<![CDATA[Please nitpick the following (or suggest an authority, such as NIST or CISA )]]>Please nitpick the following (or suggest an authority, such as NIST or CISA )

A vulnerability is a weakness that can be exploited to gain some goal or milestone for an attacker, such as the ability to run code. Vulnerabilities are usually bugs which get patched, and weaknesses are a broader set that includes susceptibility to threats. Code which demonstrates that a vulnerability is exploitable is called “proof-of-concept” or PoC. A PoC may be developed into an exploit, which is code that actually achieves that goal. Weaponized exploit code has been made production-ready with reliability or integration into some attack framework. The attackers may be not be malicious, for example external researchers or penetration testers.

]]>https://board.circlewithadot.net/topic/159ad51f-8e08-4ca1-9489-0b550ba3bd5e/please-nitpick-the-following-or-suggest-an-authority-such-as-nist-or-cisaRSS for NodeFri, 17 Apr 2026 03:20:55 GMTSat, 04 Apr 2026 20:01:06 GMT60<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Mon, 06 Apr 2026 07:17:20 GMT]]>@adamshostack nails it pretty well imo

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/d3tm4r/statuses/116356536126448345https://board.circlewithadot.net/post/https://infosec.exchange/users/d3tm4r/statuses/116356536126448345Mon, 06 Apr 2026 07:17:20 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 21:41:56 GMT]]>@adamshostack

I would include under the umbrella of weakness "lack of observability."

It's a definite weakness if there's no monitoring in place to alert on obvious suspicious behaviour, and I don't see that accounted for in what's written.

]]>https://board.circlewithadot.net/post/https://infosec.space/users/fennix/statuses/116348611237431772https://board.circlewithadot.net/post/https://infosec.space/users/fennix/statuses/116348611237431772Sat, 04 Apr 2026 21:41:56 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 21:26:34 GMT]]>@heiglandreas It absolutely does, but in a nuanced way that's far less salient than say, "pwned."

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348550828388844https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348550828388844Sat, 04 Apr 2026 21:26:34 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:47:17 GMT]]>@adamshostack Another nitpick: consider changing “gain” to “reach” or “achieve”.

I agree with Prof. @mattblaze about “weaponize”. It’s my preferred alternative, but his suggestion “fieldable” works fine. Also consider “operational” or “operationalized” as alternatives closer to “weaponized”.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/0xd0ug/statuses/116348396348102297https://board.circlewithadot.net/post/https://infosec.exchange/users/0xd0ug/statuses/116348396348102297Sat, 04 Apr 2026 20:47:17 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:42:47 GMT]]>@adamshostack well does RCE not negatively influence integrity and confidentiality?

I mean... when someone can execurlte anything on a server, then integrity is compromised and confidentiality can't be guaranteed... 🤷

]]>https://board.circlewithadot.net/post/https://phpc.social/users/heiglandreas/statuses/116348378637298996https://board.circlewithadot.net/post/https://phpc.social/users/heiglandreas/statuses/116348378637298996Sat, 04 Apr 2026 20:42:47 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:39:38 GMT]]>Some vulnerabilities can't be exploited in ways that lead to attacker success, e.g. the next/previous line of defense is sound, but they're still vulnerabilities in that they allow one or more lines of defense to be bypassed.
I'd also ask:
- do bugs usually get patched?
- is this definition supposed to cover social-engineering or insider threats?
- is this definition supposed to cover volumetric DOS?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/BenAveling/statuses/116348366263099078https://board.circlewithadot.net/post/https://infosec.exchange/users/BenAveling/statuses/116348366263099078Sat, 04 Apr 2026 20:39:38 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:35:54 GMT]]>@adamshostack "Fieldable"

