All you wanted to know about sw vulnerabilities…but were too busy to look into
summary
CVE history dates to CVE started 1999 and records carry IDs, descriptions and CVSS scores (example: 3.1 = 8.1, 4.0 base = 7.7, base+threat = 5.2). Vulnerability metadata lives in many formats so the session maps CVEs, advisories, OSV schema + API and VEX statements to package identifiers (CPE and package URLs) and SBOMs. A demo shows Trustify ingests SBOMs, not generates them, aggregates OSV/CVE/GHSA data, indexes CycloneDX/SPDX SBOMs and surfaces per-SBOM vulnerability profiles via UI and API.
AI-written summary · about
chapters (10)
- 0:00Software vulnerability basics
- 1:25What is a CVE
- 6:19CVSS scoring system
- 9:13CVSS versions 3 and 4 explained
- 15:36CPE and PURL for components
- 19:59Software supply chain security
- 22:30Security advisories and VEX
- 24:58Aggregating vulnerability data
- 26:22Trustify vulnerability demo
- 28:32Q&A
related talks
23mHitchhikers' Guide to the Vulniverse
39mCVE 101: The Unfolding Of A Zero Day Attack
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
31mEfficient Vulnerability Management in Hierarchical Supply Chains
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
45mVEXing Open Source Security: Vulnerability Data for Everything
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks