Security terms
A glossary of common security terms used in the OpenText Core SCA tool.
Last updated
Was this helpful?
A glossary of common security terms used in the OpenText Core SCA tool.
Last updated
Was this helpful?
Here are some of common security terms that are used within the tool:
This is a vulnerability published in an open database by NVD, with an assigned vulnerability ID known as CVE ID. Examples include Heartbleed (CVE-2014-0160) and Shellshock (CVE-2014-6271).
An open framework for describing the severity of vulnerabilities, where each vulnerability is given a score between 0 and 10, with 10 being critical.
This is a weakness, either in software or in hardware, that may be exploited in a specific system. The CWE list is a tree hierarchy with different levels of abstraction. An example of a CWE tree chain, from high to low abstraction, may look like:
"Improper Restriction of Operations within the Bounds of a Memory Buffer" (CWE-119) -> "Buffer Copy without Checking Size of Input" (CWE-120) -> "Stack-based Buffer Overflow" (CWE-121).
This is a naming scheme for IT systems, software, and packages. An example of a CPE string for the React framework, version 16, is:
cpe:2.3:a:facebook:react:16.0.0:*:*:*:*:*:*:*.
A package manager for JavaScript consisting of a command line client npm, along with an online database of packages known as the npm registry. npm handles local dependencies, as well as global JavaScript tools. As of 2023, npm has joined forces with GitHub.
An open database, managed by the U.S. government, for management of vulnerabilities. The information displayed is an aggregation of multiple sources along with a severity scoring using CVSS, the type of vulnerability as a CWE, and affected products as a CPE.
Have a look at the online course giving you an overview of security vulnerabilities and related topics. In this series, you will learn about:
Different types of security vulnerabilities
How to identify and mitigate them
Common attacks and how to protect your team from it
Whether you are a beginner or an experienced developer or a security professional, this series is designed to help you enhance your knowledge of open-source security and keep your code secure.
, improve your skills and stay ahead in the fast-changing world of technology.