholder-Specific Vulnerability Categorization is referenced for vulnerability management.
secure-by-design-a-guide-for-manufacturers-cisa::DT-10 · CVE completeness →Integrate D3FEND with broader cybersecurity ecosystem and frameworks. ATT&CK-D3FEND bidirectional mappings - each D3FEND defensive technique is mapped to ATT&CK offensive techniques it counters + each ATT&CK offensive technique maps to D3FEND defensive techniq...
MITRE-D3FEND-Integration-Mapping-ATTACK-CWE-CVE-CAPEC-NIST-CSF-CIS-ISO-27001-STIX-OpenC2 · MITRE D3FEND Integration + Mapping + ATT&CK + CWE + CVE + CAPEC + NIST CSF + CIS + ISO 27001 + STIX + OpenC2 →Rank 18 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software performs an authorization check but does so incorrectly, granting access that should be denied.
CWE-863 · Incorrect Authorization →An external (unauthenticated) vulnerability scan of all internet-facing IP addresses in scope. Any high or critical CVE older than 14 days fails.
CE-PLUS.2 · External Vulnerability Scan of Internet IPs →FIRST CSIRT Services Framework v2.1 Service Area 3 - Vulnerability Management. SCOPE: discovery + tracking + remediation + disclosure of vulnerabilities affecting the constituency.
FIRST-CSIRTF-SA3-VulnMgmt · Service Area 3 - Vulnerability Management and Coordinated Disclosure →Catalogue and analyse adversary techniques and sub-techniques. ATT&CK Enterprise contains 200+ techniques + 600+ sub-techniques as of v16 (October 2024).
MITRE-ATTACK-Techniques-Sub-Techniques-200-600-T1078-T1059-T1566-T1190-T1486-Procedures-Adversary-Behaviour · MITRE ATT&CK Techniques + 200+ + Sub-Techniques + 600+ + T1078 + T1059 + T1566 + T1190 + T1486 + Procedures →Questions people ask about cve
What is CVE?
Why is CVE important for compliance?
Which compliance frameworks address CVE?
Where can I learn more about CVE?
See how CVE applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.