This schema defines the structure of the National
Vulnerability Database XML feed files version: 1.2. The elements and
attribute in this document are described by xs:annotation tags. This
file is kept at http://nvd.nist.gov/schema/nvdcve.xsd. The NVD XML
feeds are available at http://nvd.nist.gov/download.cfm.
Release Notes:
Version 1.2:
* CVSS version 2 scores and vectors have been added. Please see
http://nvd.nist.gov/cvss.cfm?vectorinfo and
http://www.first.org/cvss/cvss-guide.html for more information on
how to interpret this data.
The root element of the NVD CVE feed. Multiple "entry" child elements describe specific NVD CVE entries.
The schema version number supported by the feed.
The date the feed was generated.
A CVE entry.
Documents one CVE entry. The child elements should always
appear in the sequence defined below. These elements are compatible with
entry elements from the CVE XML feeds.
Description wrapper tag, parent to any
documented descriptions of this CVE entry. While the "desc"
tag will always be present, there may be no "descript" child
tags. Only one "descript" tag will exist for each
description source (i.e. CVE, NVD, ...).
A description of a CVE entry
from the source indicated by the "source"
attribute.
Impact wrapper tag (may or may not be
present). Only one "impact" tag will exist for each impact
explanation source.
Contains a specific impact
explanation of this CVE entry from source
indicated by the "source" attribute.
Solution wrapper tag (may or may not be
present). Only one "sol" tag will exist for each solution
explanation source.
Loss type tag (may or may not be present).
Contains one loss type child for each loss type of this CVE
entry. Potential loss types are: "avail" => availability
"conf" => confidentiality "int" => integrity "sec_prot" =>
security protection
Vulnerability type tag (may or may not be
present). Contains one vulnerability type child for each
vulnerability type of this CVE entry. Potential
vulnerability types are: "access" => Access validation error
"input" => Input validation error "design" => Design error
"exception" => Exceptional condition error "env" =>
Environmental error "config" => Configuration error "race"
=> Race condition error "other" => other
Vulnerability range tag (may or may not be
present). Contains one vulnerability range child for each
vulnerability range of this CVE entry. Potential
vulnerability ranges are: "local" => Locally exploitable
"local_network" => Local network exploitable "network" =>
Network exploitable "user_init" => User accesses attacker
Reference wrapper tag (always present).
External references to this CVE entry are contained within
this tag.
Individual reference to this CVE
entry. Text is the name of this vulnerability at
this particular reference. Attributes: "source"
(required) => Name of reference source "url"
(required) => hyperlink to reference "sig" =>
indicates this reference includes a tool
signature "adv" => indicates this reference is a
Security Advisory "patch" => indicates this
reference includes a patch for this
vulnerability
Vulnerable software wrapper tag (may or may
not be present). Software affected by this CVE entry are
listed within this tag.
CVE or CAN
the full CVE name
the sequence number from CVE name
the NVD name (if it exists)
the date this entry was discovered
the date this entry was published
the date this entry was last modified
the entry's severity as determined by the NVD analysts: High, Medium, or Low
indicates that this CVE entry has been rejected by CVE or NVD
the CVSS Version Indicator
Same as the CVSS_base_score to provide backwards compatability with the previous CVE XML feed format. This field is deprecated an may be removed at a future date.
CVSS version 2 Base Score
CVSS version 2 Impact Score
CVSS version 2 Exploit Score
the CVSS version 2 Vector string
The source of the CVE description.
Input validation error tag with
one attribute for each input validation error
type. Potential input validation error types
are: "bound" => Boundary condition error
"buffer" => Buffer overflow
Contains a specific solution
explanation of this CVE entry from source
indicated by the "source" attribute.
Security Protection tag with one
attribute for each security protection type.
Potential security protection types are: "admin"
=> gain administrative access "user" => gain
user access "other" => other
Product wrapper tag. Versions of
this product that are affected by this
vulnerability are listed within this tag.
Attributes: "name" => Product name "vendor" =>
Vendor of this product
Represents a version
of this product that is affected by
this vulnerability. Attributes:
"num" => This version number "prev"
=> Indicates that versions previous
to this version number are also
affected by this vulnerability
"edition" => Indicates the edition
associated with the version number
Defines date format for NVD. Dates follow the mask "yyyy-mm-dd"
Restricts urls in NVD beyond the xs:anyURI restrictions.
simpleType used for attributes that are only present when they are
true. Such attributes appear only in the form attribute_name="1".
simpleType used when scoring on a scale of 0-10, inclusive
simpleType to describe the CVSS Base Vector