CVE & Vulnerability Attribution

Every piece of software has vulnerabilities. The NVD (National Vulnerability Database) catalogs them as CVEs (Common Vulnerabilities and Exposures) with CVSS severity scores. QROS matches every detected software version against the NVD and attributes CVEs to each indexed host — from banner to CVE in one job, with a global CVSS×10 score — so you know exactly which hosts are vulnerable and to what.

How QROS attributes CVEs

When QROS scans a host, it identifies the software running on each open port — nginx 1.18.0, OpenSSH 8.9p1, Apache 2.4.52, WordPress 6.2, Redis 7.0.5 — and matches that exact version against the NVD CVE catalog. For each match, QROS reports:

• The CVE id (e.g., CVE-2024-6387 — the recent OpenSSH regreSSHion)
• The CVSS score (0.0–10.0) and severity (low, medium, high, critical)
• A description of the vulnerability
• The weakness type (CWE — e.g., CWE-78 OS Command Injection, CWE-502 Deserialization)
• Remediation advice (upgrade to version X, disable feature Y, apply patch Z)

Search by CVE to find exposed hosts

QROS lets you search the entire indexed host database by CVE id. Search all hosts vulnerable to CVE-2024-6387 (OpenSSH regreSSHion), all hosts vulnerable to Log4Shell, or all hosts with critical CVEs — no login required.

What CVEs look like in a QROS host dossier

When QROS finds a vulnerable software version on a host, it shows each CVE with its CVSS score, severity, and remediation advice. Here's an example:

Why CVE attribution matters

Attackers scan the internet for vulnerable versions of known software. When a new CVE is disclosed, they exploit it within hours. QROS gives you the same visibility — you can find which of your hosts are vulnerable before attackers do, and prioritize patching by CVSS severity.