Practical Security Automation and Testing

CVE vulnerability scanning

The known vulnerability scan is to identify the known CVE of the modules, libraries, source code, add-ons, services, and applications used in the infrastructure. To archive these kinds of scanning, we will introduce two main different approaches. The OWASP dependency check is a local scan of files to identify the vulnerabilities. This type of scan approach can be more accurate than a network scan. However, if the local scan of files is not feasible, we will use the network scan Nmap instead. Here is the summary of these two scan approaches:

OWASP dependency check	NMAP-VulScan
Approaches	Package properties, such as libraries, filename	Network communications, such as port and protocol versions
Vulnerability ...