CVE: The memory for vulnerabilities

The impact of security threats is usually more serious if they remain undetected. Without being reported or publicised, security vulnerabilities are practically invisible. For around 20 years, the CVE system (Common Vulnerabilities and Exposures) has been helping to identify and categorise cyber vulnerabilities – a reliable tool in our daily work.

What is a CVE?

The CVE industry standard was launched in 1999 to create globally unique designations for known vulnerabilities and security gaps in IT systems.
This cross-manufacturer list makes it possible to share information on threats and security vulnerabilities.

The CVE catalogue is managed by the non-profit MITRE Corporation, which, together with the USCISA and the Japanese JPCERT/CC, is authorised to assign unique CVE numbers. Researchers, manufacturers and security companies report discovered vulnerabilities to so-called CNAs (CVE Numbering Authorities), which check them and add them to the list if they are suitable.

Supplementary organisations such as the National Vulnerability Database (NVD) expand the CVE data with additional information, such as a risk classification.

A CVE dataset comprises

• CVE ID (prefix “CVE”, year of discovery, consecutive numbering – e.g. CVE-2021-123456)
• Short description of the vulnerability
• References to further information

The increase in vulnerability reports

For over a decade, the number of reported vulnerabilities in the NVD remained largely stable, with annual fluctuations of 10-20%. in 2017, however, the number doubled compared to the previous year. Since then, it has risen continuously.
The reasons for this are presumably:

• Greater coverage of software products
• More recognised classes of programming errors and security risks
• Preventive use of CVEs

In addition to structured recording and a common technical language, CVEs are also used for preventive monitoring of systems and applications. They appear in release notes and provide the basis for test scripts to specifically check installed software versions for known security vulnerabilities – often across platforms, e.g. if software has the same vulnerability under Windows and Linux.

Vulnerability scanning at CONVOTIS

CVE data is an integral part of our daily security work. We regularly check all hosted systems on three levels:

1. External tests via the Internet – including upstream systems such as DDoS protection, firewall, WAF, load balancer
2. Internal tests within each network zone, e.g. applications in a DMZ
3. Local tests using scripts – comparison of installed software packages with inventory lists

All findings are reported internally and externally. Patching is carried out in accordance with the respective specifications. In the case of PCI/DSS systems, we are obliged to apply critical patches within 30 days.

Our Vulnerability Scanning as a Service(VSaaS) is open to all interested parties – regardless of whether they are already CONVOTIS customers or purchase other services from us.

Security starts with transparency

The structured recording of vulnerabilities through CVEs creates clarity and enables rapid action. Companies benefit from a standardised language, clear processes and the ability to close security gaps at an early stage.

With regular scans and consistent patch management, you significantly reduce the risk of successful attacks.