In the following, you'll learn about the factors considered when assessing a vulnerability:
Public internet exposure is one of the risk assessment factors taken into consideration when determining the Davis Security Score.
If there is public internet exposure, it means that vulnerabilities affect at least one process that is exposed to the internet.
Filter vulnerabilities by Risk assessment > Public internet exposure.
How is public internet exposure determined?
Reachable data assets are one of the risk assessment factors taken to consideration when determining the Davis Security Score. If there are any reachable data assets affected it means that vulnerabilities affect at least one process that has database access (runs a database service).
Filter vulnerabilities by Risk assessment > Reachable data assets
Prioritize vulnerabilities based on risk factors: Get details about reachable data assets
Third-party vulnerabilities
Vulnerable functions are one of the risk assessment factors to consider when evaluating a vulnerability (yet they are not considered for the DSS calculation).
If there are any vulnerable functions in use, there is at least one process using a vulnerable function (this might indicate a higher exploitation risk).
The class that contains the vulnerable function related to the vulnerability.
org.apache.http.client.utils.URIUtilsShows whether the vulnerable function is being used by your application. Based on whether your application uses the vulnerable function, you can assess the impact on your environment. The usage of a vulnerable function is calculated on the process level and is aggregated to the process group level, which results in a count of affected process groups per function.
In use, Not in use, Not availableVulnerable functions in useThird-party vulnerabilities
One of the risk factors to be considered when assessing a vulnerability. If there is any public exploit published, it means that malicious code to exploit this vulnerability is available on the internet.
Filter vulnerabilities by Risk assessment > Public exploit published.
Reduced accuracy means detailed analysis is not possible for various reasons, for example when there are vulnerabilities with related hosts running in Infrastructure Monitoring mode or OneAgent Discovery mode.
How this affects the DSS calculation: The context of internet exposure or reachable data assets cannot be examined due to the lack of information, thus the DSS score can't be lowered. For more information, see Monitoring modes.
When Full-Stack Monitoring isn't enabled, an alert is displayed on the details page of a vulnerability.
Filter for Risk assessment > Reduced accuracy to find out which vulnerabilities have reduced accuracy.