Vulnerability Database

Every program contains bugs. Some are harmless, others allow strangers to take over a device or read out data. Such dangerous bugs are called security holes or vulnerabilities. A vulnerability database is a public directory in which such holes are collected and described. Each entry is given a unique number so that everyone involved can talk about the same hole. In addition, there is a short description, the affected program versions, and an assessment of the danger.

Why a shared number for each hole matters

Without uniform designations, security work would be chaos. A manufacturer would speak of a “bug in the network module,” a researcher of a “memory problem,” and both would mean the same thing. The best-known numbering scheme is called CVE, which stands for “Common Vulnerabilities and Exposures.” An entry then looks something like this: CVE-2021-44228. This identifier subsequently appears in advisories, update notes, and news articles.

The practical benefit lies in speed. A large company often operates thousands of servers with hundreds of programs. As soon as a new hole is published, software can automatically check which of its own systems are affected. Without a database, a human would have to check this by hand, which would take weeks. Attackers, on the other hand, often need only hours after a publication.

The aforementioned hole CVE-2021-44228 is a good example. It was located in Log4j, a tiny component for logging events that runs inside countless programs. Companies worldwide spent days searching for where this component was even built into their systems. The database provided the shared reference point for manufacturers, authorities, and media.

From discovery to entry

It usually begins with a discovery. Security researchers, employees, or independent testers discover a hole in a product. They normally report it to the manufacturer first rather than to the public. The manufacturer is then given time to develop an update. Only afterward is the hole published. This procedure is called responsible disclosure.

There are designated bodies for assigning the numbers, often the manufacturers themselves or security organizations. They review the report and register it. Large government databases such as the American National Vulnerability Database then supplement the entries with further information. This also includes the danger rating according to a scoring system called CVSS.

This system assigns values from 0 to 10. Questions evaluated include: Does the attacker need to be on the same network, or is open internet access enough? Does he need a password? What can he do? A value above 9 is considered critical and in practice means: update immediately. One distinction is important. A high value does not automatically mean the hole is already being exploited. For that, authorities maintain separate lists of actually observed attacks.

Where entries turn up in everyday life

Most often, one encounters them without noticing. When a phone reports a security update, there is almost always a list of closed holes with CVE numbers behind it. Browsers and operating systems also publish such overviews with every update. In news reports about cyberattacks, the affected hole is likewise often mentioned by its number.

In software development, vulnerability databases are firmly built in. Modern programs largely consist of third-party components, so-called libraries. Tools automatically compare this list against the databases and issue a warning as soon as a component is reported as insecure. AI systems, too, are now using such data to check code for known error patterns.

A common misconception is that a vulnerability database is a manual for attackers. In fact, the entries rarely contain ready-made attack code. The actual benefit lies on the defenders' side, since attackers exchange information about holes among themselves anyway. For users, the most important consequence remains simple: install updates promptly.