VARIoT database entry ontology
type: Ontology
type: Class
creator: http://www.en.nask.pl
description: An ontology to describe an entry from the VARIoT vulnerabilities database
rights: http://creativecommons.org/licenses/by-sa/4.0/
comment: a VARIoT database entry

cve
type: DatatypeProperty
description: A CVE identifier related to the vulnerability
domain: VARIoT database entry ontology
range: string

id
type: DatatypeProperty
description: Identifier of the vulnerability in the VARIoT vulnerabilities database
domain: VARIoT database entry ontology
range: Datatype
  on datatype: string
  with restrictions:
    pattern: VAR-\d{6}-\d{4,}

last update date
type: DatatypeProperty
comment: Last time when any information in the entry has been updated
domain: VARIoT database entry ontology
range: dateTimeStamp

moved to
type: DatatypeProperty
comment: Reference to the identifier of the VARIoT database entry where given entry has been moved
domain: VARIoT database entry ontology
range: Datatype
  on datatype: string
  with restrictions:
    pattern: VAR-\d{6}-\d{4,}

affected products
type: Class
comment: Products (hardware or software) affected by the vulnerability

model
type: DatatypeProperty
description: Model of the affected product
domain: affected products
range: string

scope
type: DatatypeProperty
description: Scope of the vulnerable affected products's versions. Can be: eq, lt, lte, gt or gte
domain: affected products
range: string

trust
type: DatatypeProperty
description: How affected product's details can be trusted
domain: affected products
range: string

vendor
type: DatatypeProperty
description: Affected produtc's vendor name
domain: affected products
range: string

configurations
type: Class
comment: Configurations of vulnerable software and hardware

CVE data version
type: DatatypeProperty
comment: Configuration version
domain: configurations
range: string

cpe22Uri
type: DatatypeProperty
comment: CPE identifier version 2.2
domain: configurations
range: anyURI

cpe23Uri
type: DatatypeProperty
comment: CPE identifier version 2.3
domain: configurations
range: anyURI

operator
type: DatatypeProperty
comment: Logical operator to link vulnerable configurations. Can be AND or OR
domain: configurations
range: string

vulnerable
type: DatatypeProperty
comment: Indicates whether given software or hardware is vulnerable or not
domain: configurations
range: boolean

credits
type: Class
comment: Who disclosed information about vulnerability

data
type: DatatypeProperty
description: Person, group of persons or organization who disclosed information about vulnerability
domain: credits
range: string

trust
type: DatatypeProperty
description: How information about credits can be trusted
domain: credits
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

cvss
type: Class
comment: Attack vectors and severity assessment of the vulnerability

cvssV2
type: Class
comment: CVSS data in V2 format
subclass of: cvss

accessComplexity
type: DatatypeProperty
description: This metric measures the complexity of the attack required to exploit the vulnerability once an attacker has gained access to the target system. For example, consider a buffer overflow in an Internet service: once the target system is located, the attacker can launch an exploit at will. Other vulnerabilities, however, may require additional steps in order to be exploited. For example, a vulnerability in an email client is only exploited after the user downloads and opens a tainted attachment. The possible values for this metric are: HIGH, MEDIUM, LOW. The lower the required complexity, the higher the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-1-2-Access-Complexity-AC
domain: cvssV2
range: string

accessVector
type: DatatypeProperty
description: This metric reflects how the vulnerability is exploited. The possible values for this metric are: LOCAL, ADJACENT NETWORK, NETWORK. The more remote an attacker can be to attack a host, the greater the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-1-1-Access-Vector-AV
domain: cvssV2
range: string

authentication
type: DatatypeProperty
description: This metric measures the number of times an attacker must authenticate to a target in order to exploit a vulnerability. This metric does not gauge the strength or complexity of the authentication process, only that an attacker is required to provide credentials before an exploit may occur. The possible values for this metric are: Multiple, Single, None. The fewer authentication instances that are required, the higher the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-1-3-Authentication-Au
domain: cvssV2
range: string

