blocks|key|282782|text|我发现NIST站点+(在schroeder注释中提到)对于在不安装漏洞扫描器的情况下搜索所有特定版本的CVE非常有用。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|282783|只要选择"Search+=+Advanced“，就会有一个CPE部分，您可以在其中选择供应商、产品和版本。|282784|例如，如果您想搜索特定版本的Apache+Log4j漏洞：|282785|📷|atomic|282786|它将返回：|282787|282788|为了使请求自动化，我建议读取它们的发展商分区，您可以注册以获得API键。|entityMap|0|LINK|mutability|MUTABLE|url|https://nvd.nist.gov/vuln/search|1|IMAGE|IMMUTABLE|imageUrl|https://i.stack.imgur.com/Px9Y8.jpg|imageAlt|2|https://i.stack.imgur.com/hkWrM.png|3|https://nvd.nist.gov/developers^0|3|6|0|0|0|0|0|1|1|0|0|0|1|2|0|H|5|3^^$0|@$1|2|3|4|5|6|7|16|8|@]|9|@$A|17|B|18|1|19]]|C|$]]|$1|D|3|E|5|6|7|1A|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|1B|8|@]|9|@]|C|$]]|$1|H|3|I|5|J|7|1C|8|@]|9|@$A|1D|B|1E|1|1F]]|C|$]]|$1|K|3|L|5|6|7|1G|8|@]|9|@]|C|$]]|$1|M|3|I|5|J|7|1H|8|@]|9|@$A|1I|B|1J|1|1K]]|C|$]]|$1|N|3|O|5|6|7|1L|8|@]|9|@$A|1M|B|1N|1|1O]]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]|W|$5|X|S|Y|C|$Z|10|11|-4]]|12|$5|X|S|Y|C|$Z|13|11|-4]]|14|$5|R|S|T|C|$U|15]]]]

I found <a href="https://nvd.nist.gov/vuln/search" rel="nofollow noreferrer">the NIST site</a> (mentioned in schroeder comment) quite useful to search for all CVE for a specific version without installing a vulnerability scanner.
Just choose the &quot;Search Type = Advanced&quot; and you will have a CPE section where you can choose the Vendor, Product and Version.
Example if you want to search a particular version of e.g. Apache Log4j vulnerability:
<a href="https://i.stack.imgur.com/Px9Y8.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Px9Y8.jpg" alt="NIST" /></a>
it will return:
<a href="https://i.stack.imgur.com/hkWrM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hkWrM.png" alt="NIST-Result" /></a>
For automating the requests, I suggest to read their <a href="https://nvd.nist.gov/developers" rel="nofollow noreferrer">Developers' section</a>, you can register to get an API Key

blocks|key|2576784|text|漏洞管理工具就是为了完成这一功能而设计的。它们通常能够根据已知的修补程序级别以及CVEs扫描设备和查找版本。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2576785|有大量的选择与广泛的功能。|2576786|除了CVE数据库之外，最重要的检查源是：|2576787|开发数据库|unordered-list-item|2576788|Metasploit利用存储库|2576789|还有许多工具可以获取产品名称和版本的csv文件，并在这些源中查找它们(或者您可以自己制作)。|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|H|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]]|M|$]]

Vulnerability Management tools are designed to do this very function. They usually are able to scan devices and lookup versions against known patch levels as well as CVEs.

There are a great many to choose from with a wide range of features. 

The most crucial sources to check beside the CVE database are:

<ul>
<li>Exploit-DB</li>
<li>Metasploit exploit repository</li>
</ul>

There are also a number of tools that can take a csv file of product names and versions and look them up in these sources (or you can make your own).