]]>https://board.circlewithadot.net/post/https://federate.social/users/mattblaze/statuses/116348351580823341https://board.circlewithadot.net/post/https://federate.social/users/mattblaze/statuses/116348351580823341Sat, 04 Apr 2026 20:35:54 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:26:26 GMT]]>@heiglandreas Yeah, I looked at that, and frankly, respond really negatively to "a negative impact to confidentiality, integrity, or availability" ; I've never found C/I/A to be that useful around RCE

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348314336810648https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348314336810648Sat, 04 Apr 2026 20:26:26 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:24:47 GMT]]>@mattblaze thanks! I thought about productize, bit not all 'fully developed' exploits are in products. do you have a better term handy?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348307861806336https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348307861806336Sat, 04 Apr 2026 20:24:47 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:23:44 GMT]]>@cford that is what i meant by milestone. I think it's misleading to claim that there are people who care about controlling EiP. They care about something else and that's a stepping stone along the way

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348303713732936https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348303713732936Sat, 04 Apr 2026 20:23:44 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:20:10 GMT]]>@adamshostack sounds about right. I like the definition from the @CVE_Program glossary as well, https://www.cve.org/ResourcesSupport/Glossary#glossaryVulnerability - especially how they explicitly mention the security policy.

]]>https://board.circlewithadot.net/post/https://merveilles.town/users/raboof/statuses/116348289709784042https://board.circlewithadot.net/post/https://merveilles.town/users/raboof/statuses/116348289709784042Sat, 04 Apr 2026 20:20:10 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:09:49 GMT]]>@adamshostack Would it make sense to say that a vulnerability can be exploited to attain some goal or achieve further compromise? Or is that what you mean by "milestone"?

]]>https://board.circlewithadot.net/post/https://toot.thoughtworks.com/users/cford/statuses/116348249004030064https://board.circlewithadot.net/post/https://toot.thoughtworks.com/users/cford/statuses/116348249004030064Sat, 04 Apr 2026 20:09:49 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:09:45 GMT]]>@adamshostack Nitpick: This seems to imply a progression from a PoC demo (something generally produced with the aim demonstrating a bug so it can be fixed) to actual exploit code. While that can certainly happen, we don't know that that distinction is always present for malicious exploits (it's only one path).

Also, people react to the term "weaponize". It carries some baggage. It doesn't particularly bother me, but some people dislike it.

]]>https://board.circlewithadot.net/post/https://federate.social/users/mattblaze/statuses/116348248735309266https://board.circlewithadot.net/post/https://federate.social/users/mattblaze/statuses/116348248735309266Sat, 04 Apr 2026 20:09:45 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:09:08 GMT]]>@adamshostack I know. I was asking myself that question every time I answer Bug-Bounty reports.

NIST defines it quite well in https://nvd.nist.gov/vuln - but that definition focuses on the attacked party and the impact on them.

Which is why I asked....

]]>https://board.circlewithadot.net/post/https://phpc.social/users/heiglandreas/statuses/116348246312590519https://board.circlewithadot.net/post/https://phpc.social/users/heiglandreas/statuses/116348246312590519Sat, 04 Apr 2026 20:09:08 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:06:04 GMT]]>@heiglandreas I think that in this context, the vulnerability is a more specific concept than the wider English term.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348234257881949https://board.circlewithadot.net/post/https://infosec.exchange/users/adamshostack/statuses/116348234257881949Sat, 04 Apr 2026 20:06:04 GMT<![CDATA[Reply to Please nitpick the following (or suggest an authority, such as NIST or CISA ) on Sat, 04 Apr 2026 20:03:56 GMT]]>@adamshostack Is a vulnerability something that benefits the attacker? Or something that hurts the attacked? (and being the IP-source of an attack on someone else *is* hurting the attacked)

]]>https://board.circlewithadot.net/post/https://phpc.social/users/heiglandreas/statuses/116348225899999958https://board.circlewithadot.net/post/https://phpc.social/users/heiglandreas/statuses/116348225899999958Sat, 04 Apr 2026 20:03:56 GMT