author
type: DatatypeProperty
description: A person, a group of persons or an organization who authored the CVSS
domain: cvssV2
range: string

availabilityImpact
type: DatatypeProperty
description: This metric measures the impact to availability of a successfully exploited vulnerability. Availability refers to the accessibility of information resources. Attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system. The possible values for this metric are: NONE, PARTIAL, COMPLETE. Increased availability impact increases the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-1-6-Availability-Impact-A
domain: cvssV2
range: string

baseScore
type: DatatypeProperty
description: baseScore = round_to_1_decimal(((0.6*Impact)+(0.4*Exploitability)-1.5)*f(Impact))
source: https://www.first.org/cvss/v2/guide#3-2-1-Base-Equation
domain: cvssV2
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

confidentialityImpact
type: DatatypeProperty
description: This metric measures the impact on confidentiality of a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The possible values for this metric are: NONE, PARTIAL, COMPLETE. Increased confidentiality impact increases the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-1-4-Confidentiality-Impact-C
domain: cvssV2
range: string

exploitability
type: DatatypeProperty
description: This metric measures the current state of exploit techniques or code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled, thereby increasing the severity of the vulnerability. Initially, real-world exploitation may only be theoretical. Publication of proof of concept code, functional exploit code, or sufficient technical details necessary to exploit the vulnerability may follow. Furthermore, the exploit code available may progress from a proof-of-concept demonstration to exploit code that is successful in exploiting the vulnerability consistently. In severe cases, it may be delivered as the payload of a network-based worm or virus. The possible values for this metric are: Unprove, Proof-of-concept (POC), Functional, High, Not Definied. The more easily a vulnerability can be exploited, the higher the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-2-1-Exploitability-E
domain: cvssV2
range: string

exploitabilityScore
type: DatatypeProperty
description: Exploitability = 20* AccessVector*AccessComplexity*Authentication
source: https://www.first.org/cvss/v2/guide#3-2-1-Base-Equation
domain: cvssV2
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

id
type: DatatypeProperty
description: External identifier of the related vulnerability with given CVSS V2
domain: cvssV2
range: string

impactScore
type: DatatypeProperty
description: Impact = 10.41*(1-(1-ConfImpact)*(1-IntegImpact)*(1-AvailImpact))
description: https://www.first.org/cvss/v2/guide#3-2-1-Base-Equation
domain: cvssV2
range: Datatype
  on datatype: decimal
  with restrictions:
    min inclusive: 0

integrityImpact
type: DatatypeProperty
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. The possible values for this metric are: NONE, PARTIAL, COMPLETE. Increased integrity impact increases the vulnerability score.
source: https://www.first.org/cvss/v2/guide#2-1-5-Integrity-Impact-I
domain: cvssV2
range: string

obtainAllPrivilege
type: DatatypeProperty
description: whether or not the vulnerability allows one to obtain all privileges
domain: cvssV2
range: boolean

obtainOtherPrivilege
type: DatatypeProperty
description: whether or not the vulnerability allows one to obtain other privileges
domain: cvssV2
range: boolean

obtainUserPrivilege
type: DatatypeProperty
description: whether or not the vulnerability allows one to obtain user privileges
domain: cvssV2
range: boolean

remediationLevel
type: DatatypeProperty
description: The remediation level of a vulnerability is an important factor for prioritization. The typical vulnerability is unpatched when initially published. Workarounds or hotfixes may offer interim remediation until an official patch or upgrade is issued. Each of these respective stages adjusts the temporal score downwards, reflecting the decreasing urgency as remediation becomes final. The possible values for this metric are: OFFICIAL FIX, TEMPORARY FIX, WORKAROUND, UNAVAILABLE, NOT DEFINED. The less official and permanent a fix, the higher the vulnerability score is.
source: https://www.first.org/cvss/v2/guide#2-2-2-Remediation-Level-RL
domain: cvssV2
range: string

