Learn vocabulary for writing CVE descriptions, CVSS scores, and security advisories.
0 / 10 completed
1 / 10
What does CVE stand for?
CVE stands for Common Vulnerabilities and Exposures — the standard system for identifying and cataloguing publicly known cybersecurity vulnerabilities with unique CVE IDs.
2 / 10
What is a CVSS score?
The CVSS (Common Vulnerability Scoring System) provides a 0–10 score for vulnerability severity. Scores: 0.1–3.9 (Low), 4.0–6.9 (Medium), 7.0–8.9 (High), 9.0–10.0 (Critical).
3 / 10
What does 'affected versions' mean in a CVE advisory?
Affected versions in a CVE advisory specifies exactly which software versions contain the vulnerability — e.g., 'Versions < 2.1.4 are affected; 2.1.4 contains the fix.'
4 / 10
What is a 'CWE' in security advisory writing?
CWE (Common Weakness Enumeration) categorises software weaknesses that lead to vulnerabilities — e.g., CWE-89 (SQL Injection), CWE-79 (XSS). CVE advisories often reference CWE IDs.
5 / 10
Which sentence correctly describes the impact of a vulnerability in a CVE advisory?
CVE impact descriptions should specify: who the attacker is (unauthenticated/authenticated, remote/local), what they can do (execute code, read data), and with what privileges — using precise technical language.
6 / 10
During a code review of a new API endpoint designed to handle user authentication, Alice notices the following comment in the PR description: 'This function uses bcrypt for password hashing. The algorithm is SHA256 which is considered deprecated. We should migrate to Argon2'. What does 'deprecated' mean in this context?
'Deprecated' in security means that an algorithm or method has been superseded by a newer, more secure alternative. Using SHA256 for password hashing is now considered risky due to known vulnerabilities and attacks – Argon2 provides significantly better protection against modern threats. The key mistake many developers make is assuming 'deprecated' refers only to non-use; it indicates a fundamental weakness.
7 / 10
Bob, the security engineer, is drafting a Slack message to inform his team about a newly discovered vulnerability in their web server. He writes: 'There's an issue with CVE-2023-12345 – CVSS score 7.5 – affecting versions 1.0 and higher.' What does the CVSS score of '7.5' primarily indicate?
The CVSS (Common Vulnerability Scoring System) score is a standardized metric for assessing the severity of vulnerabilities. A score of 7.5 indicates a high level of potential impact if successfully exploited, reflecting significant damage or disruption to systems. It's crucial to understand that CVSS doesn't directly tell you *how* it was calculated – that's done by its components.
8 / 10
Charlie is writing a detailed description for a CVE advisory regarding a critical SQL injection vulnerability. He needs to accurately define the term 'affected versions'. What does this phrase mean in the context of a security advisory?
'Affected versions' refers to all specific software releases (e.g., application versions, operating system patches) where the vulnerability is present and exploitable. This allows developers and administrators to identify which systems require immediate attention or remediation steps. It's a critical component of accurately communicating the scope of the issue.
9 / 10
David, a senior developer, is reviewing a pull request for a new feature that includes logging. He sees the following line in the code: 'logger.debug('User accessed resource X')'. What does 'logger.debug' typically signify in this scenario?
'logger.debug' is a standard logging level used to record detailed information about the program's execution during development and debugging phases. These messages are typically not included in production deployments to avoid performance impacts or exposing sensitive data. It's a tool for understanding *why* something happens, not just that it happens.
10 / 10
Emily is crafting a response to a security alert regarding a potential vulnerability in their payment processing system. She needs to clearly articulate the urgency of the situation. Which sentence best reflects the appropriate tone and level of detail for such a message?
Given the context of a payment processing system vulnerability, an immediate response should acknowledge the *potential* security risk and emphasize the need for urgent investigation and remediation. Overly technical details or minimizing the severity would be inappropriate. The goal is to trigger appropriate action while maintaining clarity about the threat.
What will I learn from the "CVE Advisory Writing — Vocabulary and Language" exercise?
Learn vocabulary for writing CVE descriptions, CVSS scores, and security advisories.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Disclosure Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security disclosure language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Disclosure Language exercises?
See the full Security Disclosure Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.