|
1 | 1 | { |
2 | 2 | "currentNews": [ |
| 3 | + { |
| 4 | + "id": 412, |
| 5 | + "newsType": "blog", |
| 6 | + "title": "Vulnerability Data Enrichment for CVE Records: CNA Recognition List, September 23, 2024", |
| 7 | + "urlKeywords": "CNA Enrichment Recognition List Update", |
| 8 | + "date": "2024-09-24", |
| 9 | + "author": { |
| 10 | + "name": "CVE Program", |
| 11 | + "organization": { |
| 12 | + "name": "CVE Program", |
| 13 | + "url": "" |
| 14 | + }, |
| 15 | + "title": "", |
| 16 | + "bio": "" |
| 17 | + }, |
| 18 | + "description": [ |
| 19 | + { |
| 20 | + "contentnewsType": "paragraph", |
| 21 | + "content": "The “<a href='/About/Metrics#CNAEnrichmentRecognition'>CNA Enrichment Recognition List</a>” for September 23, 2024, is now available. Published every two weeks on the CVE website, the list recognizes those <a href='/ProgramOrganization/CNAs'>CVE Numbering Authorities (CNAs)</a> that are actively providing enhanced vulnerability data in their <a href='/ResourcesSupport/Glossary?activeTerm=glossaryRecord'>CVE Records</a>. CNAs are added to the list if they provide <a href='https://www.first.org/cvss/' target='_blank'>Common Vulnerability Scoring System (CVSS)</a> and <a href='https://cwe.mitre.org/' target='_blank'>Common Weakness Enumeration (CWE™)</a> information 98% of the time or more within the two-week period of their last published CVE Record." |
| 22 | + }, |
| 23 | + { |
| 24 | + "contentnewsType": "paragraph", |
| 25 | + "content": "For more about the recognition list, see “<a href='/Media/News/item/blog/2024/09/10/CNA-Enrichment-Recognition-List'>Recognition for CNAs Actively Providing Vulnerability Data Enrichment for CVE Records</a>.” To learn more about vulnerability information types like CVSS and CWE, see the <a href='/CVERecord/UserGuide'>CVE Record User Guide</a>." |
| 26 | + }, |
| 27 | + { |
| 28 | + "contentnewsType": "paragraph", |
| 29 | + "content": "View the CNA Enrichment Recognition List <a href='/About/Metrics#CNAEnrichmentRecognition'>here</a>." |
| 30 | + } |
| 31 | + ] |
| 32 | + }, |
| 33 | + { |
| 34 | + "id": 411, |
| 35 | + "newsType": "news", |
| 36 | + "title": "Pall Added as CVE Numbering Authority (CNA)", |
| 37 | + "urlKeywords": "Pall Added as CNA", |
| 38 | + "date": "2024-09-24", |
| 39 | + "description": [ |
| 40 | + { |
| 41 | + "contentnewsType": "paragraph", |
| 42 | + "content": "<a href='/PartnerInformation/ListofPartners/partner/Pall'>Pall Corporation</a> is now a <a href='/ResourcesSupport/Glossary?activeTerm=glossaryCNA'>CVE Numbering Authority (CNA)</a> for Pall branded products only." |
| 43 | + }, |
| 44 | + { |
| 45 | + "contentnewsType": "paragraph", |
| 46 | + "content": "To date, <a href='/PartnerInformation/ListofPartners'>408 CNAs</a> (406 CNAs and 2 CNA-LRs) from <a href='/ProgramOrganization/CNAs'>40 countries</a> and 1 no country affiliation have partnered with the CVE Program. CNAs are organizations from around the world that are authorized to assign <a href='/ResourcesSupport/Glossary?activeTerm=glossaryCVEID'>CVE Identifiers (CVE IDs)</a> and publish <a href='/ResourcesSupport/Glossary?activeTerm=glossaryRecord'>CVE Records</a> for vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities. Pall is the 220th CNA from USA." |
| 47 | + }, |
| 48 | + { |
| 49 | + "contentnewsType": "paragraph", |
| 50 | + "content": "Pall’s Root is the <a href='/PartnerInformation/ListofPartners/partner/icscert'>CISA ICS Root</a>." |
| 51 | + } |
| 52 | + ] |
| 53 | + }, |
3 | 54 | { |
4 | 55 | "id": 410, |
5 | 56 | "newsType": "news", |
|
9 | 60 | "description": [ |
10 | 61 | { |
11 | 62 | "contentnewsType": "paragraph", |
