REST API Access to NVD at NIST

NVD - National Vulnerability Database

NIST - National Institute of Standards and Technology

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.

There is a vulnerability API access to query NVD directly. It is available at Vulnerability API documentation. An example to retrieve CVE information in JSON format can be access at:

https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-1388

At the vulnerability metrics page, NVD is providing 2 CVSS calculators: CVSS_v2 and CVSS_v3.1 calculator, for product integration. For examples:

https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=CVE-2022-1388

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-1388

Links:

• https://nvd.nist.gov/
• https://nvd.nist.gov/developers/vulnerabilities
• https://nvd.nist.gov/Vulnerability-Metrics/Calculator-Product-Integration

Risk vs. threat vs. vulnerability

Here's a short article to explain very well the difference between risk, threat, and vulnerability.

Risk is the potential for loss, damage or destruction of assets or data caused by a cyber threat.

Threat is a process that magnifies the likelihood of a negative event, such as the exploit of a vulnerability.

Vulnerability is a weakness in your infrastructure, networks or applications that potentially exposes you to threats.

Links:

• Risk, Threat, or Vulnerability? How to Tell the Difference

20 Alerts for F5

Just received 20 alerts about vulnerability update for F5 this morning. All of them are old CVE update and related to nginx package.

opencve.io

Updated CVE list:

1. CVE-2016-0746     (cvss 9.8)    
2. CVE-2017-20005   (cvss 9.8)
3. CVE-2014-0088
4. CVE-2013-4547        
5. CVE-2009-2629        
6. CVE-2014-0133        
7. CVE-2013-2028        
8. CVE-2013-0337
9. CVE-2012-2089        
10. CVE-2009-4487        
11. CVE-2011-4315        
12. CVE-2014-3556        
13. CVE-2013-2070        
14. CVE-2009-3896        
15. CVE-2011-4963        
16. CVE-2010-2263        
17. CVE-2010-2266        
18. CVE-2012-1180        
19. CVE-2009-3898        
20. CVE-2014-3616