Comments (4)
From vulndb's point of view yeah, you can remove one of them.
from data.
@Zapotek well, this started as a comment to myself, but it's really good you've answered since now I can ask a couple of follow-up questions 👍
I believe we'll have a small decision to make here. First let me ask: "Do you intend on using vulndb in Arachni?" If the answer is yes, then we'll have to find a way to handle these cases, one of course can be that arachni reports the same vulnerability (without the different title) in both cases, another is that the ruby-sdk allows you to override the title?
The same thing happens with other vulnerabilities like XSS where the json files are almost the same. In cases like this I'm unsure if the developer reading these descriptions benefits from:
"in the server's response.\nFor example",
"`HTTP://yoursite.com/INJECTION_HERE/`, where `INJECTION_HERE`",
"represents the location where the the tool payload was injected."
vs.
"content directly into an HTML\ntag. For example `<INJECTION_HERE",
"href=.......etc>` where `INJECTION_HERE`\nrepresents the location where",
"the the tool payload was detected."
I want you to use vulndb in Arachni, hell, I want every tool to use it, it's the only way to maintain and grow it! So... what should we do?
Referenced files
- Cross domain policy
- XSS
from data.
I think we should remove all those permutations (same goes for timing attacks etc) and only keep the data for the root issue.
Then tools will be able to get the generic descriptions etc. and append any extra stuff about the way they identified the vuln as needed.
And yeah I'd like to use vulndb in Arachni eventually.
from data.
Ok then, I'll keep this issue open so we remember to do it
from data.
Related Issues (20)
- Add new vulnerabilities to database HOT 1
- Add new vulnerabilities to database (must-have)
- Write unittest to verify all JSON files comply with schema.json
- Write unittests required by specification HOT 2
- Avoid duplicated fix guidance HOT 6
- nmap might be interested in using vulndb/data
- Broad/Descriptive Tags On Entries HOT 6
- Remove Arachni-specific tags
- Markdown: 1- vs 1. HOT 1
- Translate database in russian HOT 7
- Add WASC references to existing vulnerabilities in DB
- Add field to describe who is affected by vulnerability HOT 1
- Add CVSS HOT 5
- Move markdown out of JSON files HOT 5
- cwe IDs HOT 3
- Add reference to CWE/SANS Top 25 (2011) HOT 5
- php sdk HOT 10
- Move WASC TC v2 URLs to vulndb/data HOT 3
- Remove duplicated CWE data HOT 2
- Is this project still alive? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from data.