Security operations
Vulnerability management
A findings list is not a work plan. Here you practise the ranking that matters: exploitability in the wild, asset criticality and exposure — then convert the top of the list into remediation the business can actually schedule.
Findings
12
Open critical
3
Exploited in the wild
7
Mean time to remediate
18 days
target: 7 days for critical
Findings
Sorted by composite risk, not severity label.
| Finding | Severity | CVSS | Exploit prob. | Assets | Risk | State |
|---|---|---|---|---|---|---|
CVE-2024-31129 Remote code execution in report rendering library | critical | 9.8 | 71% | 2 | Open | |
CVE-2024-21762 Out-of-bounds write in VPN appliance handler | critical | 9.6 | 83% | 1 | Open | |
CVE-2024-25600 Unauthenticated code execution in CMS plugin | critical | 9.8 | 68% | 1 | Open | |
CVE-2024-20881 Privilege escalation via print spooler service | critical | 9.1 | 44% | 2 | Mitigating | |
CVE-2023-44487 Protocol stream multiplexing resource exhaustion | high | 7.5 | 62% | 1 | Mitigating | |
CVE-2024-1086 Use-after-free in kernel packet filter | high | 7.8 | 36% | 2 | Open | |
CVE-2023-38831 Archive handler executes hidden payload on open | high | 7.8 | 55% | 3 | Mitigating | |
CVE-2024-27983 HTTP/2 request-flood denial of service | high | 8.2 | 19% | 1 | Open | |
CVE-2023-4863 Heap overflow in image decoding component | medium | 6.5 | 29% | 2 | Resolved | |
CVE-2024-3094 Malicious code in compression library build chain | medium | 6.3 | 8% | 1 | Accepted risk | |
CVE-2024-26229 Local elevation via CSC service driver | medium | 5.9 | 5% | 2 | Open | |
CVE-2024-0519 Out-of-bounds memory access in browser engine | low | 3.7 | 2% | 1 | Resolved |
CVE-2024-31129
Remote code execution in report rendering library
- Package
- report-render
- Installed → fixed
- 3.2.1 → 3.2.6
- First detected
- 6 days ago
- Composite risk
- 100/100
Affected assets
- SRV-WEB-01High
- SRV-BUILD-03High
Remediation path: upgrade report-render to 3.2.6. If a maintenance window is weeks away, record a compensating control (network restriction, detection rule, monitoring uplift) rather than leaving the finding silently open.
Why severity alone produces the wrong work ordermethod›
Two findings can both be CVSS 9.8 while one has a public exploit on an internet-facing crown-jewel asset and the other needs local access on a lab machine. Ranking by severity treats them identically and burns credibility with the teams who do the patching. The composite score used here multiplies base severity by exploitation likelihood and by asset criticality — the same three inputs every risk-based vulnerability programme uses, whatever the tooling.
Handing findings to owners without frictionpractice›
- Group by owning team and by fix action, not by CVE — one upgrade often closes several findings.
- State the exact target version. “Patch it” creates a conversation; a version number creates a ticket.
- Name the compensating control you will run until the fix lands, so risk acceptance is explicit and time-boxed.
- Re-scan and close the loop; an unverified fix is a rumour.
Learn this capability
Labs covering risk prioritisation, technique vocabulary and response trade-offs.
Intermediate · Theory · 16 min
Detection quality principles
You own the detection catalogue. Every rule you deploy costs analyst attention, so quality is measured in outcomes, not count.
Entry · Theory · 16 min
Speaking ATT&CK
Three critical alerts are open. Each describes a different attacker goal. To discuss them with anyone else in security you need the ATT&CK vocabulary.
Advanced · Guided Lab · 28 min
Containment decisions under pressure
WS-FIN-014 still has an active C2 channel and the account a.pratama may be in use by the attacker. You must choose containment now, and every option costs something.