From 36d97d69f8e6dd8b2acdbd1660cb64af0451ed60 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:23:05 -0400 Subject: [PATCH 1/5] Enhanced 10/add ghsa field/value; Deleted 1 advisory --- gems/activerecord/CVE-2012-2660.yml | 7 +++++++ gems/brakeman/CVE-2019-18409.yml | 22 ++++++++++++++------- gems/concurrent-ruby/CVE-2026-54904.yml | 10 +++++----- gems/dragonfly/CVE-2013-1756.yml | 23 ++++++++++++++++++++-- gems/fog-dragonfly/CVE-2013-1756.yml | 21 ++++++++++++++++++++ gems/gollum-grit_adapter/CVE-2014-9489.yml | 15 +++++++++++++- gems/rack-protection/CVE-2018-7212.yml | 12 ----------- gems/sinatra/CVE-2018-7212.yml | 13 +++++++++++- gems/spree/CVE-2013-2506.yml | 4 ++++ gems/spree_auth/CVE-2013-2506.yml | 6 +++++- gems/spree_auth_devise/CVE-2013-2506.yml | 5 ++++- 11 files changed, 108 insertions(+), 30 deletions(-) delete mode 100644 gems/rack-protection/CVE-2018-7212.yml diff --git a/gems/activerecord/CVE-2012-2660.yml b/gems/activerecord/CVE-2012-2660.yml index e04b3539bb..63b2399fa1 100644 --- a/gems/activerecord/CVE-2012-2660.yml +++ b/gems/activerecord/CVE-2012-2660.yml @@ -2,6 +2,7 @@ gem: activerecord framework: rails cve: 2012-2660 +ghsa: hgpp-pp89-4fgf osvdb: 82610 url: https://nvd.nist.gov/vuln/detail/CVE-2012-2660 title: "CVE-2012-2660 rubygem-actionpack: Unsafe query generation" @@ -15,6 +16,12 @@ description: | a related issue to CVE-2012-2694. cvss_v2: 7.5 patched_versions: + - "~> 2.3.16" - "~> 3.0.13" - "~> 3.1.5" - ">= 3.2.4" +related: + url: + - https://github.com/advisories/GHSA-hgpp-pp89-4fgf +notes: | + - Added GHSA data plus 2.3.16 patch from GHSA. diff --git a/gems/brakeman/CVE-2019-18409.yml b/gems/brakeman/CVE-2019-18409.yml index 6191c9264d..f54dbe8936 100644 --- a/gems/brakeman/CVE-2019-18409.yml +++ b/gems/brakeman/CVE-2019-18409.yml @@ -1,23 +1,31 @@ --- gem: brakeman cve: 2019-18409 +ghsa: hhwc-8g49-j8jx date: 2019-10-24 -url: https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released +url: https://nvd.nist.gov/vuln/detail/CVE-2019-18409 title: brakeman world writable files allow local privilege escalation description: | - The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local - privilege escalation because of world-writable files. For example, - if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, - a local user can insert malicious code into the + If the brakeman gem (which has a legacy dependency) 4.5.0 through + 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file. + + The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows + local privilege escalation because of world-writable files cvss_v2: 4.6 cvss_v3: 7.8 patched_versions: - ">= 4.7.1" - unaffected_versions: - "<= 4.4.0" - related: url: + - https://nvd.nist.gov/vuln/detail/CVE-2019-18409 + - https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released + - https://rubygems.org/gems/brakeman + - https://rubygems.org/gems/ruby_parser-legacy + - https://github.com/zenspider/ruby_parser-legacy/releases/tag/v1.0.0 - https://github.com/zenspider/ruby_parser-legacy/issues/1 + - https://github.com/advisories/GHSA-hhwc-8g49-j8jx +notes: | + - cvss_v3 and cvss_v2 from nvd.nist.go URL. diff --git a/gems/concurrent-ruby/CVE-2026-54904.yml b/gems/concurrent-ruby/CVE-2026-54904.yml index 75629b716e..4aaff10a09 100644 --- a/gems/concurrent-ruby/CVE-2026-54904.yml +++ b/gems/concurrent-ruby/CVE-2026-54904.yml @@ -2,7 +2,7 @@ gem: concurrent-ruby cve: 2026-54904 ghsa: h8w8-99g7-qmvj -url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54904 +url: https://nvd.nist.gov/vuln/detail/CVE-2026-54904 title: Concurrent Ruby - `AtomicReference#update` livelocks when the stored value is `Float::NAN` date: 