Data sources and licences
Some of what Scan.now reports comes from public vulnerability databases maintained by other people. This page says which, who owns them, and under what terms we are allowed to use them.
Why this page exists
Two of our scanners compare what they find against vulnerability databases that we did not compile. Those databases are somebody else’s work, and the licences that let us use them require us to say so in any copy we distribute. This page is that attribution. It is also, more usefully, a statement of where a finding’s authority actually comes from: When a WordPress scan says a plugin has a published vulnerability, the claim is Wordfence’s, not ours, and you should be able to see that.
What this page is not
It is not a list of the software Scan.now is built from. The checks, the crawler, the scoring and the reports are ours. What is listed below is data we consume and redistribute in our findings, which is the only part that carries an attribution obligation.
WordPress vulnerability data
The WordPress scanner matches the plugin, theme and core versions it fingerprints against the Wordfence Intelligence Vulnerability Database. That database records, for each published advisory, the affected version range, the severity, the CVE identifier and the CVSS vector. When a scan tells you a plugin is vulnerable, that advisory is where the claim comes from.
Wordfence Intelligence Vulnerability Database
Copyright © Defiant, Inc. All rights reserved. Wordfence and Wordfence Intelligence are trademarks of Defiant, Inc.
The following licence grant is reproduced from the Wordfence Intelligence Terms and Conditions, section 3.1:
License Grants. Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.
We reproduce this notice in our source tree alongside the data, and here, because both are copies within the meaning of that grant.
JavaScript library vulnerability data
The JavaScript library scanner identifies front-end library versions and matches them against the Retire.js vulnerability repository, an openly maintained record of known-vulnerable releases of common browser libraries.
Retire.js vulnerability repository
Copyright © the Retire.js contributors. Distributed under the Apache License 2.0.
We consume the repository’s published version data and reproduce the advisory identifiers it carries. The Apache 2.0 licence permits this, and requires that we preserve the copyright and licence notice — which is what this entry does.
Password breach data
The password breach check queries the Pwned Passwords range API, run by Have I Been Pwned. The lookup is anonymised by design: Only the first five characters of the password’s SHA-1 hash are transmitted, and the comparison against the full hash happens locally. The password itself never leaves your browser and is never seen by us or by them.
Pwned Passwords
Provided by Have I Been Pwned. The Pwned Passwords corpus is published into the public domain under the Creative Commons Attribution 4.0 licence, and the range API is free to query.
Everything else
The rest of what a scan reports is measured directly from the target at the moment you run it: Response headers, TLS handshake parameters, certificate fields, DNS records, page markup and crawl structure. Those are facts about your own site, read the way a browser reads them, and they belong to nobody. Our methodology page describes exactly what happens on the wire for each scanner.
If you believe we are using data of yours without the right attribution, tell us and we will correct it or stop using it.