4.3dVulnerability Analysis (CVE/CVSS)15

False positive (precise definition)

A reported vulnerability that, upon investigation, doesn't actually exist. A real but low-severity finding is NOT a false positive, just a low-priority true finding.

False negative

A real vulnerability exists but the scanner failed to detect it; doesn't appear in the report at all. Worse than a false positive because it creates false confidence.

Signature updates

Keeping the vulnerability scanner's detection database current, minimizing both false positives and false negatives.

National Vulnerability Database (NVD)

NIST's database at nvd.nist.gov, synchronized with the CVE list, hosting CVSS scores for known vulnerabilities.

CVSS (Common Vulnerability Scoring System)

Standardized 0-10 severity score for a vulnerability; 10 is most critical. Multiple versions exist (2.0, 3.x) and scores can differ between them.

CVE database (MITRE)

The canonical vulnerability list at cve.mitre.org, cross-referenced with NVD and vendor-specific databases.

CVE vs CVSS

CVE is the name/identifier of a vulnerability. CVSS is its severity score, 0-10. A CVE entry typically has a CVSS score attached.

Vendor-specific vulnerability databases

Manufacturers like Microsoft or D-Link maintain their own vulnerability disclosures beyond the general CVE list.

Vulnerability scan scope

Scanners cover multiple categories: desktop and mobile applications, web applications, and network infrastructure devices, each with their own CVE examples.

Exposure factor

Percentage representing how much impact a vulnerability would have if exploited in your specific environment, e.g. 50% service disruption or 100% complete outage.

CVSS vs exposure factor

CVSS is a generic, standardized severity score, the same for everyone. Exposure factor is the organization's own calculation of impact in its specific environment.

Environmental context (patch prioritization)

The same vulnerability matters more or less depending on where it lives, e.g. a public-facing cloud system versus an isolated lab system.

Prioritization factors

User count and type, internal versus external facing, criticality or revenue-generation of the system, and ease of exploitation all inform patch priority beyond CVSS alone.

Risk tolerance

How much risk an organization is willing to accept by leaving a vulnerability unpatched while testing occurs.

Patch testing tradeoff

Immediate patching risks breaking production; thorough testing risks prolonged exposure. Organizations balance based on risk tolerance and how easily/widely exploitable the vulnerability is.