/tags/cve/Recent content in CVE on Software FactoryHugoen/use/howto/secure/jfrog-xray-vulnerabilties/Mon, 01 Jan 0001 00:00:00 +0000/use/howto/secure/jfrog-xray-vulnerabilties/<h2 id="overview">Overview<a class="td-heading-self-link" href="#overview" aria-label="Heading self-link"></a></h2> <p>Xray detects known <a href="/use/practices/secure/software-composition-analysis/vulnerability/">vulnerabilities</a> (CVEs) in the components of your repositories, builds and release bundles.</p> <p>It identifies each component, maps it to known vulnerabilities from public and proprietary sources and lets you enforce security policies using <strong>policies</strong> and <strong>watches</strong> mechanism.</p> <ul> <li>For background on how Xray works, see <a href="/use/tools/xray/">Xray Page</a> .</li> <li>For license compliance, see <a href="/use/tools/xray/#license-compliance">Xray License Scanning</a> .</li> </ul> <h2 id="prerequisites">Prerequisites<a class="td-heading-self-link" href="#prerequisites" aria-label="Heading self-link"></a></h2> <p>Before you start, make sure you have:</p> <ul> <li>Access to a JFrog Platform instance with <strong>Xray</strong> enabled</li> <li>A dedicated <strong>Project</strong>.</li> <li>A role with <strong>Manage Xray Data</strong>, <strong>Manage Watches &amp; Policies</strong> and <strong>Manage Reports</strong> permission within that project.</li> <li><strong>JFrog CLI</strong> installed and configured</li> </ul> <h2 id="create-a-vulnerability-policy">Create a vulnerability policy<a class="td-heading-self-link" href="#create-a-vulnerability-policy" aria-label="Heading self-link"></a></h2> <p>A policy defines what counts as a violation and what action Xray takes when one is found.</p>