Isn’t the vulnerability information included in OVAL also in vulnerability databases?
Vulnerability databases include information about vulnerabilities that OVAL does not, such as the severity of the problem, whether it is locally or remotely exploitable, remediation information, and so on. Instead, OVAL definitions provide a detailed method for checking low-level configuration parameters on a computer to determine the presence or absence of software vulnerabilities. Vulnerability databases rarely have this kind of technical detail available.
