eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.

Server stats:

199
active users

#cve

7 posts6 participants0 posts today

OK #infosec folks. Has anyone put together a map of the #cve data ecosystem? It's a wild world. There's:

* MITRE's CVEs (pretty much just the identifier and unstructured text)
* NIST NVD's enriched CVEs (with product and version info)
* CISA's vulnrichment (similar)
* EUVD (similar?)
* GitHub's advisory DB (sometimes pushing to, sometimes pulling from the above DBs, sometimes with ecosystem info)
* Package manager advisory dbs (with their own versions)
* OSV.dev, pulling from all of the above?

You can now use Sightings in Vulnerability-Lookup to uncover unpublished security advisories.

This feature aggregates early signals from multiple sources — websites, news feeds, social networks, the MISP Project (@misp), Nuclei templates, our community, and more.

Detect threats before they’re officially disclosed!

- vulnerability.circl.lu
- vulnerability-lookup.org/user-
- github.com/vulnerability-looku

Always interesting to see that a CVE like CVE-2025-53767 doesn't give that much fuss in the news.

And yes I assume that Microsoft properly fixes their product, but still. Not much information on this CVE.

Plus it gives again (or still?) food for thought on the usage of cloud products.

"If it’s smart, it’s vulnerable"

Schöne neue IT-Welt:

"Durch die #Sicherheitslücken haben es die Forscher geschafft, eine Root-Shell auf einem #Bose-Lautsprecher zu erhalten, und dann davon in ein #Autoradio von #Panasonic einzubrechen. Somit kann man sich von einem #AirPlay- und #CarPlay-Gerät zum nächsten hacken."

"Außerdem beschwerten sich die Forscher, dass #Apple ein Rate-Limit zum Übermitteln von #Schwachstellen hat – nach 16 CVEs gibt es die Meldung, man könne weitere Lücken erst am nächsten Tag melden."

"In einer Live-Demo zeigte er, wie man [...] eine Socket-Kommunikation trotz geblocktem Port bei der #Defender-Firewall durchführen kann, komplett vorbei am #Betriebssystem. Auch bei #UEFI-Malware bleibt es also ein ewiges Katz-und-Maus-Rennen."

heise.de/news/Black-Hat-If-it-

heise online · Black Hat: Hack von einem AirPlay- und CarPlay-Gerät zum nächstenBy Lukas Grunwald

W/R/T #CVE

1) This is still a thing: resist.bot/petitions/PWDDUS

Makes it easy to pester Congress about the CVE program.

2) I was reminded of this bit of Internet history: pigdog.org/auto/digital_gar_ga

It was written in 1999, about 3 months before CVE came on this scene. It’s snarky. But there was no DNS Fairy, either.

A shareable card that reads "tell the U.S. Congress: Safeguard the CVE Program" followed by "text sign PWDDUS to 50409"
ResistbotSafeguard the CVE ProgramText SIGN PWDDUS to 50409 to send this to your officials.