Where our vulnerability data comes from
Some of what Scan.now reports comes from public vulnerability databases maintained by other people. This page says which, who owns them, and under what terms we are allowed to use them.
Why this page exists
Several scanners compare what they find against public datasets that we did not compile. Those datasets are somebody else’s work, so we attribute them clearly and preserve the notices their terms require. This page is that attribution. It is also, more usefully, a statement of where a result’s authority actually comes from: When a WordPress scan says a plugin has a published vulnerability, the claim is Wordfence’s, not ours, and you should be able to see that.
This is a data-source register, not a software dependency list. The checks, crawler, scoring and reports are ours. The entries below cover external data consumed or redistributed in findings, together with the relevant ownership and licence information.
WordPress advisories
Wordfence Intelligence
The WordPress scanner matches the plugin, theme and core versions it fingerprints against the Wordfence Intelligence Vulnerability Database. That database records, for each published advisory, the affected version range, the severity, the CVE identifier and the CVSS vector. When a scan tells you a plugin is vulnerable, that advisory is where the claim comes from.
- Used for
- Plugin, theme and WordPress core advisories
- Maintained by
- Defiant, Inc.
- Terms
- Wordfence Intelligence Terms and Conditions, section 3.1
Copyright © Defiant, Inc. All rights reserved. Wordfence and Wordfence Intelligence are trademarks of Defiant, Inc.
The licence grant below is reproduced from section 3.1:
License Grants. Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.
We reproduce this notice in our source tree alongside the data, and here, because both are copies within the meaning of that grant.
JavaScript advisories
Retire.js
The JavaScript library scanner identifies front-end library versions and matches them against the Retire.js vulnerability repository, an openly maintained record of known-vulnerable releases of common browser libraries.
- Used for
- Known-vulnerable browser library versions
- Maintained by
- Retire.js contributors
- Licence
- Apache License 2.0
Copyright © the Retire.js contributors. Distributed under the Apache License 2.0.
We consume the repository’s published version data and reproduce the advisory identifiers it carries. The Apache 2.0 licence permits this and requires us to preserve the copyright and licence notice. This entry provides that notice.
Breached passwords
Have I Been Pwned
The password breach check queries the Pwned Passwords range API, run by Have I Been Pwned. The lookup is anonymised by design: Only the first five characters of the password’s SHA-1 hash are transmitted, and the comparison against the full hash happens locally. The password itself never leaves your browser and is never seen by us or by them.
- Used for
- Checking whether a password appears in breach data
- Provided by
- Have I Been Pwned
- Licence
- Creative Commons Attribution 4.0
Provided by Have I Been Pwned. The Pwned Passwords corpus is made available under the Creative Commons Attribution 4.0 licence, and the range API is free to query.
Open web graph
Common Crawl Web Graph
The Common Crawl Harmonic Centrality checker looks up domains in an index built directly from Common Crawl’s published domain rank file. It reports the published Harmonic Centrality and PageRank positions and values without replacing them with a proprietary authority score.
- Used for
- Domain Harmonic Centrality and PageRank measurements
- Published by
- Common Crawl Foundation
- Source
- Common Crawl Web Graph releases
Each result names its exact graph release, graph size and local top-N lookup coverage, and links to the official rank file. Common Crawl snapshots a large sample of the public web; its measurements are not Google rankings and do not prove that an unmatched domain is absent from the web.
Direct measurements
Measured live by Scan.now
The rest of what a scan reports is measured directly from the target at the moment you run it: Response headers, TLS handshake parameters, certificate fields, DNS records, page markup and crawl structure. Those are facts about your own site, read the way a browser reads them, and they belong to nobody. Our methodology page describes exactly what happens on the wire for each scanner.
If you believe we are using data of yours without the right attribution, tell us and we will correct it or stop using it.
