Hey there,
in the cvelist, all vendors and products and their versions are totally messed up.
First off, there seem to be more than one notation for the meaning of "n/a" (aka null). So far I've identified these notations: n/a, * n/a *, *** n/a ***, NONE, None, none, no, null, [UNKNOWN], [Unknown], Unknown.
Additionally, all vendors and products are messed up. Sometimes there's the product field containing the actual versions that are affected in a comma separated list. Sometimes the Vendor is redundantly marked e.g. as Example, Inc and Example Corporation and Example. Siemens alone has more than 10 different notations.
The versions themselves are a whole other story, because most of them are also totally invalid. Even when there's a lessThan field set, sometimes the value of it is set to None. It gets even more ridiculous when the same CVE has two different affected versions which logically contradict each other.
Hey there,
in the cvelist, all vendors and products and their versions are totally messed up.
First off, there seem to be more than one notation for the meaning of "n/a" (aka
null). So far I've identified these notations:n/a,* n/a *,*** n/a ***,NONE,None,none,no,null,[UNKNOWN],[Unknown],Unknown.Additionally, all vendors and products are messed up. Sometimes there's the
productfield containing the actual versions that are affected in a comma separated list. Sometimes the Vendor is redundantly marked e.g. asExample, IncandExample CorporationandExample. Siemens alone has more than 10 different notations.The versions themselves are a whole other story, because most of them are also totally invalid. Even when there's a
lessThanfield set, sometimes the value of it is set toNone. It gets even more ridiculous when the same CVE has two different affected versions which logically contradict each other.