Also check the global listing for wordpress plugin vulnerabilities

openwebvulndb/common/cve.py

@@ -73,14 +73,17 @@ async def read_api(self, url):
                 self.read_one(entry)
 
     async def read_one_from_api(self, cve_id):
-        url = "https://cve.circl.lu/api/cve/" + cve_id
-        async with self.session.get(url) as response:
-            entry = await response.json()
-            if entry is None:
-                logger.info("No entry found for %s" % cve_id)
-                return
-            self._convert_vulnerable_configuration(entry)
-            self.read_one(entry)
+        try:
+            url = "https://cve.circl.lu/api/cve/" + cve_id
+            async with self.session.get(url) as response:
+                entry = await response.json()
+                if entry is None:
+                    logger.info("No entry found for %s" % cve_id)
+                    return
+                self._convert_vulnerable_configuration(entry)
+                self.read_one(entry)
+        except Exception as e:
+            logger.warn("Error fetching %s: %s", cve_id, e)
 
     def read_one(self, entry):
         target = self.identify_target(entry)

openwebvulndb/common/securityfocus/fetcher.py

@@ -31,16 +31,16 @@ class SecurityFocusFetcher:
     def __init__(self, aiohttp_session=None):
         self.aiohttp_session = aiohttp_session
 
-    async def get_vulnerabilities(self, vuln_pages_to_fetch=1):
+    async def get_vulnerabilities(self, vuln_pages_to_fetch=1, vendor_name="WordPress"):
         vulnerabilities = []
-        vuln_list = await self.get_vulnerability_list(vuln_pages_to_fetch)
+        vuln_list = await self.get_vulnerability_list(vuln_pages_to_fetch, vendor_name=vendor_name)
         for vuln_url in vuln_list:
             vuln_entry = await self.get_vulnerability_entry(url=vuln_url)
             if vuln_entry is not None:
                 vulnerabilities.append(vuln_entry)
         return vulnerabilities
 
-    async def get_vulnerability_list(self, vuln_pages_to_fetch=1, file=None):
+    async def get_vulnerability_list(self, vuln_pages_to_fetch=1, file=None, vendor_name='WordPress'):
         """vuln_pages_to_fetch: Amount of pages to fetch for vulnerabilities (None for all pages).
         When searching for vulnerabilities on the security focus website, results are displayed accross multiple pages
         (30 vulnerabilities per page), with the most recent on the first page"""
@@ -52,7 +52,7 @@ async def get_vulnerability_list(self, vuln_pages_to_fetch=1, file=None):
             # The number of the first vuln on the next page to fetch. Increment by 30 to change page (30 vuln per page).
             vuln_index = 0
             while vuln_pages_to_fetch is None or vuln_index < vuln_pages_to_fetch * vulnerabilities_per_page:
-                post_data = {'op': 'display_list', 'o': vuln_index, 'c': 12, 'vendor': 'WordPress'}
+                post_data = {'op': 'display_list', 'o': vuln_index, 'c': 12, 'vendor': vendor_name}
                 async with self.aiohttp_session.post("https://www.securityfocus.com/bid", data=post_data) as response:
                     assert response.status == 200
                     vuln_index += vulnerabilities_per_page

openwebvulndb/common/securityfocus/reader.py

@@ -57,6 +57,14 @@ async def read_from_website(self, vuln_pages_to_fetch=1):
             if vuln is not None and not vuln.id.startswith("CVE-"):
                 await self.augment_with_cve(vuln)
 
+        # Also fetch the global ones, but filter based on description
+        vuln_entries = await self.fetcher.get_vulnerabilities(vuln_pages_to_fetch=vuln_pages_to_fetch*5, vendor_name="")
+        for vuln_entry in vuln_entries:
+            if self._is_wordpress(vuln_entry):
+                vuln = self.read_one(vuln_entry)
+                if vuln is not None and not vuln.id.startswith("CVE-"):
+                    await self.augment_with_cve(vuln)
+
     async def augment_with_cve(self, vuln_entry):
         for ref in vuln_entry.references:
             if ref.type == "cve":