12 | | - "content": "<a href='/PartnerInformation/ListofPartners/partner/ASUS'>ASUSTeK Computer Incorporation</a> is now a <a href='/ResourcesSupport/Glossary?activeTerm=glossaryCNA'>CVE Numbering Authority (CNA)</a> for ASUS issues only." |
| 63 | + "content": "<a href='/PartnerInformation/ListofPartners/partner/ASUS'>ASUSTeK Computer Incorporation</a> is now a <a href='/ResourcesSupport/Glossary?activeTerm=glossaryCNA'>CVE Numbering Authority (CNA)</a> for ASUS issues only. Read the ASUS news release: “<a href='https://press.asus.com/news/press-releases/asus-cve-authority-product-security/' target='_blank'>ASUS Authorized by the CVE Program as a CVE Numbering Authority (CNA)</a>.”" |
13 | 64 | }, |
14 | 65 | { |
15 | 66 | "contentnewsType": "paragraph", |
|
81 | 132 | "description": [ |
82 | 133 | { |
83 | 134 | "contentnewsType": "paragraph", |
84 | | - "content": "The <a href='/'>CVE Program</a> and <a href='https://www.first.org/' target='_blank'>FIRST</a> will co-host <i><a href='https://www.first.org/conference/vulncon2025/' target='_blank'>VulnCon 2025</a></i> at the McKimmon Center in Raleigh, North Carolina, USA, on April 7-10, 2025. The call for papers, and virtual and in-person registration options, are TBA." |
| 135 | + "content": "The <a href='/'>CVE Program</a> and <a href='https://www.first.org/' target='_blank'>FIRST</a> will co-host <i><a href='https://www.first.org/conference/vulncon2025/' target='_blank'>VulnCon 2025</a></i> at the McKimmon Center in Raleigh, North Carolina, USA, on April 7-10, 2025. Registration, both virtual and in-person, will open in November 2024." |
85 | 136 | }, |
86 | 137 | { |
87 | 138 | "contentnewsType": "image", |
|
104 | 155 | }, |
105 | 156 | { |
106 | 157 | "contentnewsType": "paragraph", |
107 | | - "content": "We have an action-packed docket of dynamic speakers and cross-industry topics that we feel will accelerate collaboration within the vulnerability management and standards/frameworks space! This will be a must-see event for anyone involved in researching, reporting, triaging, mitigating, and communicating about security vulnerabilities. Some highlights from the agenda include: <ul><li>40+ sessions across 4 full days of content and networking/collaboration</li><li>PSIRTs, Vulnerability SIGs, Working Groups, and other vulnerability ecosystem experts presenting about CVE, CVSS, EPSS, KEV, VEX, CVD, SBOM, Incident Response, and others!</li><li>Speakers from CISA, MITRE, ENISA, global CERT teams, the OpenSSF, FIRST, and other renown industry experts</li><li>Actionable advice on how to engage with CVD across ecosystem stakeholders and how to use and align the assorted vuln metadata tools, frameworks, and standards</li></ul>" |
| 158 | + "content": "We have an action-packed docket of dynamic speakers and cross-industry topics that we feel will accelerate collaboration within the vulnerability management and standards/frameworks space! This will be a must-see event for anyone involved in researching, reporting, triaging, mitigating, and communicating about security vulnerabilities. Some highlights from the agenda include: <ul><li>40+ sessions across 4 full days of content and networking/collaboration</li><li>PSIRTs, Vulnerability SIGs, Working Groups, and other vulnerability ecosystem experts presenting about CVE, CVSS, EPSS, KEV, VEX, CVD, SBOM, Incident Response, and others!</li><li>Speakers from the CVE Program, CISA, ENISA, global CERT teams, the OpenSSF, FIRST, and other renown industry experts</li><li>Actionable advice on how to engage with CVD across ecosystem stakeholders and how to use and align the assorted vuln metadata tools, frameworks, and standards</li></ul>" |
108 | 159 | }, |
