Re: CVE request form is missing an important bit

[jericho <jericho@attrition.org>]

On Thu, 5 Jan 2017, Andy Balinsky (balinsky) wrote:

: My point is that the year of the CVE shouldn't be a major data item, 
and 
: it shouldn't matter much if the year is 2016 or 2017 for a December 
: vuln.

"Shouldn't matter", yet every company that uses the CVE data set to 
generate statistics rely on that to count by year, even if the 
vulnerability was disclosed a year prior to the ID (e.g. disclosed in 
2015, received a 2016 ID).

This is a simple fact, and a majority of the 'statistics' we see 
surrounding vulnerabilities are impacted by this.

.b