Comment by ovi256 | Hacker News Reader

Comment by ovi256 | Hacker News Reader

I am highly interested in finding Django CVE PoCs which would be useful to justify internally (and externally) upgrading services running old unsupported versions of Django (or backporting the patches from the supported versions, if applicable). This repository contains the string "Django" 35 times. There are false positives, like this one, where the string "POC" was found in the CVE description but it's actually saying "No POC found"

https://github.com/trickest/cve/blob/967839a1f3dd2e43c3ca7af...

The string "No POC found" appears 34,948 times in this repository. This is concerning, given this repo has ~1000 CVEs per year, and 24 years!

The GitHub links for each CVE are very low value, unfortunately, the modal link seems to be to a "awesome CVE" or "CVE POC list" repository of no value whatsoever.

I'd really like a CVE database where you can search by software and version and see which CVEs apply to your version, their severity, and which have PoCs. Anybody else feeling this would be valuable ?

There is Exploit-DB which contains a list of PoC for a lot of services, if their count is to be believed its almost at 45k different PoC.

https://www.exploit-db.com/

I think this is more of a demonstration of what trickest can do.

I posted it because it made it onto GitHub trending and thought it shows the potential of what could be done by aggregating cve / POC data.

I had much the same thought as you, it would be great to have this in a curated database. I feel like someone might reply that such a thing already exists :)

Snyk is pretty good for your use case (I think). It often has PoCs or links to PoCs if they’re available for vulnerabilities associated with library / framework versions. Here’s the link to the vulnerabilities for Django:

https://snyk.io/vuln/pip:django

That already exists. I work on one version of that. Unless I've misunderstood you.

> I'd really like a CVE database where you can search by software and version and see which CVEs apply to your version, their severity, and which have PoCs.

You work on such a database? Please link it for the rest of us!

You could grab quite a lot of this from the OVAL feeds that multiple distros offer.

Getting a verified POC is a much harder problem.

Just to be sure we are talking about the same thing, you want a nice GUI interface for the NVD API? In other words, this:

curl --verbose "https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2020-068..."

But you want a nice interface for that? We offer that at Virtalabs, though we specialize on ICS that are in hospitals:

https://www.virtalabs.com

Reply on news.ycombinator.com