This schema defines National Vulnerability Database XML feed files. NVD XML Version: 1.1 Each element in this document is described by xs:annotation tags. This file is kept at http://nvd.nist.gov/download/nvdcve.xsd accompanying DTD at http://nvd.nist.gov/download/nvdcve.dtd NVD XML feeds and further documentation are available at http://nvd.nist.gov/download.cfm CVSS Scores and Vectors: Common Vulnerability Scoring System scores and vectors are now included in the NVD XML feed. Please see http://nvd.nist.gov/cvss.cfm?vectorinfo and http://www.first.org/cvss/cvss-guide.html for more information on how to interpret these data. Root element. Contains only "entry" child elements. Attributes for this element describe the version of the XML feed being read. Attributes: "nvd_xml_version" (required) => the schema and DTD version number currently supported by this document "pub_date" (required) => the date this document was compiled Documents one CVE entry. The child elements should always appear in the sequence defined below. These elements are compatible with entry elements from the CVE XML feeds. Attributes: "type" (required) => CVE or CAN "name" (required) => full CVE name "seq" (required) => sequence number from CVE name "nvd_name" => NVD name (if it exists) "discovered" => date discovered "published" (required) => date published "modified" => date modified "severity" => severity as determined by NVD analysts: High, Medium, or Low "reject" => indicates that this CVE entry has been rejected by CVE or NVD "CVSS_version" => CVSS Version Indicator "CVSS_base_score" => CVSS Base Score "CVSS_impact_score" => CVSS Impact Score "CVSS_exploit_score" => CVSS Exploit Score "CVSS_vector" => CVSS Vector Description wrapper tag, parent to any documented descriptions of this CVE entry. While the "desc" tag will always be present, there may be no "descript" child tags. Only one "descript" tag will exist for each description source (i.e. CVE, NVD, ...). Contains a specific description of this CVE entry from source indicated by the "source" attribute. Impact wrapper tag (may or may not be present). Only one "impact" tag will exist for each impact explanation source. Contains a specific impact explanation of this CVE entry from source indicated by the "source" attribute. Solution wrapper tag (may or may not be present). Only one "sol" tag will exist for each solution explanation source. Contains a specific solution explanation of this CVE entry from source indicated by the "source" attribute. Loss type tag (may or may not be present). Contains one loss type child for each loss type of this CVE entry. Potential loss types are: "avail" => availability "conf" => confidentiality "int" => integrity "sec_prot" => security protection Security Protection tag with one attribute for each security protection type. Potential security protection types are: "admin" => gain administrative access "user" => gain user access "other" => other Vulnerability type tag (may or may not be present). Contains one vulnerability type child for each vulnerability type of this CVE entry. Potential vulnerability types are: "access" => Access validation error "input" => Input validation error "design" => Design error "exception" => Exceptional condition error "env" => Environmental error "config" => Configuration error "race" => Race condition error "other" => other Input validation error tag with one attribute for each input validation error type. Potential input validation error types are: "bound" => Boundary condition error "buffer" => Buffer overflow Vulnerability range tag (may or may not be present). Contains one vulnerability range child for each vulnerability range of this CVE entry. Potential vulnerability ranges are: "local" => Locally exploitable "local_network" => Local network exploitable "network" => Network exploitable "user_init" => User accesses attacker Reference wrapper tag (always present). External references to this CVE entry are contained within this tag. Individual reference to this CVE entry. Text is the name of this vulnerability at this particular reference. Attributes: "source" (required) => Name of reference source "url" (required) => hyperlink to reference "sig" => indicates this reference includes a tool signature "adv" => indicates this reference is a Security Advisory "patch" => indicates this reference includes a patch for this vulnerability Vulnerable software wrapper tag (may or may not be present). Software affected by this CVE entry are listed within this tag. Product wrapper tag. Versions of this product that are affected by this vulnerability are listed within this tag. Attributes: "name" => Product name "vendor" => Vendor of this product Represents a version of this product that is affected by this vulnerability. Attributes: "num" => This version number "prev" => Indicates that versions previous to this version number are also affected by this vulnerability "edition" => Indicates the edition associated with the version number Defines date format for NVD. Dates follow the mask "yyyy-mm-dd" Restricts urls in NVD beyond the xs:anyURI restrictions. simpleType used for attributes that are only present when they are true. Such attributes appear only in the form attribute_name="1". simpleType used when scoring on a scale of 0-10, inclusive simpleType to describe the CVSS Base Vector