On Security Vulnerabilities: n doesn't match

[Ricardo_Rodriguez]

@tmortagne

2 is actually the number of vulnerabilities which don’t have an explanation to suggest XWiki is not actually impacted (so kind of unknown known vulnerabilities, “known” in this context just referring to the fact that they are public in the database of CVEs, but we sometimes don’t know about them ourselves yet).

Cool! It is much clearer to me now. I will survive with this explanation. Thanks!

@tmortagne

I agree with you that the separation is really not clear in the UI (the only difference, I think, is that the “analyzed” ones have a little document icon next to the CVE), and that’s one of the reasons why we decided to spend more time on this UI before enabling it by default.

Things are clearer to me know after expending some time reading other topics and papers and your first paragraph above. I will keep a close eye on new developments

@tmortagne

By the way, I’m surprised by this snappy report. Is this extension coming as a dependency of some extension you installed (you can check that in the Extension Manager by checking the dependency tab in the detail of the snappy installed extension) ? That would be something to fix in that extension.

Following your explanation, I get deeper on the vulnerabilities’ correction process and update snappy to release 0.5. The red bell shows now only one (1) environment vulnerability (org.webjars:bootstrap/3.4.1). snappy is no longer in the list.

Here what I get concerning dependencies:

 
Let me know if I can be of any further help!