2026-06-19 @@ -37,18 +37,18 @@ description: | ### Credit Pranjali Thakur - depthfirst ([depthfirst.com]()) +cvss_v3: 7.5 cvss_v4: 8.2 patched_versions: - ">= 1.3.7" related: url: - - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54904 + - https://nvd.nist.gov/vuln/detail/CVE-2026-54904 - https://rubygems.org/gems/concurrent-ruby/versions/1.3.7 - https://github.com/ruby-concurrency/concurrent-ruby/releases/tag/v1.3.7 - https://advisories.gitlab.com/gem/concurrent-ruby/CVE-2026-54904 - https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj - https://github.com/advisories/GHSA-h8w8-99g7-qmvj notes: | - - cvss_v4 from GHSA - - CVE is reserved, but not published. - - Not on nvd.nist.gov so no cvss_v2 or cvss_v3. + - cvss_v4 from GHSA and nvd.hist.gov URLs. + - cvss_v3 from nvd.hist.gov URL. diff --git a/gems/dragonfly/CVE-2013-1756.yml b/gems/dragonfly/CVE-2013-1756.yml index 38e4dc3e14..d867b5ba90 100644 --- a/gems/dragonfly/CVE-2013-1756.yml +++ b/gems/dragonfly/CVE-2013-1756.yml @@ -1,8 +1,8 @@ --- gem: dragonfly cve: 2013-1756 -osvdb: 90647 ghsa: p463-639r-q9g9 +osvdb: 90647 url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756 title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution date: 2013-02-19 @@ -14,4 +14,23 @@ cvss_v2: 7.5 unaffected_versions: - "< 0.7.0" patched_versions: - - ">= 0.9.13" + - "~> 0.8.6" + - ">= 0.9.14" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-1756 + - https://rubygems.org/gems/dragonfly/versions/0.9.14 + - https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo + - https://github.com/markevans/dragonfly/releases/tag/v0.9.14 + - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 + - https://github.com/markevans/dragonfly/releases/tag/security_fix + - https://rubygems.org/gems/dragonfly/versions/0.8.6 + - https://github.com/markevans/dragonfly/releases/tag/v0.8.6 + - https://github.com/markevans/dragonfly/compare/v0.8.5...v0.8.6 + - https://exchange.xforce.ibmcloud.com/vulnerabilities/82476 + - https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225 + - https://github.com/advisories/GHSA-p463-639r-q9g9 +notes: | + - See commit URL for patch note in repo's README file. + - Patch was backported to "0.8.6". + - cvss_v2 from nvd.nist.gov URL. diff --git a/gems/fog-dragonfly/CVE-2013-1756.yml b/gems/fog-dragonfly/CVE-2013-1756.yml index 29abe97831..7e1ecc406f 100644 --- a/gems/fog-dragonfly/CVE-2013-1756.yml +++ b/gems/fog-dragonfly/CVE-2013-1756.yml @@ -1,6 +1,7 @@ --- gem: fog-dragonfly cve: 2013-1756 +ghsa: p463-639r-q9g9 osvdb: 90647 url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756 title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution @@ -15,4 +16,24 @@ cvss_v2: 7.5 unaffected_versions: - "< 0.7.0" patched_versions: + - "~> 0.8.6" - ">= 0.9.14" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2013-1756 + - https://rubygems.org/gems/dragonfly/versions/0.9.14 + - https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo + - https://github.com/markevans/dragonfly/releases/tag/v0.9.14 + - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 + - https://github.com/markevans/dragonfly/releases/tag/security_fix + - https://rubygems.org/gems/dragonfly/versions/0.8.6 + - https://github.com/markevans/dragonfly/releases/tag/v0.8.6 + - https://github.com/markevans/dragonfly/compare/v0.8.5...v0.8.6 + - https://rubygems.org/gems/fog-dragonfly + - https://exchange.xforce.ibmcloud.com/vulnerabilities/82476 + - https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225 + - https://github.com/advisories/GHSA-p463-639r-q9g9 +notes: | + - See commit URL for patch note in repo's README file. + - Patch was backported to "0.8.6". + - cvss_v2 