Re: CWE/CAPEC Definitions

[David A. Wheeler]

> On Jul 14, 2022, at 1:47 PM, SJ Jazz <sjoeja...@gmail.com> wrote:
> 
> Vulnerability = weakeness + exploit
> Or more specifically,
> Vulnerability = weakeness(es) + known exploit

I believe the first one is the right one. that is, vulnerabilities = weakness + 
exploit exists.

If vulnerabilities are only known vulnerabilities, then you can't discover 
vulnerabilities. It would mean the mere act of looking creates vulnerabilities.

--- David A. Wheeler