1. We should add a sort order - published date is probably good enough, descending if possible (i.e., newest first).
2. If the links are broken in the HTML report, we likely need to fix them as well. The easiest approach would be to expose the nvdSearchUrlFor() methods in the ReportTool, as it is already added to the Velocity context.

Thanks @jeremylong - I didn’t look at the 2nd one at all, it turned out a bit messier than i thought and I ran out of time. I couldn’t work out what the urls are used for in the CpeIdentifier object if not used later to actually render the report, so it needed more digging as to the reason for the 404ing URLs and which section of the report those ones appear in.

Understood, the HTML reports contain code like:

  <p>Vulnerable Software &amp; Versions:<ul>
      <li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
  </ul></p>

ReportTool.java

...
public String getNvdSearchURL(VulnerableSoftware vs) {
     return CpeIdentifier.nvdSearchUrlFor(vs.getVendor(), vs.getProduct(), vs.getVersion());
}
...

Then in the reports, something like:

  <p>Vulnerable Software &amp; Versions:<ul>
      <li class="vs$vsctr"><a target="_blank" href="$rpt.getNvdSearchURL($vuln.matchedVulnerableSoftware)">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
  </ul></p>

Some of the generated URLs look like the broad pattern and others the more specific one - so we may need two methods exposed.

OK I figured out that a different mechanism was being used for the "Identifiers" vs. the "Vulnerable Software & Versions" sections. Which also had a different URL syntax. Not sure, but suspect the "Vulnerable Software & Versions" links might have been broken for a while.

I've made this change now, however needs a bit more testing.

I think we don't need to specifically use the broad URLs, because the search syntax just takes a CPE 2.3 formatted string anyway. If from the NVD match we know details such as the version number from the matched software (sometimes it is included, if the affected version is not a range), it should be fine to include it in the search. In most other cases including * should be sufficient.

This new search also allows us to search specficially for all the other pieces of the CPE that have shown up in the NVD match, not just part/vendor/product/version - so behaviour should be better, I think.

Added an example HTML report generated with this to the description.