reportConfidence
type: DatatypeProperty
description: This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details. Sometimes, only the existence of vulnerabilities are publicized, but without specific details. The vulnerability may later be corroborated and then confirmed through acknowledgement by the author or vendor of the affected technology. The urgency of a vulnerability is higher when a vulnerability is known to exist with certainty. This metric also suggests the level of technical knowledge available to would-be attackers. The possible values for this metric are: Unconfirmed, Uncorroborated, Confirmed, Not Definied. The more a vulnerability is validated by the vendor or other reputable sources, the higher the score.
source: https://www.first.org/cvss/v2/guide#2-2-3-Report-Confidence-RC
domain: cvssV2
range: string

severity
type: DatatypeProperty
description: Qualitative rating of all the scores. Can be: low, medium or high
source: https://nvd.nist.gov/vuln-metrics/cvss
domain: cvssV2

userInteractionRequired
type: DatatypeProperty
description: whether or not user interaction is required
domain: cvssV2
range: boolean

vectorString
type: DatatypeProperty
description: Vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form.
domain: cvssV2
range: Datatype
  on datatype: string
  with restrictions:
    pattern: ^((AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))/)*(AV:[NAL]|AC:[LMH]|Au:[MSN]|[CIA]:[NPC]|E:(U|POC|F|H|ND)|RL:(OF|TF|W|U|ND)|RC:(UC|UR|C|ND)|CDP:(N|L|LM|MH|H|ND)|TD:(N|L|M|H|ND)|[CIA]R:(L|M|H|ND))$

version
type: DatatypeProperty
description: CVSS version
domain: cvssV2
range: string

cvssV3
type: Class
comment: CVSS data in V3 format
subclass of: cvss

attackComplexity
type: DatatypeProperty
description: This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. As described below, such conditions may require the collection of more information about the target, or computational exceptions. Importantly, the assessment of this metric excludes any requirements for user interaction in order to exploit the vulnerability (such conditions are captured in the User Interaction metric). If a specific configuration is required for an attack to succeed, the Base metrics should be scored assuming the vulnerable component is in that configuration. The Base Score is greatest for the least complex attacks. The list of possible values is: Low, High
source: https://www.first.org/cvss/v3.1/specification-document#2-1-2-Attack-Complexity-AC
domain: cvssV3
range: string

attackVector
type: DatatypeProperty
description: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the Base Score) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable component. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater Base Score. The list of possible values is: Netwok, Adjacent, Local, Physical
source: https://www.first.org/cvss/v3.1/specification-document#2-1-1-Attack-Vector-AV
domain: cvssV3
range: string

author
type: DatatypeProperty
description: A person, a group of persons or an organization who authored the CVSS
domain: cvssV3
range: string

availabilityImpact
type: DatatypeProperty
description: This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the impacted component, this metric refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component. The Base Score is greatest when the consequence to the impacted component is highest. The list of possible values is: High, Low, None
source: https://www.first.org/cvss/v3.1/specification-document#2-3-3-Availability-A
domain: cvssV3
range: string

baseScore
type: DatatypeProperty
description: BaseScore = If Impact \<= 0 0, else If Scope is Unchanged Roundup (Minimum [(Impact + Exploitability), 10]) If Scope is Changed Roundup (Minimum [1.08 × (Impact + Exploitability), 10])
source: https://www.first.org/cvss/v3.1/specification-document#7-1-Base-Metrics-Equations
domain: cvssV3
range: Datatype
  on datatype: decimal
  with restrictions:
    min inclusive: 0

baseSeverity
type: DatatypeProperty
description: All scores can be mapped to the qualitative ratings. None: 0.0, Low: 0.1 - 3.9, Medium: 4.0 - 6.9, High: 7.0 - 8.9, Critical: 9.0 - 10.0
source: https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale
domain: cvssV3
range: string

confidentialityImpact
type: DatatypeProperty
description: This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones. The Base Score is greatest when the loss to the impacted component is highest. The list of possible values is: High, Low, None
source: https://www.first.org/cvss/v3.1/specification-document#2-3-1-Confidentiality-C
domain: cvssV3
range: string