from nvd.nist.gov URL. diff --git a/gems/gollum-grit_adapter/CVE-2014-9489.yml b/gems/gollum-grit_adapter/CVE-2014-9489.yml index 30d2b70fbc..73edbb4b57 100644 --- a/gems/gollum-grit_adapter/CVE-2014-9489.yml +++ b/gems/gollum-grit_adapter/CVE-2014-9489.yml @@ -1,7 +1,8 @@ --- gem: gollum-grit_adapter cve: 2014-9489 -url: https://github.com/gollum/gollum/issues/913 +ghsa: q97v-764g-r2rp +url: https://nvd.nist.gov/vuln/detail/CVE-2014-9489 title: gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution @@ -19,5 +20,17 @@ description: | Note that the grep result must find the string 'master' (or whatever is the default branch that gollum uses) in any of the wiki's documents for this to succeed. +cvss_v2: 6.5 +cvss_v3: 8.8 patched_versions: - ">= 0.1.1" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2014-9489 + - https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7 + - https://github.com/gollum/gollum/issues/913 + - http://www.openwall.com/lists/oss-security/2015/01/03/19 + - https://web.archive.org/web/20200229041306/http://www.securityfocus.com/bid/71499 + - https://github.com/advisories/GHSA-q97v-764g-r2rp +notes: | + - cvss_v2 and cvss_v3 from nvd.nist.gov URL. diff --git a/gems/rack-protection/CVE-2018-7212.yml b/gems/rack-protection/CVE-2018-7212.yml deleted file mode 100644 index afc51242d8..0000000000 --- a/gems/rack-protection/CVE-2018-7212.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -gem: rack-protection -cve: 2018-7212 -url: https://github.com/sinatra/sinatra/pull/1379 -title: Path traversal is possible via backslash characters on Windows. -date: 2018-02-18 -description: | - An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal - is possible via backslash characters. -patched_versions: - - ">= 2.0.1" - - "~> 1.5.4" diff --git a/gems/sinatra/CVE-2018-7212.yml b/gems/sinatra/CVE-2018-7212.yml index d33e69b754..0488f22901 100644 --- a/gems/sinatra/CVE-2018-7212.yml +++ b/gems/sinatra/CVE-2018-7212.yml @@ -2,7 +2,7 @@ gem: sinatra cve: 2018-7212 ghsa: h29f-7f56-j8wh -url: https://github.com/sinatra/sinatra/pull/1379 +url: https://nvd.nist.gov/vuln/detail/CVE-2018-7212 title: sinatra ruby gem path traversal via backslash characters on Windows date: 2018-01-09 description: | @@ -15,3 +15,14 @@ unaffected_versions: - "< 2.0.0" patched_versions: - ">= 2.0.1" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2018-7212 + - https://rubygems.org/gems/sinatra/versions/2.0.1 + - https://github.com/sinatra/sinatra/pull/1379 + - https://github.com/sinatra/sinatra/commit/6ad721abcfe36334108dcdd05d046c361e1b7a9c + - https://github.com/advisories/GHSA-h29f-7f56-j8wh +notes: | + - cvss_v2 and cvss_v3 from nvd.nist.gov URL. + - "patched_versions" to "sinatra" gem verified in commit URL. + - "unaffected_versions" from global GHSA. diff --git a/gems/spree/CVE-2013-2506.yml b/gems/spree/CVE-2013-2506.yml index 0352dd3f66..4d1c9f941f 100644 --- a/gems/spree/CVE-2013-2506.yml +++ b/gems/spree/CVE-2013-2506.yml @@ -2,6 +2,7 @@ gem: spree cve: 2013-2506 osvdb: 90865 +ghsa: jp57-9j37-5476 url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed title: Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege @@ -18,3 +19,6 @@ patched_versions: - "~> 1.1.6" - "~> 1.2.0" - ">= 1.3.0" +related: + url: + - https://github.com/advisories/GHSA-jp57-9j37-5476 diff --git a/gems/spree_auth/CVE-2013-2506.yml b/gems/spree_auth/CVE-2013-2506.yml index d25bdd8327..cd6c168260 100644 --- a/gems/spree_auth/CVE-2013-2506.yml +++ b/gems/spree_auth/CVE-2013-2506.yml @@ -2,7 +2,8 @@ gem: spree_auth cve: 2013-2506 osvdb: 90865 -url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed +ghsa: jp57-9j37-5476 +url: