MITRE
A United States non-profit research organization focused on cybersecurity, defense, and engineering research and development. MITRE is widely known for maintaining foundational security infrastructure including the MITRE ATT&CK framework and the Common Vulnerabilities and Exposures (CVE) program.
Core Facts
The CVE (Common Vulnerabilities and Exposures) database is the world's most authoritative vulnerability numbering system, with new vulnerabilities being disclosed and recorded every day.
Coordinated Disclosure is a convention between open-source projects and security researchers: researchers report vulnerabilities privately, vendors develop patches within an agreed timeframe, and both sides disclose details simultaneously to minimise user exposure time.
Timeline (last 90 days)
CVE numbers are maintained by MITRE in the format CVE-year-sequence number; they contain no technical details themselves and serve as an index key across databases, vendor advisories and security tools.
Coordinated Disclosure is a convention between open-source projects and security researchers: researchers report vulnerabilities privately, vendors develop patches within an agreed timeframe, and both sides disclose details simultaneously to minimise user exposure time.
CVE (Common Vulnerabilities and Exposures) IDs are assigned under MITRE's coordination and are the unique public identifier of a vulnerability; the ID itself contains no technical details.
CVE numbers, together with MITRE and the security advisory databases of various language ecosystems (such as GitHub Security Advisory), form the skeleton of vulnerability information distribution.
CVE is a standardized identifier for publicly disclosed cybersecurity vulnerabilities, in a format such as CVE-2024-XXXXX.
MITRE ATLAS borrows the tactics/techniques matrix structure of ATT&CK and specifically documents real attack techniques against AI systems, including data poisoning, model evasion, and prompt injection, making it suitable as a reference table for red team testing.
MITRE ATLAS draws on the approach of the ATT&CK framework and specifically organizes attackers' tactics, techniques, and procedures for AI systems.
CWE-345 is an entry in MITRE's Common Weakness Enumeration, named "Insufficient Verification of Data Authenticity", and is referenced by CVE, NVD and security tools.
CWE is maintained by MITRE and is a standardized enumeration of software weaknesses, each with a unique number, such as CWE-89 for SQL injection and CWE-79 for XSS.
For the FAA to advance AI systems into actual operations, it needs to work in concert with standards bodies such as MITRE and RTCA to develop dedicated certification standards for AI tools.
5 more timeline events
All Facts (19)
The CVE (Common Vulnerabilities and Exposures) database is the world's most authoritative vulnerability numbering system, with new vulnerabilities being disclosed and recorded every day.
80%VerifiedCoordinated Disclosure is a convention between open-source projects and security researchers: researchers report vulnerabilities privately, vendors develop patches within an agreed timeframe, and both sides disclose details simultaneously to minimise user exposure time.
70%UnverifiedMITRE ATT&CK systematically categorizes known attack techniques, providing defenders with an encyclopedia of attacker behavior.
70%Unverified每年约10万个CVE中仅有不到100个被确认为零日利用
65%UnverifiedThe CVE numbering system is maintained by MITRE Corporation, with the format CVE-year-sequence number.
60%UnverifiedCVE numbers are maintained by MITRE in the format CVE-year-sequence number; they contain no technical details themselves and serve as an index key across databases, vendor advisories and security tools.
50%UnverifiedCVE (Common Vulnerabilities and Exposures) IDs are assigned under MITRE's coordination and are the unique public identifier of a vulnerability; the ID itself contains no technical details.
50%UnverifiedCVE numbers, together with MITRE and the security advisory databases of various language ecosystems (such as GitHub Security Advisory), form the skeleton of vulnerability information distribution.
50%UnverifiedCVE is a standardized identifier for publicly disclosed cybersecurity vulnerabilities, in a format such as CVE-2024-XXXXX.
50%UnverifiedMITRE ATLAS borrows the tactics/techniques matrix structure of ATT&CK and specifically documents real attack techniques against AI systems, including data poisoning, model evasion, and prompt injection, making it suitable as a reference table for red team testing.
50%UnverifiedMITRE ATLAS draws on the approach of the ATT&CK framework and specifically organizes attackers' tactics, techniques, and procedures for AI systems.
50%UnverifiedCWE-345 is an entry in MITRE's Common Weakness Enumeration, named "Insufficient Verification of Data Authenticity", and is referenced by CVE, NVD and security tools.
50%UnverifiedCWE is maintained by MITRE and is a standardized enumeration of software weaknesses, each with a unique number, such as CWE-89 for SQL injection and CWE-79 for XSS.
50%UnverifiedFor the FAA to advance AI systems into actual operations, it needs to work in concert with standards bodies such as MITRE and RTCA to develop dedicated certification standards for AI tools.
50%UnverifiedMITRE ATT&CK is a knowledge base of adversary tactics and techniques maintained by MITRE Corporation, categorized and numbered along two dimensions of tactical objectives and technical methods, currently covering hundreds of technique entries.
50%UnverifiedThe MITRE ATT&CK framework evolved from the cyber kill chain and maps attack behaviors into 14 tactical phases and hundreds of specific techniques
50%UnverifiedCVE is a global vulnerability identification system maintained by MITRE Corporation, with identifiers assigned through a distributed network of CNAs, of which there are hundreds of authorized CNAs worldwide.
50%UnverifiedGitHub Security Advisories（GHSA）发布的漏洞公告可直接关联修复提交的diff，使研究人员能精确定位漏洞代码行
50%UnverifiedMITRE在2023年发布了面向AI/ML系统的威胁知识库MITRE ATLAS
50%