Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities · HackerPapers discussions

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities — HN submission

Sun, 19 May 2024 18:51:04 GMT

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluat

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities — mentioned by Aachen

Fri, 22 Sep 2023 13:31:29 GMT

Well that's a poor article. Not used to that from LWN at all. I think this sentence sums up most of its problems: > In fact, the pull request for the fix was attached to the report, but that apparently made little difference in the assessment from NVD. - CVEs are about vulnerabilities, not fixes. If everyone updated their software and all software updated its dependencies, I'm not sure we needed a vulnerability tracking system at all! The fix being available doesn't change the impact or exploitability of the bug while you run the out-of-date software - The text makes it sound like ratings…

Paper and discussion history. A mention is not an endorsement.

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities — HN submission

Wed, 06 Sep 2023 05:14:19 GMT

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study

1 point; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities — HN submission

Tue, 05 Sep 2023 14:27:02 GMT

Shedding Light on CVSS Scoring Inconsistencies

1 point; 1 discussion reply on HN. Paper and source history. A submission is not an endorsement.