merge with 0.1.0-dev (#74) * Refactor icons .ics and .ico are replaced by https://vulnogram.github.io/vg-icons/dist/ * Refactor icons and CSS * Cache ace editor * Add linkify * Add CAPEC * Refactor scripts * refactor query middleware * Refactor document model * Dockerize * Cleanup * Fix bulk update rendering * Upgrade packages * Refactor icons * Upgrade ace and json-editor cached copies. * CVE JSON 5.0 support * Update app.js * Add rate limiter * Update ace and jsoneditor versions * Update cve5.schema.json * Integrate with CVE services API * Versions display * CSS changes * Upgrade ace * Add CNA private workflow object * Rearrange buttons * Update error display * Update for vg-icons * Fix user list CSS/icons * Improve conf * fix version display * Delete CNA_private from standalone schema * Sync to CVE JSON newer changes, Support using production endpoint. * Remove the next year button, (needs logic to show only in Dec) * change URL to cve.org, update json-editor to 2.6.1 * Refactor CVE v4 for vulnogram 0.1.0 UI changes * fix id path * display option changes, make use of label-next-to-input (lni) style * implement logout button * implement logout, label test and production clearly * Sync to Vulnogram 0.1.0 configs * Don't escpace CSS * include table sorting in standalone * Introduce formClass option, fix how errors are displayed for simplehtml types. * introduce label-next-to-input style (lni) to compact the display * Show a label for CVE 4.0 (interim) * add some examples. * Move CVE portal login button inside the tab - provide a portal experience. * fix transparent date input * Use the cve.org URL * Add checks for schema compliant products and versions. * indent * Add more placeholders, examples fixed a bug where error messages were not clearing on valid input * fixes - Show object's delete button next to obj label. - show placeholders for taglists - fixed bug where error messages were not clearing * better rendering of CVE JSON5 record/ remove JSON tab. * remove cna fullname reference * Update package.json * Enable loading the cvelistv5 review JSONs * validate x_ type tags. * better tags and schema sync to CVE-JSON 5.0 RC-6 * refactor product version display * add CVSS colors, and tagify * better taglist * remove select2, add tagify.js * Improvements * Fix the css for Safari, remove select2 styles * remove console.log * Sync cve.js (support for Safari and FireFox) * Experimental - basic form based creds prompt. Experimental : separating credential intake from cve.js * fixes * refactor Portal GUI * Improve list rendering/loading/results * use serviceWorkers (expermental) * Integrates latest from cve.js (#61) * minor fixes * sync with https://github.com/xdrr/cve.js/tree/feature/cred-mgmt * Support direct reject of reserved IDs * Updates to enable the CVE submit API * Hide datePublic until the services schema is updated. * user mgmt draft * Adds paging to the CVE Issue #54 (#73) * Adds paging to the CVE Issue #54 * Reintroduce reserver more buttons. * introduce /static directory to serve static content * fix js paths * user management: add keyreset, add user * show errors * Update script.js Co-authored-by: Ben N., Vijay S.
Making the world safer one CVE ID at a time, since 2017.
Vulnogram is a tool for creating and editing CVE information in CVE JSON format, and for generating advisories.
The name Vulnogram is inspired from Greek origin suffix ‘-gram’ which is used for denoting something written or recorded especially in a certain way. Vulnerability related information when recorded in a standard format can help in aggregation, curation, dissemination, analysis and remediation. This enables automation and efficiency in response activities.
Vulnogram project aims to make it easier for vendors and security researchers to accurately record vulnerability information for inclusion in the CVE List.
Vulnogram can be deployed in two modes:
| Browser mode | Server mode |
|---|---|
| Frontend web UI only, as seen on vulnogram.github.io. | A NodeJS web application serves frontend web UI for a backend Mongodb. |
| It is a Javascript based tool to open, import, edit, preview and save JSON documents which conform to a given JSON-Schema. | It is a modern scalable issue tracker similar to JIRA or bugtrack but using JSON-Schemas as data models and a NoSQL database as a backend. Along with customizable plugins it can be used for tracking anything that can be expressed with a JSON-Schema. plugins are available for tracking security incidents, tickets, contacts, NVD entries and CVE assignments. |
| Can't save CVE JSON drafts. | JSON documents are saved to a NoSQL (Mongodb) backend. |
| No login required. | Users are authenticated. |
| No workflow or tracking. | Allows tracking, querying, searching, version control, audit trail of changes, commenting and dashboard charts and graphs on collections of JSON documents. |
| Security considerations: 👍 Information entered in the tool is not transmitted anywhere out of the browser. ℹ️ Download button saves the JSON document in the browser to a local file. ⚠️ Ensure local filesystem is secured. ⚠️ Avoid using the tool on a public computer (beware of browser autofill). | Security considerations: ℹ️ Configure HTTPS in the config file. ⚠️ Ensure that MongoDB is secured and hardened. Mongodb backend is used for storing documents on the server. ⚠️ Keep configuration files secured. ⚠️ Only create accounts for trusted users. There is no RBAC or ACL feature (as of now)! |
$ cd vulnogram $ npm install ... this should install required dependencies ...
See https://www.mongodb.com/
Important: Ensure mongodb authentication is enabled. It is recommended to run mongodb bound to loopback/localhost and not expose it to network.
See config/conf-default.js comments for hints
$ node useradd.js tester tester@example.com Tester sirt@example.com 1 Enter Password: ******************************************** Enter Password again: ******************************************** Success New user is now registered and can log in: tester
$ npm start > Vulnogram@0.0.6 start /home/vulnogram/ > forever start --id 'vulnogram' --spinSleepTime 5000 --minUptime 2000 app.js info: Forever processing file: app.js info: Forever processes running data: uid command script forever pid id logfile uptime data: [0] v3wE /usr/bin/node app.js 11208 11210 vulnogram /home/vulnogram/.forever/v3wE.log 0:0:0:0.23
http://localhost:3555/ or https://localhost:3555/ depending on configuration.
$ make min
This creates standalone /index.html with minimized javascript and stylesheets can be hosted independently on websites serving static files. This does not require the backend mongodb server or the nodejs server application to be running.
Note: Opening the index.html as a file URL may not work since some browsers (including Chrome) will not run async requests on file:// URLs. It is recommended to serve these files from a webserver. See https://developer.mozilla.org/en-US/docs/Learn/Common_questions/set_up_a_local_testing_server for examples on how to run a simple testing webserver.
This project uses or depends on software from
Copyright (c) 2017-2019 Chandan B N.
SPDX-License-Identifier: MIT