109 | 160 | { |
110 | 161 | "contentnewsType": "paragraph", |
111 | | - "content": "Some showcase sessions will include: <ul><li>A “Day of VEX” from practitioners</li><li>A “Day of Vuln Identifiers” from practitioners</li><li>Previous Keynotes spoke on the topics of “Supply Chain Security: The Office of the National Cyber Director Perspective”, “Vulnerability Coordination in the EU”, “What it takes to lead America’s Vulnerability Management Team”, and sessions from global CERT teams</li><li>Expert panels on Industry CVD, Vulnerability identifiers, VEX, Decentralized Root Cause analysis, the risks of requiring premature vuln disclosure, and more!</li><li>Detailed sessions updating frameworks like CWE, CVSS, EPSS, and others</li></ul>" |
| 162 | + "content": "Some showcase sessions will include: <ul><li>A “Day of VEX” from practitioners</li><li>A “Day of Vuln Identifiers” from practitioners</li><li>Previous Keynotes spoke on the topics of “Supply Chain Security: The Office of the National Cyber Director Perspective”, “Vulnerability Coordination in the EU”, “What it takes to lead America’s Vulnerability Management Team”, and sessions from global CERT teams</li><li>Expert panels on Industry CVD, Vulnerability identifiers, VEX, Decentralized Root Cause analysis, the risks of requiring premature vuln disclosure, and more!</li><li>Detailed sessions updating frameworks like CVSS, CWE, EPSS, and others</li></ul>" |
112 | 163 | }, |
113 | 164 | { |
114 | 165 | "contentnewsType": "paragraph", |
|
132 | 183 | }, |
133 | 184 | { |
134 | 185 | "contentnewsType": "paragraph", |
135 | | - "content": "For most up-to-date information, visit the <a href='https://www.first.org/conference/vulncon2025/' target='_blank'>CVE/FIRST VulnCon 2025</a> conference page hosted on the FIRST website. We look forward to seeing you at this first-ever community event!</a>" |
| 186 | + "content": "For most up-to-date information, visit the <a href='https://www.first.org/conference/vulncon2025/' target='_blank'>CVE/FIRST VulnCon 2025</a> conference page hosted on the FIRST website. We look forward to seeing you at this exciting community event!</a>" |
136 | 187 | } |
137 | 188 | ] |
138 | 189 | }, |
|
171 | 222 | "description": [ |
172 | 223 | { |
173 | 224 | "contentnewsType": "paragraph", |
174 | | - "content": "The CVE Program now publishes a “<a href='/About/Metrics#CNAEnrichmentRecognition'>CNA Enrichment Recognition List</a>” every two weeks on the <a href='/About/Metrics'>Metrics</a> page on the CVE website to recognize <a href='/ProgramOrganization/CNAs'>CVE Numbering Authorities (CNAs)</a> that are actively enriching their <a href='/ResourcesSupport/Glossary?activeTerm=glossaryRecord'>CVE Records</a> by adding <a href='https://www.first.org/cvss/' target='_blank'>Common Vulnerability Scoring System (CVSS)</a> and <a href='https://cwe.mitre.org/' target='_blank'>Common Weakness Enumeration (CWE™) </a> information." |
| 225 | + "content": "The CVE Program now publishes a “<a href='/About/Metrics#CNAEnrichmentRecognition'>CNA Enrichment Recognition List</a>” every two weeks on the <a href='/About/Metrics'>Metrics</a> page on the CVE website to recognize <a href='/ProgramOrganization/CNAs'>CVE Numbering Authorities (CNAs)</a> that are actively enriching their <a href='/ResourcesSupport/Glossary?activeTerm=glossaryRecord'>CVE Records</a> by adding <a href='https://www.first.org/cvss/' target='_blank'>Common Vulnerability Scoring System (CVSS)</a> and <a href='https://cwe.mitre.org/' target='_blank'>Common Weakness Enumeration (CWE™)</a> information." |
175 | 226 | }, |
176 | 227 | { |
177 | 228 | "contentnewsType": "paragraph", |
|
0 commit comments