Skip to content
  • There are no suggestions because the search field is empty.

What do the different vulnerability test values and information mean?

The Vulnerability Tests page in Security Center contains vulnerabilities for network and web application scans.

Title
The name/short description of the vulnerability.
Example: SQL Injection.

Severity level
The severity level of a vulnerability is derived from its CVSS score (see "CVSS Base" below). Each level has a corresponding color in Security Center, which allows users to quickly and easily identify a vulnerability's severity.

The severity levels are as follows:

  • Info
    It is unlikely that you are exposed to a potential threat.
  • Low
    A low severity level indicates that this vulnerability poses a low risk of exposure.
  • Medium
    A medium severity level indicates that you may be exposed to a potential threat.
  • High  
    A high severity level usually means that you are exposed to a potential threat.
  • Critical  
    Critical level of severity. You are exposed to a threat, only with some exceptions.

Discovery method
The method that was used to discover the vulnerability.

  • Remote only
    Detected only using remote unauthenticated scanning.
  • Authenticated only
    Detected only using authenticated scanning.
  • Remote or Authenticated
    Detected using remote unauthenticated scanning or authenticated scanning.

Published
When the vulnerability was published.

Service modified
When the vulnerability was modified.

HID
The HID (Holm Security ID) is a unique identifier within Security Center for all vulnerabilities.
Example: HID-2-1-339509

Category
The category of vulnerability.
Example: Windows

CVE ID
A unique ID for the vulnerability. Vulnerabilities have unique IDs based on the Common Vulnerability Scoring System (CVSS), commonly used across vendors. You can read more about CVSS below.
Example: CVE-2014-0224

Vendor reference
Information provided by a software provider or vendor, such as OpenSSL.

Patch available
This lets users know whether a patch is available for a given vulnerability.

CVSS metric groups
CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS consists of three metric groups: Base, Temporal, and Environmental. The Base group represents the intrinsic qualities of a vulnerability, the Temporal group reflects the characteristics of a vulnerability that change over time, and the Environmental group represents the characteristics of a vulnerability unique to a user's environment.

The Base metrics produce a score ranging from 0.0 to 10.0, which can be modified by scoring the Temporal and Environmental metrics. A CVSS score is also represented as a vector string, a compressed textual representation of the values used to derive the score.

The CVSS score is translated into a severity level (see Severity level above) to simplify the vulnerability levels.

From CVSS score to Holm Security severity level:

  • Info: 0.0
  • Low: 0.1 – 3.9
  • Medium: 4.0 – 6.9
  • High: 7.0 – 8.9
  • Critical: 9.0 – 10.0

CVSS access vector
The access vector shows how a vulnerability may be exploited.

  • Local
    The attacker must have physical access to the vulnerable system (e.g., Firewire) or a local account (e.g., a privilege escalation attack).
  • Adjacent network
    The attacker must have access to the broadcast or collision domain of the vulnerable system (e.g., ARP spoofing or Bluetooth attacks).
  • Network
    The vulnerable interface works at layer three or above of the OSI Network stack. These types of vulnerabilities are often described as remotely exploitable (e.g., "a remote buffer overflow in a network service").

Software
The software affected by the vulnerability.
Example: OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h

Impact
The impact of the vulnerability.
Example: Successfully exploiting this issue may allow cybercriminals to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks.

Solution
Mitigation for the vulnerability.
Example: Updates are available.

Detection
How the Holm Security script operates to find the vulnerability. 

Insight
Extended information on a more technical level, sometimes covering CVE-specific cases for vulnerabilities titled as multiple.