id
type: DatatypeProperty
description: External identifier of the related vulnerability with a given CVSS V3
domain: cvssV3
range: string

impactScore
type: DatatypeProperty
description: ISS = 1 - [ (1 - Confidentiality) × (1 - Integrity) × (1 - Availability) ] Impact = If Scope is Unchanged 6.42 × ISS If Scope is Changed 7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15
source: https://www.first.org/cvss/v3.1/specification-document#7-1-Base-Metrics-Equations
domain: cvssV3
range: Datatype
  on datatype: decimal
  with restrictions:
    min inclusive: 0

integrityImpact
type: DatatypeProperty
description: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. The Base Score is greatest when the consequence to the impacted component is highest. The list of possible values is: High, Low, None
source: https://www.first.org/cvss/v3.1/specification-document#2-3-2-Integrity-I
domain: cvssV3
range: string

privilegesRequired
type: DatatypeProperty
description: This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. The Base Score is greatest if no privileges are required. The list of possible values is: None, Low, High
source: https://www.first.org/cvss/v3.1/specification-document#2-1-3-Privileges-Required-PR
domain: cvssV3
range: string

scope
type: DatatypeProperty
description: The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope. The Base Score is greatest when a scope change occurs. The list of possible values is: Unchanged, Changed
source: https://www.first.org/cvss/v3.1/specification-document#2-2-Scope-S
domain: cvssV3
range: string

trust
type: DatatypeProperty
description: How trusted can be CVSS V3 information
domain: cvssV3
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

userInteraction
type: DatatypeProperty
description: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The Base Score is greatest when no user interaction is required. The list of possible values is: None, Required
source: https://www.first.org/cvss/v3.1/specification-document#2-1-4-User-Interaction-UI
domain: cvssV3
range: string

vectorString
type: DatatypeProperty
description: Vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form.
source: https://www.first.org/cvss/v3.1/specification-document#Vector-String
domain: cvssV3
range: Datatype
  on datatype: string
  with restrictions:
    pattern: ^CVSS:3.1/((AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])/)*(AV:[NALP]|AC:[LH]|PR:[NLH]|UI:[NR]|S:[UC]|[CIA]:[NLH]|E:[XUPFH]|RL:[XOTWU]|RC:[XURC]|[CIA]R:[XLMH]|MAV:[XNALP]|MAC:[XLH]|MPR:[XNLH]|MUI:[XNR]|MS:[XUC]|M[CIA]:[XNLH])$

version
type: DatatypeProperty
description: CVSS version
domain: cvssV3
range: string

severity
type: Class
comment: Severity of the vulnerability
subclass of: cvss

author
type: DatatypeProperty
description: Author of the severity assessment
domain: severity
range: string

id
type: DatatypeProperty
description: Identifier of the related vulnerability with given severity
domain: severity
range: string

trust
type: DatatypeProperty
description: How trusted can be severity assessment
domain: severity
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

value
type: DatatypeProperty
description: Level of the vulanerability's severity. On the scale provided by the source
domain: severity
range: string

description
type: Class
description: Description of the vulnerability

data
type: DatatypeProperty
description: Description of the vulnerability
domain: description
range: string

trust
type: DatatypeProperty
description: How trusted can be the description
domain: description
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

exploit availability
type: Class
description: Links to the external resources with code exploiting the vulnerability

reference
type: DatatypeProperty
description: An URL to the external resource with a code of the exploit
domain: exploit availability
range: anyURI

trust
type: DatatypeProperty
description: How trusted can be information about the exploit
domain: exploit availability
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

type
type: DatatypeProperty
description: Type of the exploit e.g. Proof-of-Concept or working exploit
domain: exploit availability
range: string

external ids
type: Class
description: List of identifiers of entries from other databases related to the vulnerability

db
type: DatatypeProperty
description: External database with an entry related to the vulnerability
domain: external ids
range: string

