Towards System Security: What a Comparison of National Vulnerability Databases Reveals

Forain, Igor; Albuquerque, Robson de Oliveira; Sousa, Rafael T. de

doi:10.23919/cisti54924.2022.9820232

Cited by 3 publications

(1 citation statement)

References 21 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…И последно, NVD, CNVD, CNNVD са изследвани относно информацията, която предоставят (Forain et al 2022), но не се разглеждат възможностите за филтриране и извличане на информация за група уязвимости по определен признак, например версия на МОС.…”

Section: актуално състояние на проблемаunclassified

To the Issue of Publicly Available National Databases Containing Descriptions of Vulnerabilities for Mobile Device Operating Systems

Mechev¹

2023

math

View full text Add to dashboard Cite

The paper aims to examine publicly available vulnerability databases and their systems for assessing the severity of damage that can be caused by malware targeting mobile devices running Android or iOS. The second goal of the study is to evaluate the vulnerability detection capabilities associated with a specific version of a mobile operating system. Methods used: comparative analysis and summary. Based on the results of the application of the comparative analysis, it is established which of the national databases have better capabilities to filter the data and obtain adequate results when searching for vulnerabilities for mobile devices.

show abstract

Section: актуално състояние на проблемаunclassified

To the Issue of Publicly Available National Databases Containing Descriptions of Vulnerabilities for Mobile Device Operating Systems

Mechev¹

2023

math

View full text Add to dashboard Cite

show abstract

On NVD Users’ Attitudes, Experiences, Hopes and Hurdles

Wunder,

Corona,

Hammer

et al. 2024

Digital Threats

View full text Add to dashboard Cite

The National Vulnerability Database (NVD) is a major vulnerability database that is free to use for everyone. It provides information about vulnerabilities and further useful resources such as linked advisories and patches. The NVD is often considered as the central source for vulnerability information and as a help to improve the resource-intensive process of vulnerability management. Although the NVD receives much public attention, little is known about its usage in vulnerability management, users’ attitudes towards it and whether they encounter any problems during usage. We explored these questions using a preliminary interview study with seven people, and a follow-up survey with 71 participants. The results show that the NVD is consulted regularly and often aids decision making. Generally, users are positive about the NVD and perceive it as a helpful, clearly structured tool. But users also faced issues: missing or incorrect entries, incomplete descriptions or incomprehensible CVSS ratings. In order to identify the problems origins, we discussed the results with two senior NVD members. Many of the problems can be attributed to higher-level problems such as the CVE List or limited resources. Nevertheless, the NVD is working on improving existing problems.

show abstract

Cross-Site Scripting Attacks and Defensive Techniques: A Comprehensive Survey

Weamie¹

2022

IJCNS

View full text Add to dashboard Cite

The advancement of technology and the digitization of organizational functions and services have propelled the world into a new era of computing capability and sophistication. The proliferation and usability of such complex technological services raise several security concerns. One of the most critical concerns is cross-site scripting (XSS) attacks. This paper has concentrated on revealing and comprehensively analyzing XSS injection attacks, detection, and prevention concisely and accurately. I have done a thorough study and reviewed several research papers and publications with a specific focus on the researchers' defensive techniques for preventing XSS attacks and subdivided them into five categories: machine learning techniques, server-side techniques, client-side techniques, proxy-based techniques, and combined approaches. The majority of existing cutting-edge XSS defensive approaches carefully analyzed in this paper offer protection against the traditional XSS attacks, such as stored and reflected XSS. There is currently no reliable solution to provide adequate protection against the newly discovered XSS attack known as DOM-based and mutation-based XSS attacks. After reading all of the proposed models and identifying their drawbacks, I recommend a combination of static, dynamic, and code auditing in conjunction with secure coding and continuous user awareness campaigns about XSS emerging attacks.

show abstract

Towards System Security: What a Comparison of National Vulnerability Databases Reveals

Cited by 3 publications

References 21 publications

To the Issue of Publicly Available National Databases Containing Descriptions of Vulnerabilities for Mobile Device Operating Systems

To the Issue of Publicly Available National Databases Containing Descriptions of Vulnerabilities for Mobile Device Operating Systems

On NVD Users’ Attitudes, Experiences, Hopes and Hurdles

Cross-Site Scripting Attacks and Defensive Techniques: A Comprehensive Survey

Contact Info

Product

Resources

About