VulnerableCode manual comparison

[Hritik14]

List of manually found instances where VulnerableCode performed better compared to other sources.

[Hritik14]

Encounter with NVD

1. CVE-2020-7789 at NVD (https://nvd.nist.gov/vuln/detail/CVE-2020-7789) shows CPE as cpe:2.3:a:node-notifier_project:node-notifier:*:*:*:*:*:node.js:*:* which reads in plain English as Up to (excluding) 8.0.1
2. This would mean node-notifier (https://www.npmjs.com/package/node-notifier?activeTab=versions) version 5.4.5 is also vulnerable
3. Although VC does not show 5.4.5 vulnerable because it realises 5.4.5 was released AFTER the advisory was published. Win for time travel !
4. BUT
5. Expanding the cpe at NVD (Show Matching CPE(s) button), also does NOT list 5.4.5
6. Did they also implement time-travel in cpe ? That'd be weird as there's no such clue in the cpe name itself
7. No. It's just that the last modified time for the advisory is too old that 5.4.5 was not even released. (NVD Last Modified: 12/17/2020). They didn't need to time travel, they're living in the past
8. Well, the advisory was published by snyk, they must be right at their end !
9. Yes! https://security.snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794
10. and No... https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371