Misbehaviour VulnerabilityDiscovered

URI: VulnerabilityDiscovered

Description: Discovery by potential attackers of one or more vulnerabilities in software associated with the affected host or process.

Host	A device that can store, process, transmit or receive data.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.

(empty)

H.E-A.TH.8

Vulnerability (A) discovered at Host: software vulnerability found in device Host, which could allow an attack on host availability, and may be known to attackers. Only around 4 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

H.E-AU.H.8

Vulnerability (AU) discovered at Host: software vulnerability found in device Host, which could allow an attack that bypasses authentication, and may be known to attackers. Around 82 percent of vulnerabilities can be accessed without authentication (NVD 2015-2019).

H.E-C.TH.8

Vulnerability (C) discovered at Host: software vulnerability found in device Host, which could allow an attack on data confidentiality, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

H.E-I.TH.8

Vulnerability (I) discovered at Host: software vulnerability found in device Host, which could allow an attack on data integrity, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

H.E-M.SH.8

Vulnerability (M) discovered at Host: software vulnerability found in device Host, which could allow an attack gaining admin level access, and may be known to attackers. Around 18 percent of vulnerabilities allow complete control of the vulnerable device (NVD 2015-2019).

H.E-VA.H.8

Vulnerability (VA) discovered at Host: software vulnerability found in device Host, which could allow an attack from an adjacent network, and may be known to attackers. Under 2 percent of vulnerabilities require low level access from an adjacent network (NVD 2015-2019).

H.E-VL.H.8

Vulnerability (VL) discovered at Host: software vulnerability found in device Host, which could allow an attack by a local user, and may be known to attackers. Around 14 percent of vulnerabilities require local user access to the vulnerable device (NVD 2015-2019).

H.E-VN.H.8

Vulnerability (VN) discovered at Host: software vulnerability found in device Host, which could allow an attack from a remote network, and may be known to attackers. Around 84 percent of vulnerabilities can be accessed from a remote network (NVD 2015-2019).

H.E-W.GH.8

Vulnerability (W) discovered at Host: software vulnerability found in device Host, which could allow an attack by self-propagating malware, and may be known to attackers. Statistics not analysed, but should be less likely than user-level access because someone would need to know about the vulnerability and then develop fully automated and self-propagating malware able to attack it.

P.E-A.HP-iT.8

Vulnerability (A) discovered at Process: software vulnerability found in process Process, which could allow an attack on process availability, and may be known to attackers. Only around 4 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

P.E-AU.HP-iT.8

Vulnerability (AU) discovered at Process: software vulnerability found in process Process, which could allow an attack bypassing authentication, and may be known to attackers. Around 82 percent of vulnerabilities can be accessed without authentication (NVD 2015-2019).

P.E-C.HP-iT.8

Vulnerability (C) discovered at Process: software vulnerability found in process Process, which could allow an attack on data confidentiality, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

P.E-I.HP-iT.8

Vulnerability (I) discovered at Process: software vulnerability found in process Process, which could allow an attack on data integrity, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).

P.E-M.SHP-iT.8

Vulnerability (M) discovered at Process: software vulnerability found in process Process, which could allow admin level access to its host device, and may be known to attackers. Around 18 percent of vulnerabilities allow complete control of the vulnerable device (NVD 2015-2019).

P.E-QI.HP-iT.8

Vulnerability (QI) discovered at Process: software vulnerability found in process Process, which could allow injection of queries into a back-end database, and may be known to attackers. Around 3 percent of vulnerabilities relate to query injection, but around 5 percent of all low complexity attacks are of this type (NVD 2015-2019).

P.E-U.SHP-iT.8

Vulnerability (U) discovered at Process: software vulnerability found in process Process, which could allow user level access to its host device with the rights of the process, and may be known to attackers. Around 30 percent of vulnerabilities allow local user access to the vulnerable device (NVD 2015-2019).

P.E-VA.HP-iT.8

Vulnerability (VA) discovered at Process: software vulnerability found in process Process, which could allow an attack from an adjacent network, and may be known to attackers. Under 2 percent of vulnerabilities require low level access from an adjacent network (NVD 2015-2019), and presumably the majority are in the O/S (i.e. the host).

P.E-VL.HP-iT.8

Vulnerability (VL) discovered at Process: software vulnerability found in process Process, which could allow an attack by a local user, and may be known to attackers. Around 14 percent of vulnerabilities require local user access to the vulnerable device (NVD 2015-2019).

P.E-VN.HP-iT.8

Vulnerability (VN) discovered at Process: software vulnerability found in process Process, which could allow an attack from a remote network, and may be known to attackers. Around 84 percent of vulnerabilities can be accessed from a remote network (NVD 2015-2019).

P.E-W.HP-iT.8

Vulnerability (W) discovered at Process: software vulnerability found in process Process, which could allow an attack by self-propagating malware, and may be known to attackers. Statistics not analysed, but should be less likely than user-level access because someone would need to know about the vulnerability and then develop fully automated and self-propagating malware able to attack it.

P.E-XS.HP-iT.8

Vulnerability (XS) discovered at Process: software vulnerability found in process Process, which could allow a cross-site scripting attack on a client, and may be known to attackers. Around 14 percent of vulnerabilities relate to cross site scripting, including 32 percent of vulnerabilities relating to medium complexity exploits (NVD 2015-2019).