GitHub
Home / Documentation / Vulnerability Category - Event Types

Complete reference for security vulnerability types including CVEs, misconfigurations, and open services

Vulnerability Category

Security vulnerabilities, misconfigurations, and open services that pose security risks. Used by security researchers, vulnerability disclosure programs, and system administrators.

Field Legend

  • 🟠 Mandatory - MUST be present in all valid reports
  • 🟢 Recommended - SHOULD be included when information is available
  • 🔵 Optional - MAY be included for additional context

cve

Use Case: Reports of systems affected by known CVE (Common Vulnerabilities and Exposures). Used by vulnerability management teams, security researchers, and coordinated disclosure programs to notify affected parties.

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T10:00:00Z",
  🟠 "reporter": {
    "org": "Vulnerability Scanner Service",
    "contact": "[email protected]",
    "domain": "scanner.example"
  },
  🟠 "sender": {
    "org": "Vulnerability Scanner Service",
    "contact": "[email protected]",
    "domain": "scanner.example"
  },
  🟠 "source_identifier": "192.0.2.100",
  🟠 "category": "vulnerability",
  🟠 "type": "cve",

  🟢 "source_port": 443,
  🟢 "evidence_source": "automated_scan",
  🟢 "evidence": [
    {
      "content_type": "application/json",
      "description": "CVE scan results",
      "payload": "eyJjdmUiOiJDVkUtMjAyNC0xMjM0NSIsInNldmVyaXR5IjoiaGlnaCJ9"
    }
  ],
  🔵 "confidence": 0.95,

  🔵 "tags": ["cve:CVE-2024-12345", "severity:high"],
  🔵 "description": "Server vulnerable to CVE-2024-12345 (Apache Log4j RCE)"
}

Schema

misconfiguration

Use Case: Reports of security misconfigurations such as weak TLS settings, exposed admin interfaces, or insecure cloud storage. Used by security teams to identify and remediate configuration issues before exploitation.

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T12:00:00Z",
  🟠 "reporter": {
    "org": "Cloud Security Monitoring",
    "contact": "[email protected]",
    "domain": "monitor.example"
  },
  🟠 "sender": {
    "org": "Cloud Security Monitoring",
    "contact": "[email protected]",
    "domain": "monitor.example"
  },
  🟠 "source_identifier": "203.0.113.75",
  🟠 "category": "vulnerability",
  🟠 "type": "misconfiguration",

  🟢 "source_port": 443,
  🟢 "evidence_source": "automated_scan",
  🟢 "evidence": [
    {
      "content_type": "application/json",
      "description": "Misconfiguration scan results",
      "payload": "eyJpc3N1ZSI6IndlYWtfY2lwaGVycyIsInNzbF92ZXJzaW9uIjoiVExTdjEuMCJ9"
    }
  ],
  🔵 "confidence": 0.92,

  🔵 "tags": ["config:weak_tls", "protocol:ssl"],
  🔵 "description": "Server using weak TLS 1.0 with outdated cipher suites"
}

Schema

open_service

Use Case: Reports of open services that should not be publicly accessible (DNS resolvers, NTP servers, memcached, SSDP) which can be exploited for DDoS amplification or other attacks. Used by ISPs and organizations like Shadowserver to notify operators of potentially exploitable services.

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T14:30:00Z",
  🟠 "reporter": {
    "org": "Shadowserver Foundation",
    "contact": "[email protected]",
    "domain": "shadowserver.org"
  },
  🟠 "sender": {
    "org": "Shadowserver Foundation",
    "contact": "[email protected]",
    "domain": "shadowserver.org"
  },
  🟠 "source_identifier": "198.51.100.200",
  🟠 "category": "vulnerability",
  🟠 "type": "open_service",

  🟢 "source_port": 53,
  🟢 "evidence_source": "automated_scan",
  🟢 "evidence": [
    {
      "content_type": "text/plain",
      "description": "Open DNS resolver scan results",
      "payload": "T3BlbiBETlMgcmVzb2x2ZXIgZGV0ZWN0ZWQgb24gcG9ydCA1Mw=="
    }
  ],
  🔵 "confidence": 0.98,

  🔵 "tags": ["open:dns_resolver", "risk:amplification"],
  🔵 "description": "Open DNS resolver exploitable for DDoS amplification"
}

Schema