id
type: DatatypeProperty
description: Identifier of an entry in the external database related to the vulnerability
domain: external ids
range: string

trust
type: DatatypeProperty
description: How trusted can be information about an entry in external database related to the vulnerability
domain: external ids
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

iot
type: Class
description: Indicates whether vulnerability is IoT related or not

data
type: DatatypeProperty
description: Indicates whether vulnerability is IoT related or not
domain: iot
range: boolean

trust
type: DatatypeProperty
description: How trusted can be an information about vulnerability being IoT related or not
domain: iot
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

iot taxonomy
type: Class
description: Describes category and subcategory of the vulnerable IoT device

category
type: DatatypeProperty
description: Category of the vulnerable IoT device
domain: iot taxonomy
range: string

subcategory
type: DatatypeProperty
description: More detailed category of the vulnerable IoT device
domain: iot taxonomy
range: string

trust
type: DatatypeProperty
description: How trusted can be information about category and subcategory of the vulnerable IoT device
domain: iot taxonomy
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

patch
type: Class
description: Information about available patch or workaround

title
type: DatatypeProperty
description: Short description of the patch
domain: patch
range: string

trust
type: DatatypeProperty
description: How trusted can be information about patch
domain: patch
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

url
type: DatatypeProperty
description: A link to the patch
domain: patch
range: anyURI

problemtype data
type: Class
description: Type of the vulnerability as CWE identifier

problemtype
type: DatatypeProperty
description: CWE identifier describing type of the vulnerability
domain: problemtype data
range: string

trust
type: DatatypeProperty
description: How trusted can be information about problemtype
domain: problemtype data
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

references
type: Class
comment: Links to external sources for further reading about vulnerability

trust
type: DatatypeProperty
comment: How trusted can be given URL
domain: references
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

url
type: DatatypeProperty
comment: An URL pointing to the external source with information related to the vulnerability
domain: references
range: anyURI

sources
type: Class
comment: Sources of the information (entries from external databases)

db
type: DatatypeProperty
description: Name of the source database
domain: sources
range: string

id
type: DatatypeProperty
description: Identifier of the entry from the source database
domain: sources
range: string

sources release date
type: Class
description: When information about vulnerability showed first time in the source database

date
type: DatatypeProperty
description: Timestamp when information has been published first time in the source database
domain: sources release date
range: string

db
type: DatatypeProperty
description: Source database
domain: sources release date
range: string

id
type: DatatypeProperty
description: Identifier in the source database
domain: sources release date
range: string

sources update date
type: Class
comment: Dates when given sources had been updated

date
type: DatatypeProperty
description: Date or date and time when given source had been updated
domain: sources update date
range: string

db
type: DatatypeProperty
description: Source database where entry had been updated
domain: sources update date
range: string

id
type: DatatypeProperty
description: Identifier of the updated entry in the external database
domain: sources update date
range: string

threat type
type: Class
comment: Type of the threat

data
type: DatatypeProperty
description: Type of the threat
domain: threat type
range: string

trust
type: DatatypeProperty
description: How trusted can be information about threat type
domain: threat type
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

title
type: Class
comment: Short desciption of the vulnerability

data
type: DatatypeProperty
description: A title for the vulnerability
domain: title
range: string

trust
type: DatatypeProperty
description: How trusted can be the title
domain: title
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

type
type: Class
comment: Type of the vulnerability

data
type: DatatypeProperty
comment: Type of the vulnerability
domain: type
range: string

trust
type: DatatypeProperty
comment: How trusted can be information about the type of the vulnerability
domain: type
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0

vulnerability type
type: Class
comment: Type of the vulnerability

data
type: DatatypeProperty
comment: Type of the vulnerability
domain: vulnerability type
range: string

trust
type: DatatypeProperty
comment: How trusted can be information about vulnerability type
domain: vulnerability type
range: Datatype
  on datatype: decimal
  with restrictions:
    min exclusive: 0