Flaw Flood Busts Bug Bank

Summary: The CVE index plans to expand its identifier syntax so it can catalog up to 999,999 vulnerabilities a year, up from the current 9,999 limit under the CVE-YYYY-NNNN format, MITRE Corp. announced. NSS Labs reported that vulnerabilities in industrial control systems grew 600 percent in 2010 and nearly doubled from 2011 to 2012, while reports from iDefense's Vulnerability Contributor Program and HP Tipping Point's Zero Day Initiative each fell more than 50 percent in 2012.
Bottom line: The CVE standard is being rebuilt to absorb 100 times more flaw reports a year, and the fastest growth is in the control systems running power grids, water purification, manufacturing and transportation - while the two largest bug bounty programs saw submissions drop by more than half as researchers found other buyers.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2013-0422
Related: CVE-2013-0422: Oracle JRE Remote Code Execution Vulnerability Known Exploited Vulnerabilities · May 25, 2022
Zero-Day Java Exploit Debuts in Crimeware Cyber Risks ·
Oracle Ships Critical Security Update for Java Cyber Risks ·