English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The Common Vulnerability Scoring System (CVSS) is a popular method forevaluating the severity of vulnerabilities in vulnerability management. In theevaluation process, a numeric score between 0 and 10 is calculated, 10 beingthe most severe (critical) value. The goal of CVSS is to provide comparablescores across different evaluators. However, previous works indicate that CVSSmight not reach this goal: If a vulnerability is evaluated by several analysts,their scores often differ. This raises the following questions: Are CVSSevaluations consistent? Which factors influence CVSS assessments? Wesystematically investigate these questions in an online survey with 196 CVSSusers. We show that specific CVSS metrics are inconsistently evaluated forwidespread vulnerability types, including Top 3 vulnerabilities from the ''2022CWE Top 25 Most Dangerous Software Weaknesses'' list. In a follow-up surveywith 59 participants, we found that for the same vulnerabilities from the mainstudy, 68% of these users gave different severity ratings. Our study revealsthat most evaluators are aware of the problematic aspects of CVSS, but theystill see CVSS as a useful tool for vulnerability assessment. Finally, wediscuss possible reasons for inconsistent evaluations and providerecommendations on improving the consistency of scoring.

Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities