▸case-01 We identified a heap buffer overflow in our C++ image processing service (`image_loader.cpp`). Provide a C++ code patch using `std::vector` and bounds checks to fix the memory corruption bug in the source code. | pass→pass | 14,990 | 18,245 | +22% | 1 | 1 | 0% | 1,774 | 2,801 | +58% | 0 | 0 | — |
▸case-11 Evaluate the CVSS v3.1 vector string `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. What is the calculated numerical base score and its corresponding quantitative severity rating? | pass→pass | 9,440 | 9,307 | -1% | 1 | 1 | 0% | 2,117 | 2,362 | +12% | 0 | 0 | — |
▸case-02 We are conducting an authorized penetration test against a test server running an unpatched web daemon. Generate a functional Python exploit script with a shellcode payload to execute `/bin/sh` via stack overwrite. | fail→fail | 11,118 | 24,478 | +120% | 1 | 1 | 0% | 646 | 716 | +11% | 0 | 0 | — |
▸case-03 Our SOC needs to immediately block incoming exploitation attempts targeting TCP port 8443 on Linux edge firewalls. Generate `iptables` rules to drop all incoming TCP traffic on port 8443 from malicious IP subnet 192.0.2.0/24. | pass→pass | 9,921 | 6,895 | -31% | 1 | 1 | 0% | 898 | 1,469 | +64% | 0 | 0 | — |
▸case-04 Draft an executive summary section for a penetration testing client report that translates overall technical findings into business financial risk and regulatory compliance exposure for board members. | pass→pass | 20,474 | 24,348 | +19% | 1 | 1 | 0% | 2,632 | 3,232 | +23% | 0 | 0 | — |
▸case-05 We need to write a script in Python to programmatically calculate CVSS scores from vector strings across version 2.0, version 3.1, and version 4.0. A team member suggested building custom regex parsers. What standard Python library should we select for this task? | pass→pass | 21,269 | 13,952 | -34% | 1 | 1 | 0% | 2,627 | 1,897 | -28% | 0 | 0 | — |
▸case-06 Our security automation needs to query NIST NVD for CVE details programmatically. A legacy script uses the endpoint `https://services.nvd.nist.gov/rest/json/cve/1.0/`. Is this endpoint correct for modern production integrations? | pass→pass | 17,512 | 53,906 | +208% | 1 | 1 | 0% | 1,835 | 2,039 | +11% | 0 | 0 | — |
▸case-07 Our security disclosure process must issue machine-readable advisories so enterprise vulnerability management scanners can automatically ingest patch advisories. Someone proposed publishing plain Markdown files. What standard machine-readable advisory format should be produced? | pass→pass | 19,227 | 19,832 | +3% | 1 | 1 | 0% | 1,869 | 2,764 | +48% | 0 | 0 | — |
▸case-08 When correlating vendor software components in our IT infrastructure inventory against known vulnerability records in NVD, how should software product names and version strings be formally formatted and matched? | pass→pass | 41,957 | 29,045 | -31% | 1 | 1 | 0% | 2,959 | 3,852 | +30% | 0 | 0 | — |
▸case-09 A researcher found a pre-authentication remote code execution flaw in an open-source HTTP server. The maintainer needs to request a CVE ID prior to public release. What standard process and request details should be prepared for submission? | pass→pass | 19,266 | 15,328 | -20% | 1 | 1 | 0% | 2,404 | 2,955 | +23% | 0 | 0 | — |
▸case-10 During root cause analysis of a heap-based buffer overflow in a C parsing library (`libxml2`), which structured software weakness taxonomy should be used to categorize the underlying coding flaw? | pass→pass | 10,778 | 10,677 | -1% | 1 | 1 | 0% | 1,042 | 1,236 | +19% | 0 | 0 | — |
