Vulnerability Database
What is Vulnerability Database?
A repository of known security vulnerabilities with details including severity ratings, affected systems, and available patches or workarounds.
Terms that appear alongside vulnerability database
Each of these is named in at least one of the same controls as vulnerability database. The number is how many controls name both.
- vulnerability 6 shared controls
- enisa 3 shared controls
- vulnerability disclosure 2 shared controls
- asset discovery 2 shared controls
- vulnerability scanning 2 shared controls
Frameworks that govern vulnerability database
What the standards actually require on vulnerability database
Requirements naming vulnerability database across 6 standards, quoted from the control text.
Requires each Member State to designate a CSIRT as coordinator for coordinated vulnerability disclosure, acting as trusted intermediary between finders and vendors, and requires ENISA to develop and maintain the European vulnerability database.
nis2-directive::Art.12 · Coordinated vulnerability disclosure and a European vulnerability database →A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
ISM-1808 · A vulnerability scanner with an up-to-date vulnerability database is used for vulnerabilit →An automated method of asset discovery is used at least fortnightly. A vulnerability scanner with an up-to-date vulnerability database is used.
E8-PATCHOS-ML1 · Patch Operating Systems (ML1) →Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;
JP-FSA-CYB-Vulnerability-Management-Patching-CVE-Risk-Based-Prioritisation-Penetration-Testing-Red-Team · Japan FSA Cybersecurity Vulnerability Management + Patching + CVE Tracking + Risk-Based Prioritisation + Penetration Testing + Red-Team + Bug Bounty + Coordinated Vulnerability Disclosure + Zero-Day Response →Verify that third party and open source components meet the same security requirements applied to in house code. Use static analysis, dependency analysis, and known vulnerability databases to support the decision.
SP800-218-PW.4.4 · Verify Acquired Components Meet Security Requirements →Operate dependency management per OpenSSF Scorecard checks Dependency-Update-Tool + Pinned-Dependencies + Vulnerabilities. Dependency Update Tool Active must (a) verify Dependabot + Renovate + or equivalent is configured + (b) maintains dependency update PRs +...
OSSFSC-2 · Dependency Management, Pinning, Updates, Vulnerability Tracking →Questions people ask about vulnerability database
What is Vulnerability Database?
Why is Vulnerability Database important for compliance?
Which compliance frameworks address Vulnerability Database?
Where can I learn more about Vulnerability Database?
See how Vulnerability Database applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.