Open Vulnerability Assessment Language (OVAL)

https://oval.mitre.org/

Open Vulnerability Assessment Language (OVAL) is a publicly available information security international standard used to evaluate and detail the system's current state and issues.

OVAL Process

OVAL Definitions

The OVAL definitions are recorded in an XML format to discover any software vulnerabilities, misconfigurations, programs, and additional system information taking out the need to exploit a system.By having the ability to identify issues without directly exploiting the issue, an organization can correlate which systems need to be patched in a network.

The four main classes of OVAL definitions consist of:

• OVAL Vulnerability Definitions: Identifies system vulnerabilities
• OVAL Compliance Definitions: Identifies if current system configurations meet system policy requirements
• OVAL Inventory Definitions: Evaluates a system to see if a specific software is present
• OVAL Patch Definitions: Identifies if a system has the appropriate patch

Common Vulnerabilities and Exposures (CVE)

Common Vulnerabilities and Exposures (CVE) is a publicly available catalog of security issues sponsored by the United States Department of Homeland Security (DHS). Each security issue has a unique CVE ID number assigned by the CVE Numbering Authority (CNA).