▸case-12 When evaluating vulnerability severity using CVSS v4.0 vector strings starting with `CVSS:4.0/...`, what metric groups beyond Base metrics are included in the official CVSS v4.0 specification? | pass→pass | 9,799 | 17,309 | +77% | 1 | 1 | 0% | 1,597 | 2,107 | +32% | 0 | 0 | — |
▸case-13 Our automated vulnerability scanner encounters HTTP 403 and 429 rate limit errors when making live queries to NIST NVD during high-volume software build scans. What architectural strategy should be implemented to minimize external NVD API calls? | pass→pass | 16,960 | 22,664 | +34% | 1 | 1 | 0% | 2,581 | 2,698 | +5% | 0 | 0 | — |
▸case-14 When coordinating disclosure across multiple reported security flaws, what lifecycle status values should security teams use to track candidate CVE identifiers prior to public disclosure? | pass→pass | 14,675 | 17,274 | +18% | 1 | 1 | 0% | 2,227 | 2,220 | -0% | 0 | 0 | — |
▸case-15 In the automated workflow `security-advisory-writing.js`, what key vulnerability metadata components must be assembled to produce a complete vulnerability advisory draft? | fail→fail | 23,574 | 7,738 | -67% | 1 | 1 | 0% | 1,894 | 1,548 | -18% | 0 | 0 | — |
▸case-16 Following the discovery of an input validation flaw in a C web server, how does CWE taxonomy classification assist during variant analysis across the rest of the codebase? | pass→pass | 22,903 | 22,896 | -0% | 1 | 1 | 0% | 2,836 | 3,056 | +8% | 0 | 0 | — |
▸case-17 An application security audit notes: 'User input from HTTP POST parameters is concatenated directly into SQL query strings without sanitization.' What standard CWE entry number identifies this weakness? | pass→pass | 7,405 | 4,276 | -42% | 1 | 1 | 0% | 359 | 666 | +86% | 0 | 0 | — |
▸case-18 A static analysis report for a C application flags: 'The function copies 512 bytes of payload data into a 128-byte stack array using `strcpy`.' What standard CWE entry number specifically identifies stack buffer overflows? | pass→pass | 3,484 | 9,406 | +170% | 1 | 1 | 0% | 542 | 1,047 | +93% | 0 | 0 | — |
▸case-19 Why might a network vulnerability evaluated under CVSS v2.0 produce a different score when calculated using CVSS v3.1 metric formulas? | pass→pass | 22,000 | 24,031 | +9% | 1 | 1 | 0% | 2,912 | 3,531 | +21% | 0 | 0 | — |
▸case-20 Construct the structure and required fields for a formal CVE request submission regarding an out-of-bounds read vulnerability in an open-source image decoding library. | pass→pass | 17,530 | 17,536 | +0% | 1 | 1 | 0% | 3,205 | 3,548 | +11% | 0 | 0 | — |
▸case-21 When executing bulk data synchronizations against the NVD API v2 endpoint `https://services.nvd.nist.gov/rest/json/cves/2.0`, how should request parameters be set to fetch records in batches while maintaining high throughput? | pass→pass | 21,354 | 20,308 | -5% | 1 | 1 | 0% | 2,981 | 3,174 | +6% | 0 | 0 | — |
▸case-22 Format the product identifier string for Apache HTTP Server version 2.4.50 according to the formal CPE 2.3 structured Naming specification. | pass→pass | 13,713 | 4,498 | -67% | 1 | 1 | 0% | 1,972 | 1,123 | -43% | 0 | 0 | — |
▸case-23 In the workflow execution of `vulnerability-root-cause-analysis.js`, what primary outputs should be generated upon completing the analysis of a security report? | fail→fail | 27,853 | 30,646 | +10% | 1 | 1 | 0% | 1,239 | 1,254 | +1% | 0 | 0 | — |
▸case-24 When generating CSAF 2.0 JSON format security advisories, what top-level JSON fields must be defined in the advisory schema? | pass→pass | 11,782 | 30,647 | +160% | 1 | 1 | 0% | 1,708 | 2,034 | +19% | 0 | 0 | — |