https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed title: Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation @@ -14,3 +15,6 @@ description: | a user. This may allow a remote attacker to assign arbitrary roles and gain elevated administrative privileges. cvss_v2: 4.0 +related: + url: + - https://github.com/advisories/GHSA-jp57-9j37-5476 diff --git a/gems/spree_auth_devise/CVE-2013-2506.yml b/gems/spree_auth_devise/CVE-2013-2506.yml index df7ddb4596..e9bbad3e20 100644 --- a/gems/spree_auth_devise/CVE-2013-2506.yml +++ b/gems/spree_auth_devise/CVE-2013-2506.yml @@ -3,7 +3,7 @@ gem: spree_auth_devise cve: 2013-2506 osvdb: 90865 ghsa: jp57-9j37-5476 -url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed +url: https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed title: Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation date: 2013-02-21 description: | @@ -17,3 +17,6 @@ patched_versions: - "~> 1.1.6" - "~> 1.2.0" - ">= 1.3.0" +related: + url: + - https://github.com/advisories/GHSA-jp57-9j37-5476 From d9c7f9f732f1f0772e087af5d813a267b7240f3a Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 6 Aug 2026 16:36:11 -0400 Subject: [PATCH 2/5] Delete gems/spree_auth/CVE-2013-2506.yml --- gems/spree_auth/CVE-2013-2506.yml | 20 -------------------- 1 file changed, 20 deletions(-) delete mode 100644 gems/spree_auth/CVE-2013-2506.yml diff --git a/gems/spree_auth/CVE-2013-2506.yml b/gems/spree_auth/CVE-2013-2506.yml deleted file mode 100644 index cd6c168260..0000000000 --- a/gems/spree_auth/CVE-2013-2506.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -gem: spree_auth -cve: 2013-2506 -osvdb: 90865 -ghsa: jp57-9j37-5476 -url: https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed -title: - Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege - Escalation -date: 2013-02-21 -description: | - Spree contains a flaw that leads to unauthorized privileges being gained. The - issue is triggered as certain input related to mass role assignment in - app/models/spree/user.rb is not properly verified before being used to update - a user. This may allow a remote attacker to assign arbitrary roles and gain - elevated administrative privileges. -cvss_v2: 4.0 -related: - url: - - https://github.com/advisories/GHSA-jp57-9j37-5476 From 639455ea1be5b47387ffa3ec1a53ff1310ca5978 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 6 Aug 2026 16:39:01 -0400 Subject: [PATCH 3/5] Delete gems/spree_auth_devise/CVE-2013-2506.yml --- gems/spree_auth_devise/CVE-2013-2506.yml | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 gems/spree_auth_devise/CVE-2013-2506.yml diff --git a/gems/spree_auth_devise/CVE-2013-2506.yml b/gems/spree_auth_devise/CVE-2013-2506.yml deleted file mode 100644 index e9bbad3e20..0000000000 --- a/gems/spree_auth_devise/CVE-2013-2506.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -gem: spree_auth_devise -cve: 2013-2506 -osvdb: 90865 -ghsa: jp57-9j37-5476 -url: https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed -title: Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation -date: 2013-02-21 -description: | - Spree contains a flaw that leads to unauthorized privileges being gained. The - issue is triggered as certain input related to mass role assignment in - app/models/spree/user.rb is not properly verified before being used to update - a user. This may allow a remote attacker to assign arbitrary roles and gain - elevated administrative privileges. -cvss_v2: 4.0 -patched_versions: - - "~> 1.1.6" - - "~> 1.2.0" - - ">= 1.3.0" -related: - url: - - https://github.com/advisories/GHSA-jp57-9j37-5476 From 48e48172cd8f00afb4a2da2155075dea351d86d4 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 6 Aug 2026 16:50:02 -0400 Subject: [PATCH 4/5] Delete gems/spree/CVE-2013-2506.yml --- gems/spree/CVE-2013-2506.yml | 24 ------------------------ 1 file changed, 24 deletions(-) delete mode 100644 gems/spree/CVE-2013-2506.yml diff --git a/gems/spree/CVE-2013-2506.yml b/gems/spree/CVE-2013-2506.yml deleted file mode 100644 index 4d1c9f941f..0000000000 --- a/gems/spree/CVE-2013-2506.