Vulnerability Details

Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor.

List of Affected Code objects that describe details about code blocks identified as vulnerable.

List of software packages identified as affected by a vulnerability/vulnerabilities.

The category of a vulnerability or weakness, as reported by the source tool, such as Container Security or Open Source Security.

Describes the Common Vulnerabilities and Exposures (CVE) details related to the vulnerability.

Describes the Common Weakness Enumeration (CWE) details related to the vulnerability.

Information about the chain of dependencies related to the issue as reported by an Application Security or Vulnerability Management tool. E.g., serverless-offline -> @serverless/utils -> memoizee -> es5-ext.

The description of the vulnerability.

The time when the exploit was most recently observed.

Entity:URL_STRING
The URL of the exploit code or Proof-of-Concept (PoC).

The requirement description related to any constraints around exploit execution.

The categorization or type of Exploit. E.g., Network or Physical.

The time when the vulnerability was first observed.

Indicates if a fix is available for the reported vulnerability.

🚧 WARNING: DEPRECATED

Fix Availability has been deprecated since 1.1.0. Use the is_fix_available attribute instead.

The fix coverage, normalized to the caption of the fix_coverage_id value.

The normalized identifier for fix coverage, applicable to this vulnerability. Typically useful, when there are multiple affected packages but only a subset have available fixes.

• 1: Complete (COMPLETE)
• 2: Partial (PARTIAL)
• 3: None (NONE)
• 0: Unknown (UNKNOWN)
• 99: Other (OTHER)

Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability.

Indicates if a fix is available for the reported vulnerability.

A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update.

🚧 WARNING: DEPRECATED

Knowledgebase Articles has been deprecated since 1.4.0. Use advisory attribute instead.

The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update.

🚧 WARNING: DEPRECATED

Knowledgebase Articles has been deprecated since 1.1.0. Use the kb_article_list attribute instead.

The time when the vulnerability was most recently observed.

List of vulnerable packages as identified by the security product

🚧 WARNING: DEPRECATED

Software Packages has been deprecated since 1.1.0. Use the affected_packages attribute instead.

Group:context
The event data as received from the event source.

Group:primary
Unique identifier for the object

A list of reference URLs with additional information about the vulnerability.

List of vulnerability IDs (e.g. CVE ID) that are related to this vulnerability.

The remediation recommendations on how to mitigate the identified vulnerability.

The vendor assigned severity of the vulnerability.

A title or a brief phrase summarizing the discovered vulnerability.

Data from the source that was not mapped into the schema.

The name of the vendor that identified the vulnerability.