DependencyTrack / DependencyTrack/dependency-track
Discrepancy in vulnerabilities returned in DTrack and NVD
Open
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
We are evaluating DTrack and found a discrepancy in vulnerabilities returned for cpe:2.3:o:apple:mac_os_x:10.5.6:*:*:*:*:*:*:*
dtrack is returning 1,896 vulnerabilities while nvd shows 1,998 vulns. I have identified a couple of cvs which are missing in dtrack are showing they are MODIFIED and waiting reanalysis e.g. CVE-2007-0712.
There are 2 questions about that
1) is MODIFIED and waiting reanalysis is the reason of missing cve for above mentioned cve?
2) is there any other reason of missing cves?
3) how can we see all the cves associated to cpe?
Contributor guide
Assessment
This issue has not been assessed yet.