blocks|key|282660|text|可以使用的工具是漏洞扫描器，如OpenVAS、Nessus甚至Metasploit。现在并不是所有的第三方软件都在里面。除此之外，github上还有一些脚本提供一些帮助。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|282661|手动搜索或编写https://cve.mitre.org/find/脚本的好站点|offset|length|282662|对于Linux：https://github.com/clearlinux/cve-check-tool+(需要CVE缓存的本地副本)--+CVE+https://github.com/cve-search/cve-search的本地数据库工具|282663|更进一步说。|282664|Nmap有一个名为伏尔扫描的NSE脚本。它可以帮助您使用漏洞数据库映射从目标计算机获取的版本信息，例如：|282665|来自www.cve.mitre.org的CVE|unordered-list-item|282666|OSCDB+www.osvdb.org|282667|scip+VulDB+Www.sc.ch/|282668|www.SecurityFocus.com|282669|www.securitytracker.com|entityMap|0|LINK|mutability|MUTABLE|url|https://cve.mitre.org/find/|1|https://github.com/clearlinux/cve-check-tool|2|https://github.com/cve-search/cve-search|3|http://www.computec.ch/mruef/software/nmap_nse_vulscan-1.0.tar.gz|4|http://www.cve.mitre.org/|5|http://www.osvdb.org/|6|http://www.scip.ch/?vuldb|7|http://www.securityfocus.com/|8|http://www.securitytracker.com/^0|0|7|R|0|0|8|18|1|22|14|2|0|0|9|4|3|0|2|H|4|0|6|D|5|0|B|A|6|0|0|L|7|0|0|N|8^^$0|@$1|2|3|4|5|6|7|1J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1K|8|@]|9|@$D|1L|E|1M|1|1N]]|A|$]]|$1|F|3|G|5|6|7|1O|8|@]|9|@$D|1P|E|1Q|1|1R]|$D|1S|E|1T|1|1U]]|A|$]]|$1|H|3|I|5|6|7|1V|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1W|8|@]|9|@$D|1X|E|1Y|1|1Z]]|A|$]]|$1|L|3|M|5|N|7|20|8|@]|9|@$D|21|E|22|1|23]]|A|$]]|$1|O|3|P|5|N|7|24|8|@]|9|@$D|25|E|26|1|27]]|A|$]]|$1|Q|3|R|5|N|7|28|8|@]|9|@$D|29|E|2A|1|2B]]|A|$]]|$1|S|3|T|5|N|7|2C|8|@]|9|@$D|2D|E|2E|1|2F]]|A|$]]|$1|U|3|V|5|N|7|2G|8|@]|9|@$D|2H|E|2I|1|2J]]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]|13|$5|Y|Z|10|A|$11|14]]|15|$5|Y|Z|10|A|$11|16]]|17|$5|Y|Z|10|A|$11|18]]|19|$5|Y|Z|10|A|$11|1A]]|1B|$5|Y|Z|10|A|$11|1C]]|1D|$5|Y|Z|10|A|$11|1E]]|1F|$5|Y|Z|10|A|$11|1G]]|1H|$5|Y|Z|10|A|$11|1I]]]]

A tool to use would be a vulnerability scanner such as OpenVAS, Nessus or even Metasploit. Now not all 3rd party software will be in there. Other than that, there are scripts on github that offer some assistance.
A good site to search manually or script it <a href="https://cve.mitre.org/find/" rel="nofollow noreferrer">https://cve.mitre.org/find/</a>
For Linux: <a href="https://github.com/clearlinux/cve-check-tool" rel="nofollow noreferrer">https://github.com/clearlinux/cve-check-tool</a> (need a local copy of CVE cache)
A tool for local Database of CVE <a href="https://github.com/cve-search/cve-search" rel="nofollow noreferrer">https://github.com/cve-search/cve-search</a>
<hr />
Furthermore.
Nmap has an NSE script for this called <a href="http://www.computec.ch/mruef/software/nmap_nse_vulscan-1.0.tar.gz" rel="nofollow noreferrer">Vulscan</a>. It can help you to map the version information you obtain from a target machine with the vulnerability database, such as:
<ul>
<li>CVE from <a href="http://www.cve.mitre.org" rel="nofollow noreferrer">www.cve.mitre.org</a></li>
<li>OSCDB <a href="http://www.osvdb.org" rel="nofollow noreferrer">www.osvdb.org</a></li>
<li>scip VulDB <a href="http://www.scip.ch/?vuldb" rel="nofollow noreferrer">www.scip.ch/?vuldb</a></li>
<li><a href="http://www.SecurityFocus.com" rel="nofollow noreferrer">www.SecurityFocus.com</a></li>
<li><a href="http://www.securitytracker.com" rel="nofollow noreferrer">www.securitytracker.com</a></li>
</ul>

blocks|key|2577011|text|https://vulners.com/用于搜索产品版本号。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2577012|Vulner基本上列举了CVE和漏洞报告，以及互联网上以安全为重点的博客和帖子。然后，您可以搜索这些文档中可能包含的任何内容。|2577013|由于他们健壮的API，我开始使用它，这使得事情变得更加简单。我相信他们也有一种建立漏洞扫描器的方法。|entityMap|0|LINK|mutability|MUTABLE|url|https://vulners.com/^0|0|K|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@$A|P|B|Q|1|R]]|C|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|C|$]]]|H|$I|$5|J|K|L|C|$M|N]]]]

<a href="https://vulners.com/" rel="nofollow noreferrer">https://vulners.com/</a> to search for a product version number.

Vulners basically enumerates CVE's and vulnerability reports as well as security focused blogs and posts from across the internet. You can then search for anything that may be contained in these documents.

I started using it due to their robust API, which makes things even easier. I believe they have a method of setting up a vulnerability scanner as well.

I have a list of software installed on workstations which contains product name and version, for example my list contains Mysql Workbench 6.3.8. Searching in CVE Details I found out that this software has one vulnerability CVE-2017-3469. Is there any automated tool to do this kind of search in most popular vulnerability databases? What are the others vulnerability databases that I should search?

How to get vulnerabilites by product name and version

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我有一个安装在工作站上的软件列表，其中包含产品名称和版本，例如，我的列表包含Mysql 6.3.8。搜索CVE的细节，我发现这个软件有一个漏洞CVE-2017-3469。在大多数流行的漏洞数据库中，是否有任何自动工具来进行这种搜索？我应该搜索的其他漏洞数据库是什么？

问如何按产品名称和版本获取漏洞
EN

回答 4

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何按产品名称和版本获取漏洞EN

回答 4

Security用户

Security用户

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何按产品名称和版本获取漏洞
EN