Comodo Web Inspector

Status

-

Indicates the status of the device whether it has passed or failed.

Plugin

The vulnerability plug-in that has detected the vulnerability.

Category

-

The category of the flaw that is responsible for the vulnerability.

Priority

-

Indicates the priority at which the vulnerability has to be re mediated.

Synopsis

-

The Synopsis in the report provides a short description of the vulnerability. For example: if the protocol is encrypted, if debugging is enabled etc.

Description

-

A detailed description of the vulnerability and its effects. This section also contains links for additional reading about the vulnerability.

Risk Factor

-

Shows the severity of the vulnerability according to the CVSS score. The NVD provides severity rankings of "Low", "Medium", and "High" in addition to the numeric CVSS scores but these qualitative rankings are simply mapped from the numeric CVSS scores:

• Vulnerabilities are labeled "Low" severity if they have a CVSS base score of 0.0-3.9.

• Vulnerabilities will be labeled "Medium" severity if they have a base CVSS score of 4.0-6.9.

• Vulnerabilities will be labeled "High" severity if they have a CVSS base score of 7.0-10.0.

Additional Information

-

Provides CVE index of standardized names for vulnerabilities and other information security exposures, BID numbers and other references to the vulnerability.

CVE aims to standardize the names for all publicly known vulnerabilities and security exposures. 

Examples of universal vulnerabilities include:

• phf (remote command execution as user "nobody")

• rpc.ttdbserverd (remote command execution as root)

• world-write able password file (modification of system-critical data)

• default password (remote command execution or other access)

• denial of service problems that allow an attacker to cause a Blue Screen of Death

• smurf (denial of service by flooding a network)

Examples of exposures include:

• running services such as finger (useful for information gathering, though it works as advertised)

• inappropriate settings for Windows NT auditing policies (where "inappropriate" is enterprise-specific)

• running services that are common attack points (e.g., HTTP, FTP, or SMTP)

• use of applications or services that can be successfully attacked by brute force methods (e.g., use of trivially broken encryption, or a small key space)

Each CVE name includes the following:

• CVE identifier number (i.e., "CVE-1999-0067").

• Indication of "entry" or "candidate" status.

• Brief description of the security vulnerability or exposure.

• Any pertinent references (i.e., vulnerability reports and advisories or OVAL-ID).

Solution

-

Provides expert advices on the action to be taken by giving a set of rules to be configured for the specific port/service vulnerability. This gives the best suited remediation measure for the vulnerability found.