PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

VRT update: Doubling down on hardware vulnerabilities

bugcrowd.com | blog | #hardware-security | #firmware | #bugcrowd | #vrt | #physical-security | #vulnerability-rating | #taxonomy | #vulnerability-taxonomy
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

VRT 1.13 adds hardware-focused entries: new P2/P3 vulnerabilities under Insecure OS/Firmware (default local admin, over-permissioned and shared credentials) plus a net-new Physical Security category.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
VRT v1.10 Released: Flash downgrades and extended automotive categorization
Bugcrowd released VRT v1.10: new automotive categories from its Stellantis partnership, Flash entries downgraded to P5 after end of life, and Secure Code Warrior training mappings for remediation.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.9 with More Classifications for Credential Exposure
Bugcrowd releases VRT 1.9, adding granular Disclosure of Secrets ratings for credential exposure (P5-P1) and new SSTI, Broken Link Hijacking, Password Policy Bypass, and Flash-based CSRF entries.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.8 With New Indicators of Compromise
Bugcrowd releases VRT 1.8, adding race condition and cache poisoning entries, a new Indicators of Compromise category, and downgrading mobile clipboard findings to P5.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.7 With New Automotive Security Misconfiguration
Bugcrowd releases VRT 1.7, adding automotive security misconfiguration ratings after ~10,000 automotive submissions in a year, plus new host header token leakage (P2) and weak 2FA (P4) variants.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.6
Bugcrowd ships VRT 1.6, revising internal SSRF and email spoofing ratings: as major providers rely on DMARC, missing or p=none DMARC now rates P3/P4 thanks to researcher Jacob Wilkin.
vulnerability · bugcrowd.com
Bugcrowd’s VRT 1.5 Offers a Taxonomy Reflective of the Current AppSec Landscape
Bugcrowd ships VRT 1.5 of its open-source Vulnerability Rating Taxonomy, adding entries for common issues and finer severity granularity, and reassessing Flash-related vulnerability risk.
Back