A method to assess 'forgivable' vs 'unforgivable' vulnerabilities

A method to assess 'forgivable' vs 'unforgivable' vulnerabilities ↗ source

January 28, 2025 NCSC Analysis Report

Co-sealed by: CISA, NCSC-UK

Source: https://www.ncsc.gov.uk/report/a-method-to-assess-forgivable-vs-unforgivable-vulnerabilities

Summary

In fact, the number of Common Vulnerabilities and Exposures (CVEs) in commodity technology continues to rise. While there are a number of factors that are driving the increasing numbers, the NCSC expect this trend to continue unless interventions are made. But vulnerabilities that are trivial to find (and that occur time and time again) are ones the NCSC are aiming to drive down at scale. These ‘unforgivable vulnerabilities', a phrase coined by Steve Christie in his 2007 MITRE paper, ‘are beacons of a systematic disregard for secure development practices. They simply should not appear in software that has been designed, developed, and tested with security in mind’.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2021-26084	9.8 Critical	Atlassian Confluence Server and Data Center Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthentica…
CVE-2023-34362	9.8 Critical	Progress MOVEit Transfer Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Tr…
CVE-2023-27997	9.2 Critical	Fortinet FortiOS and FortiProxy SSL-VPN Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to exe…
CVE-2023-36934	—	n/a n/a In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Microsoft 388 KEV Apple 94 KEV Google 75 KEV Apache 40 KEV Fortinet 30 KEV Atlassian 13 KEV Progress 9 KEV Red Hat 9 KEV JetBrains 4 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.