PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Taking platform support for CVSS to the next level

bugcrowd.com | blog | #vulnerability-management | #bugcrowd | #vrt | #cvss | #vulnerability-scoring | #platform-features
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd now supports custom CVSS v3.1 to VRT mappings. Assigning a CVSS score prefills the matching P1-P5 VRT severity, standardizing how security teams prioritize vulnerabilities.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
Consistency is Key: Aligning Bugcrowd’s VRT with CVSS
Bugcrowd now maps its Vulnerability Rating Taxonomy to CVSS v3, auto-suggesting CVSS scores on validated submissions; VRT 1.3 adds a Broken Access Control category aligned with OWASP Top 10 2017.
blog · borghq.io
How to Prioritise Security Findings That Have No CVE
CVSS, EPSS and KEV are all built around published CVEs, so they cannot score findings in your own application code. This practical guide shows how to rank exploitable issues like tenant boundary flaws in a continuous testing queue.
blog · jfrog.com
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
JFrog researchers show how CVSS overstates risk using JavaScript prototype pollution as a case study — Axios gadget chains included — after reassessing 96% of NVD criticals as lower severity.
vulnerability · bugcrowd.com
Bugcrowd’s VRT 1.2 Introduces Market Aligned Updates and Easy Integration via a Ruby Gem
Bugcrowd releases VRT 1.2 — GET-based open redirects move to P4, weak password policies to P5 informational — and packages the taxonomy as a Ruby gem for easy integration into vulnerability workflows.
vulnerability · hackerone.com
What Is The Common Vulnerability Scoring System (CVSS)
Overview of CVSS, the FIRST-managed open standard for rating vulnerability severity: base metrics like attack vector, complexity and privileges required, and how scores guide patch priorities.
blog · bugcrowd.com
Behind the scenes of PHP2Shell: What the last 72 hours taught us
PHP2Shell hit fast. Bugcrowd’s CISO shares what 72 hours of response taught us, plus three lessons for CISOs facing the next critical vulnerability.
Back