cve-search is a tool to import CVE (Common Vulnerabilities and Exposures) and CPE (Common Platform Enumeration) into a MongoDB to facilitate search and processing of CVEs.

• Python 3
• MongoDB
• PyMongo
• sax parser (part of Python)

For the initial run, you need to populate the CVE database by running:

./db_mgmt.py -p
./db_mgmt_cpe_dictionnary.py

It will fetch all the existing XML files from the Common Vulnerabilities and Exposures database and the Common Platform Enumeration.

An updater script helps to start the db_mgmt_*

./db_updater.py -v

You can run it in a crontab, logging is done in syslog by default.

You can search the database using search.py

./search.py -p cisco:ios:12.4
./search.py -f nagios -n
./search.py -p microsoft:windows_7 -o html

If you want to search all the WebEx vulnerabilities and only printing the official references from the supplier.

./search.py -p webex: -o csv  -v "cisco"

Or you can use the XMPP bot

./search_xmpp.py -j [email protected] -p strongpassword

There is a ranking database allowing to rank software vulnerabilities based on their common platform enumeration name. The ranking can be done per organization or department within your organization or any meaningful name for you.

As an example, you can add a partial CPE name like "sap:netweaver" which is very critical for your accounting department.

./python3.3 db_ranking.py  -c "sap:netweaver" -g "accounting" -r 3

and then you can lookup the ranking (-r option) for a specific CVE-ID:

./python3.3 search.py -c CVE-2012-4341  -r  -n

cve-search is free software released under the "Modified BSD license"

Copyright (c) 2012 Wim Remes - https://github.com/wimremes/
Copyright (c) 2012 Alexandre Dulaunoy - https://github.com/adulau/