User, contributor and developer-friendly vulnerability database. Our goal is to provide a vulnerability database which is:
Actionable, easy to read and understand for developers and sysadmins who need to fix the vulnerability
Easy to integrate by developers into any vulnerability scanner, report generator, penetration testing or related tool.
Trivial to contribute to, by using JSON and Markdown to store the vulnerabilities
This repository holds the vulnerability database itself, in order to make the information easily accessible from different programming languages these SDKs are available:
Projects using this database
We would love to receive your pull-requests!
The easiest way to contribute is:
- Browse our repository and find the JSON file you would like to edit
- Click on the top-right icon in the github UI that will open the online text editor
- Change the file
The vulnerability database supports translations and we're happy to add your native language to reach more users.
Initial data provided by the Arachni scanner project
The project founders maintain one or more vulnerability scanners, each of those tools had a different vulnerability database with different fields, formats, texts and quality. To reduce our documentation efforts we decided to commoditize the vulnerability database and created this repository.
At the beginning we tried to use the CWE data, but we found several problems with it:
The target audience for our vulnerability information is too busy to read the long descriptions and hundreds of fields provided by CWE. We want to provide enough information for the users to know what's wrong and point them to information with more detailed info if that's what they need.
The XML format storing the CWE data is simply too complex for our needs.
Mitre never answered our questions on derivated work
We might still use some paragraphs from the CWE data in our database, but manually migrated and reviewed for clarity.