Vulnerability and Exploit Database Management

Vulnerability and exploit databases play a fundamental role in the conversation surrounding vulnerability management. This chapter discusses some of the most notable examples, as well as their challenges and strengths and how they can be used by both vulnerability management vendors and end‐user organizations. While there are several vulnerability databases in the industry, one of the most notable examples is the National Institute of Standards and Technology's National Vulnerability Database. Some vulnerability databases take the approach of focusing on specific aspects of the software ecosystem. That is the case with Sonatype's Open Source Software (OSS) Index, which is a free catalog of open source components aimed at helping organizations identify vulnerabilities and the associated risks of specific OSS components. The Open Source Vulnerabilities schema was launched by the team at Google in 2021. In the context of the GitHub security advisories, the database makes use of a GitHub security advisories identification.