More Software Vulnerabilities Disclosed in 2016 Than Ever Before

1 of 9

More Software Vulnerabilities Disclosed in 2016 Than Ever Before

Risk Based Security's software vulnerability report for 2016 shows find that the number of new flaws found during the year set a record and that bug bounty programs are an important source of new discoveries.

2 of 9

The Number of Vulnerabilities Keeps Rising

According to Risk Based Security's VulnDB vulnerability tracking system, there were 15,000 reported vulnerabilities in 2016, setting a new record.

3 of 9

Vulnerability Impact Varies

Not all of the vulnerabilities reported in any given year have the same impact. Common Vulnerabilities Scoring System (CVSS) scores, which attempt to measure the impact of a given vulnerability, have been trending higher in recent years, showing that both the volume and severity of vulnerabilities are on the rise.

4 of 9

Vulnerabilities Were More Severe in 2016

Looking specifically at 2016, 21.3 percent of vulnerabilities in VulnDB had a CVSS score of between 9.0 and 10.0.

5 of 9

Most Vulnerabilities Are Verified by Vendors

Of the vulnerabilities reported by VulnDB for the year, 80.1 percent were verified by a vendor, prior to being disclosed.

6 of 9

Bug Bounty Programs Are Finding More Flaws

According to VulnDB, since 2013, bug bounty programs have becoming a leading source of disclosures, outpacing vendors' own abilities to discover flaws.

7 of 9

Vendor Response Times Vary

Different vendors had different response rates for dealing with vulnerabilities in 2016. VulnDB tracks the rates with its Vulnerability Timeline and Exposure Metrics (VTEM) system. Google had the fasted response time at only three days.

8 of 9

XSS is the Most Common Web Vulnerability

Looking specifically at web vulnerabilities, Cross Site Scripting (XSS) accounted for 37 percent of reported web vulnerabilities in 2016, according to VulnDB.

9 of 9

Privacy-Focused Tails 2.10 Linux Includes Security Updates, New Tools

The Amnesic Incognito Live System, also known more simply as Tails, is a privacy-focused Linux distribution loaded with tools and features to help users stay somewhat anonymous on the internet. Tails first rose to prominence in 2013 as the Linux distribution used by U.S. National Security Agency (NSA) whistleblower Edward Snowden and reached the 1.0 milestone in April 2014. The latest Tails release is version 2.10, which became generally available Jan. 24, providing users with security patches and some incremental feature updates. Among the new features in the Tails 2.10 release is the Onion Share anonymous file-sharing tool. Staying anonymous online is a core element of Tails, thanks to the integration with the Tor (The Onion Router) network technology. Tor also is updated in the Tails 2.10 release, to version and the included Tor Browser, which is based on Mozilla's Firefox, is...
Top White Papers and Webcasts