US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by aeternum on Monday September 06, 2021 @08:03PM (#28439437)

It follows in theory but may not in practice. Certain software may have lots of defects that are not CVEs.

[ Parent | on HN ]

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by arghwhat on Tuesday September 07, 2021 @07:16AM (#28443344)

All products will have defects that are not CVEs, hopefully by a large margin.

But every sufficiently complicated product will have defects of this type, and a higher probability of defects does increase the probability of CVEs.

So, it follows in practice, as can be seen by looking at CVE rates from projects with high defect rates (web browsers, kernels, ...) vs projects with low defect rate.

Note that defect rate differences can be caused by multiple things.

[ Parent | on HN ]