Skip to main content

CVE Database

The CVE Database provides access to comprehensive information about Common Vulnerabilities and Exposures (CVEs). This searchable database is synchronized from the National Vulnerability Database (NVD) and contains detailed information about security vulnerabilities that may affect software in your environment.

Accessing the CVE Database​

  1. Navigate to SAM in the main menu
  2. Under Vulnerability Management, click CVE Database

Understanding the CVE Database​

CVE Database

Summary Statistics​

The top of the page displays key metrics about the CVE database:

MetricDescription
Total CVEsComplete count of CVEs in the database
CriticalNumber of CVEs with CVSS score 9.0-10.0
HighNumber of CVEs with CVSS score 7.0-8.9
MediumNumber of CVEs with CVSS score 4.0-6.9
Known ExploitsCVEs with confirmed exploit code available

Search and Filters​

Use the search bar and filters to find specific vulnerabilities:

  • Search: Enter a CVE ID (e.g., "CVE-2024-1234") or keywords from the description
  • Severity: Filter by severity level (Critical, High, Medium, Low)
  • Known Exploit: Filter to show only vulnerabilities with confirmed exploits

Reading CVE Entries​

Each CVE entry in the table displays:

ColumnDescription
CVE IDUnique identifier in format CVE-YYYY-NNNNN
ScoreCVSS score from 0.0 to 10.0
SeverityColor-coded severity badge
DescriptionBrief explanation of the vulnerability
PublishedDate the CVE was first published
ExploitIndicator if exploit code is known to exist
CPEsNumber of affected products/platforms
ActionsView full details

CVSS Scoring​

The Common Vulnerability Scoring System (CVSS) provides a standardized way to measure severity:

Score RangeSeverityAction Required
9.0 - 10.0🔴 CriticalImmediate remediation required
7.0 - 8.9🟠 HighRemediate within days
4.0 - 6.9🟡 MediumPlan remediation
0.1 - 3.9🟢 LowRemediate as resources permit

Viewing CVE Details​

Click on any CVE ID or the action button to view complete details:

Vulnerability Information​

  • Full Description: Detailed explanation of the security issue
  • Attack Vector: How the vulnerability can be exploited (Network, Local, etc.)
  • Attack Complexity: Difficulty of exploitation
  • Privileges Required: Access level needed to exploit
  • User Interaction: Whether user action is needed

Affected Products​

  • List of software products and versions affected
  • CPE identifiers for each affected product
  • Version ranges that are vulnerable

References​

  • Links to vendor advisories
  • Patch information
  • Security bulletins
  • Research papers or blog posts

CVSS Vector​

The CVSS vector string breaks down the scoring:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ComponentMeaningValues
AVAttack VectorNetwork, Adjacent, Local, Physical
ACAttack ComplexityLow, High
PRPrivileges RequiredNone, Low, High
UIUser InteractionNone, Required
SScopeUnchanged, Changed
CConfidentiality ImpactNone, Low, High
IIntegrity ImpactNone, Low, High
AAvailability ImpactNone, Low, High

Using the CVE Database​

Research Vulnerabilities​

Before deploying new software or updates, search for known vulnerabilities:

  1. Search by software name or vendor
  2. Review severity levels and descriptions
  3. Check if patches are available

Investigate Alerts​

When security tools flag potential issues:

  1. Search for the specific CVE ID
  2. Understand the attack vector and impact
  3. Determine if your environment is affected

Compliance Reporting​

For security audits and compliance:

  1. Search for CVEs affecting critical systems
  2. Export findings for documentation
  3. Track remediation progress

Data Freshness​

The CVE database is synchronized from the National Vulnerability Database. The Refresh button allows you to manually trigger synchronization to ensure you have the latest vulnerability data.

Data Sources

CVE data is sourced from NIST's National Vulnerability Database (NVD), which aggregates vulnerability information from multiple sources including software vendors, security researchers, and CERT coordination centers.