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -gem: spree -cve: 2013-2506 -osvdb: 90865 -ghsa: jp57-9j37-5476 -url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed -title: - Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege - Escalation -date: 2013-02-21 -description: | - Spree contains a flaw that leads to unauthorized privileges being gained. The - issue is triggered as certain input related to mass role assignment in - app/models/spree/user.rb is not properly verified before being used to update - a user. This may allow a remote attacker to assign arbitrary roles and gain - elevated administrative privileges. -cvss_v2: 4.0 -patched_versions: - - "~> 1.1.6" - - "~> 1.2.0" - - ">= 1.3.0" -related: - url: - - https://github.com/advisories/GHSA-jp57-9j37-5476 From 4e5884185b63bef772744680a5e94b2f4cdc60a2 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Mon, 10 Aug 2026 11:33:11 -0400 Subject: [PATCH 5/5] Updated advisory to clarify patched_versions --- gems/dragonfly/CVE-2013-1756.yml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/gems/dragonfly/CVE-2013-1756.yml b/gems/dragonfly/CVE-2013-1756.yml index d867b5ba90..0780501354 100644 --- a/gems/dragonfly/CVE-2013-1756.yml +++ b/gems/dragonfly/CVE-2013-1756.yml @@ -15,22 +15,33 @@ unaffected_versions: - "< 0.7.0" patched_versions: - "~> 0.8.6" - - ">= 0.9.14" + - ">= 0.9.15" related: url: - https://nvd.nist.gov/vuln/detail/CVE-2013-1756 - - https://rubygems.org/gems/dragonfly/versions/0.9.14 + - https://rubygems.org/gems/dragonfly/versions/0.9.15 + - https://github.com/markevans/dragonfly/releases/tag/v0.9.15 + - https://github.com/markevans/dragonfly/compare/v0.9.14...v0.9.15 - https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo - - https://github.com/markevans/dragonfly/releases/tag/v0.9.14 - - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 - https://github.com/markevans/dragonfly/releases/tag/security_fix + - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 - https://rubygems.org/gems/dragonfly/versions/0.8.6 - https://github.com/markevans/dragonfly/releases/tag/v0.8.6 - https://github.com/markevans/dragonfly/compare/v0.8.5...v0.8.6 + - https://github.com/markevans/dragonfly/commit/6825722c57be49b29742a37dd1acdcf9cfb097fe - https://exchange.xforce.ibmcloud.com/vulnerabilities/82476 - https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225 - https://github.com/advisories/GHSA-p463-639r-q9g9 notes: | - - See commit URL for patch note in repo's README file. - - Patch was backported to "0.8.6". + - Based on History.md (their ChangeLog) file and GHSA advisory: + - 2013-01-30: 0.9.13 released. + - 2013-02-13: 0.9.14 released. + - 2013-02-19: "security_fix" committed. + - https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 + - 2013-02-19: Thread starts: https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo + - Titled "Important Security Update - Dragonfly 0.9.14 released [CVE-2013-1756]" + but inside they say there is still a bug associatged with patch. + - 2013-03-26: 0.8.6 released (Patch was backported to "0.8.6"). + - 2013-05-04: 0.9.15 released. Found "security_fix" commit in 0.9.15. + - https://github.com/markevans/dragonfly/compare/v0.9.14...v0.9.15 - cvss_v2 from nvd.nist.gov URL.