High Vulnerability Severity (CVSS) Or What Can Actually Be Achieved

bm
bashis mcw
•May 31, 2023

Was thinking for a while in terms of vulnerabilities and their severity, do you think their highest severity is the most important thing?

I mean we may have a high or critical vulnerability, but in practice, it is maybe "only" denial of service (DoS) or access to /etc/passwd but practically not much more than that.

** ** *** **** * ****** of *************** ** ***** ******** **** low/medium/high *** ******* *** *** ** exploited ** * ***** ***** ** completely **** **** * ******.

* ****** ***** ***** **** *** be ******** **** *** *************/***************, **** do *** *****?

UI
Undisclosed Integrator #1
•May 31, 2023

**** ******* ********** **** *** *****:

*** *** **** ** **** ***** CVSS *** ************* ************** - **** | *******®

*** ******* **** ***** **** ** prioritize *********** ******* ***** **** *** fact **** *** **** **** ***** is ********* ******** ****** *** ***** of *** ************* ***** ********** – and ****** ***** ********* ********* **** initial ********** – *** ** ********* limited ** * *********** **** ** the **** * ************* ***** *********** introduce, ****** **** ** ************* ** the ****** ****** *********.

*** ****, *** *** **** ** CVSS ******

*******, *** ******* *** ********* ******** is ************ *** ******** **** ********** details. *** *******, **** ****** *** software ******* *** ****** ** ***** CVSS ******, ***** ** *** ****** of ******** ** * ********** *************. They ***** ** *** ******* *** full ***** ** ***** ******** ******** or ****** ** ****** *** ****** CVEs ** ***. **** ******* *** affect *** *** ** ************* ******* many ** *** *** *** ********** vendors **** **** **** **** ****** to ****** ***** *************** **** **** on * ***-**-*** ***** ** ***** only ******* ** *** *************; ********* both. **** ******** ******** ****** ********* sharing *** *** **** ** ************'* ability ** ******** ***** ********** ***** and * ******** **-** ************* ********.

* ******* ******* ** **** ********** where *************** **** ******** **************, ********** shared *** ******* ****** ** ************ can ** ******** **** *** ******** attack ** ***** ** ****, ***** shut **** ********** ** * ******* scale.

**** ****** ********** *** ******* ** address ****-***** ****** | *** ***** Swig

*****’* ********, ***** ******* ** ********* the ****** ** ******** **** ** open ****** ********, ********* **** ****** CVSS ****** ******* *** ** *************** the **** ***** ** *************** ******* it ***** *******, ***** ***** *******.

...

***** **** **** **** *** ******** ratings **** “**********” ** **** **** not ** ****** ** ******* ** reported. ***********, **** ** *** ******** vulnerabilities ******** ******* ************* ************ ** particular ********** *** * ********** ******.

******* ********* **** ** *** ************* firm ** **** ***** *** ** a **** ** ******* **** ********* CVE ****** ********** *******. *** *******, considering *** *********** ********** ******** ** deployed, *** ******* ***********, *** *** software ** ****, ** ******* * vulnerable *** ***** *** ** ******* untrusted **** ****** *** ** ********. The ****** ** **** ******** ******* might ****** ** *** ****** *** high ** *** ***.

***** **** ******** **** ** ** the **** ********* *************** ** **** impacting *** ********** ****** ** **** low ******** ******* *** ** *** either ******** ** * ***** ******** for ********** ** ***** *** **** source ******* *********** – ** *********** work ** ****** ******* ** (*****) entirely ***********.

(2)
Avatar
Brian Karas
•Jun 01, 2023
Pelican Zero

* ****** ***** ***** **** *** be ******** **** *** *************/***************, **** do *** *****?

* **** ** ***** *** **** way.

*** **** ******* ****** ***** ** considered ******** ******** ** ** **** of **********, ** ** ******** *** highly ************** ************ ** ***** **. decades ****.

** **, * ***** ******** ************* is *** **** *** ** ********* by ** ********* ********* ******** *** has **** ******* ** ******* ********** to *** ******* ** ********. **** we ******** ************ ** ********* **** bot *****, **** ***** ****** ********, etc., ** ******* ******** *** ******** a ****** **** ************* ** ******* greater ******* **** ******* *** **** requires ***** ******* ****** ** *******.

(1)
New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions