Vulnerability management

Vulnerabilities answers two questions without you tracking CVEs by hand: what known vulnerabilities do your customers' systems have, and does the threat everyone is talking about today affect any of them? It's for your MSP team; portal users see the resulting findings under your sharing rules.

Where the inventory comes from

Inventory is checked against OSV.dev (maintained by the ecosystems and Linux distributions themselves), the US National Vulnerability Database (NVD) for a curated list of Windows and Mac programs, CISA's Known Exploited Vulnerabilities catalogue and FIRST's EPSS. Everything is re-checked twice a day against fresh advisory data, and whenever new inventory arrives. Re-check runs it now.

The page

• Threats we're tracking at the top: cards for emerging threats RevoSecure curates, plus your own threat watches. Each says Not affected (checked N systems), N systems at M customers affected or Checking….
• By application (the default) tells you what to update. One row per application, however many CVEs it has: the vulnerabilities by severity and how many are actively exploited, the systems running it, the versions installed, and Update to, the one version that clears every vulnerability with a published fix. Firefox 148.0.2 with 453 CVEs, fixed in 21 different versions from 149.0 to 157.0.1, is one row: 157.0.1 or later. Vulnerabilities with no fixed version published are counted apart. Known-exploited applications come first, then the worst severity, then the most systems. In All customers each customer's applications are their own rows.
• Select a row to open it in place: its CVEs, most serious first (each links to its details), and the systems with their versions and the update each one needs (each links to the device). Open the finding goes to the finding you assign or ticket.
• By vulnerability lists each CVE instead, actively exploited and critical first. Open one for the advisory, every affected system, the fixed version and what to do.
• Filters apply to both views: severity, source (devices, public websites, GitHub, SBOM), Actively exploited only and search (application, CVE or system name). In By application they choose applications, for example the ones with a critical vulnerability, and each row still counts everything open in it.
• Systems lists every checked device, website and application with its exploited, tracked-threat, critical and high counts, plus coverage notes.
• Coverage shows what feeds the page and what's missing: agents older than 0.3.0, systems that haven't reported for a week, Windows programs outside the curated list, and whether you've run external assessments or connected code.

A customer's Vulnerabilities shows that customer's tracked threats and applications to update. A device's Vulnerabilities tab has the same two views for that device: By application first, and By vulnerability with open, accepted, not applicable and fixed ones.

One application across versions

An application is the same whatever version or language edition is installed: Mozilla Firefox (x64 en-US) and Mozilla Firefox (x86 de) are Mozilla Firefox, and Java 8 Update 431 and Java 8 Update 461 are Oracle Java 8. Programs RevoSecure identifies take their product name; for anything else, version numbers are taken out of the program's name (OpenVPN 2.5.2-I601 amd64 becomes OpenVPN amd64). Linux packages and code dependencies keep their package name. Updating a program therefore never makes it a new row or a new finding.

Check a CVE

Paste any CVE, GHSA or USN id. You get one of four answers:

RevoSecure never shows a green "not affected" it can't back up: a lookup that failed, or a product installed without a readable version, makes the answer inconclusive rather than clean.

Installed programs: how a CVE gets on a device

Windows and Mac programs (Chrome, Firefox, Java, Acrobat, 7-Zip, Zoom and about 35 others) and runtimes such as PHP or OpenSSL are matched by their exact version against the NVD's records. A CVE is listed only when the NVD names that version or a version range that includes it, and only on the operating systems it applies to:

• "Every version" listings are ignored. The NVD marks some old CVEs as affecting every version of a product because nobody analysed which ones. They are 2003-2016 issues about versions long gone, so they never count against a device.
• Platform-specific CVEs stay on their platform. "Google Chrome on Mac", Firefox for Android or a Windows-only Foxit bug don't appear on the wrong devices.
• Java's update counts. Java 8 Update 461 is matched as update 461, not as "Java 8".

Each affected row has Why it's here: which versions the NVD lists as affected, the version that fixes it, any platform limit, and a link to the NVD record. Sometimes a CVE's description is about a different product: a WebKit bug "fixed in macOS Sonoma" listed against Oracle Java, because Java includes WebKit. Those rows say Bundled component and explain it; updating the listed program still clears it.

Corrected (instead of Fixed) means RevoSecure stopped listing a CVE because better data showed the installed version was never affected, not because anything changed on the device. Corrections don't count as fixes in the change history and don't send notifications.

What this trades for accuracy: RevoSecure reports what the NVD has analysed. Very new CVEs the NVD hasn't processed yet, and older Java updates that later Oracle patch rounds don't list by name, can be missing. Add a threat watch for anything you need tracked regardless.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Possibly affected

Possibly affected means the version matches but RevoSecure can't see the patch level. It happens with:

• Linux distribution packages: Ubuntu and Debian back-port fixes without changing the upstream version;
• versions read from web-server headers;
• floating container tags such as php:8.3-fpm, or a product reported without a version.

Apply the distribution's security update. The match clears on its own once the fixed package is installed or the distribution publishes its fix data. See Confirmed, firm and suspected.

From vulnerabilities to findings

Serious ones become findings, so they flow into assignments, PSA tickets and reports:

• one per tracked threat, for example PHP2Shell: 3 affected systems;
• one per application with a known-exploited, critical or high vulnerability, for example Mozilla Firefox (Windows): 453 vulnerabilities on 3 devices (12 critical), update to 157.0.1. Updating the application updates this finding; it resolves once no system is affected.

Lower-severity ones stay on the Vulnerabilities page, so they don't flood the findings queue.

Accepting the risk

Accept the risk or Not applicable on an affected system (a reason is required and audited) takes it out of the findings until you reopen it. Exposures resolve on their own when the fixed version is installed.

Limits

• Windows programs are identified by their Programs and Features entry, and only a curated list is matched by name, to avoid reporting another product's CVEs. Add a threat watch for anything critical outside it.
• Program matching depends on the NVD's analysis (see Installed programs).
• CVEs fixed by pending Windows updates are handled by patching, not listed here.
• Containers are matched by image tag only; image layers aren't scanned. Windows containers aren't collected.
• CentOS, Fedora, Amazon Linux, Arch and their derivatives have no OSV data; their packages are only checked by threat watches, and coverage says so.
• Results are as current as each system's last report. Systems silent for 7 days are flagged stale.