Practice vocabulary for CVE publication: NVD listings, CVSS scores, affected version ranges, fix versions, and vendor advisories.
0 / 10 completed
1 / 10
The US government database where CVE records are officially published and searchable is called:
The CVE is published in the NVD (National Vulnerability Database) — operated by NIST, it is the authoritative source for CVE details and CVSS scores.
2 / 10
A score of 9.8 on the standard vulnerability severity scale indicates the vulnerability is:
The CVSS base score is 9.8 (Critical) — CVSS scores range from 0-10, with 9.0-10.0 being Critical. Score 9.8 typically indicates network-exploitable RCE or similar.
3 / 10
When describing which software versions are affected by a CVE, you would say:
The vulnerability affects versions X.X through Y.Y — specifying exact version ranges is critical for operators to assess their exposure.
4 / 10
When informing users which version they should upgrade to in order to be protected, you say:
The fix is available in version Z.Z — this precise phrasing tells users exactly which version to install to remediate the vulnerability.
5 / 10
When the vendor publishes their own security notice at the same time the CVE goes public, it is described as:
The vendor advisory was published simultaneously — coordinating the vendor advisory with CVE publication prevents confusion and ensures users get complete context.
6 / 10
Sarah from Security just commented on your PR: 'This uses the deprecated `http.get()` method. It's a known CVE vulnerability (CVE-2023-12345) and should be updated to use `https.request()`.' Which of the following best describes the *primary* reason for Sarah's comment?
This question tests understanding of CVE context. Sarah's comment isn't about style or design; it directly relates to a known vulnerability (CVE-2023-12345) stemming from using an outdated function (`http.get()`). The use of the CVE ID demonstrates that this is not just a general coding issue, but one with a documented security impact.
7 / 10
You're drafting a Slack message to inform your team about a newly discovered vulnerability. The API response from the CVE database states: 'Affected Products: Apache Tomcat 9.0.x; CVSS Score: 8.2 (High).'. Which of the following is the MOST accurate and concise way to convey this information in a Slack channel?
This assesses the ability to translate technical details into actionable Slack language. Option 2 provides the key information – affected product (Tomcat 9.0.x), severity score (8.2), and a brief explanation of its significance. It's direct and informative, avoiding overly dramatic phrasing or demanding immediate action without context.
8 / 10
During a standup meeting, your team lead asks: 'What's the status on patching this CVE – CVE-2024-5678?' You respond with which of the following statements?
This tests communication around a CVE's lifecycle. Option 3 demonstrates a realistic update – acknowledging the vendor's patch and its current testing phase. It's specific, shows progress, and avoids vague statements about investigation or mitigation without concrete action.
9 / 10
You're writing a PR description for a fix to a vulnerability that has been assigned a CVE ID. Which of the following descriptions is MOST appropriate?
This assesses the importance of documenting CVEs in PRs. Option 2 clearly states the vulnerability (CVE-2024-9012) and provides context for the change – a secure alternative. Including the CVE ID is crucial for tracking and auditing purposes.
10 / 10
The vendor of a software component releases an advisory detailing a new vulnerability (CVE-2023-7890). Simultaneously, your internal security team publishes a detailed analysis of the same vulnerability. What is this situation best described as?
This tests understanding of industry best practices. The simultaneous release of information represents a common scenario in security vulnerability management. Both the vendor and internal teams are contributing to the overall knowledge base, demonstrating collaborative efforts to identify and address risks.
What will I learn from the "CVE Publication Vocabulary" exercise?
Practice vocabulary for CVE publication: NVD listings, CVSS scores, affected version ranges, fix versions, and vendor advisories.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Disclosure Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security disclosure language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Disclosure Language exercises?
See the full Security Disclosure Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.