# Understand your vulnerabilities

## **Introduction: see vulnerability details**

{% hint style="info" %}
**Recap**\
You have [viewed and understood scanned Projects](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/getting-started/walkthrough-code-repository-projects/view-your-first-snyk-projects); now you can look at the details of vulnerabilities in that Project.
{% endhint %}

### See your vulnerabilities

First, open a target to see your Snyk Projects:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FhZmXW20m2WwYrJpzSYcB%2Fimage.png?alt=media&#x26;token=6a1294cb-790f-489e-bb3c-ae792c68d560" alt="View imported Projects"><figcaption><p>View imported Projects</p></figcaption></figure>

Next, select a Project in that list, to see details of the vulnerabilities found in that Project.

For example, for a **Code analysis** project scanned by Snyk Code:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-18b769bcc05fb945f294d0474283d842c1f7e288%2Fimage%20(75).png?alt=media" alt="Vulnerability example - Code analysis"><figcaption><p>Vulnerability example - Code analysis</p></figcaption></figure>

See [View project information](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/manage-issues/introduction-to-snyk-projects/view-project-information) for more details.

### View Issue Cards

Now, look at the vulnerability information for each Snyk Project, provided in Issue Cards:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-fe789c64ba01202012505ac6b5252fecd6e20402%2Fimage%20(13)%20(1).png?alt=media" alt="Vulnerability details Issue Card"><figcaption><p>Vulnerability details Issue Card</p></figcaption></figure>

Again, there's a lot of information for you to understand, so take the time to understand how all of this information relates to your vulnerability, to help you decide on what fix actions to take.

For details, see [Issue card information](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/manage-issues/introduction-to-snyk-projects/issue-card-information).

### Access more vulnerability information

Snyk provides detailed resources for more information about vulnerabilities, accessible directly from the card:

* [**Snyk Vulnerability Database**](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/scan-application-code/snyk-open-source/starting-to-fix-vulnerabilities/using-the-snyk-vulnerability-database): access details on a specific vulnerability.
* [**Snyk Learn**](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/more-info/more-resources/snyk-learn): access general information about that type of vulnerability.

#### Access Snyk Vulnerability Database

For Open Source and Container vulnerabilities, click on the Snyk vulnerability Identifier (on the right of the Severity Level) to access detailed [Snyk Vulnerability Database](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/scan-application-code/snyk-open-source/starting-to-fix-vulnerabilities/using-the-snyk-vulnerability-database) information for that vulnerability, as defined by Snyk. For example:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FAqaPY3eauZpcQ02Rcye7%2Fimage.png?alt=media&#x26;token=79355b4a-e8d8-4bff-b629-58d23c906952" alt="Access Snyk Vulnerability Database"><figcaption><p>Access Snyk Vulnerability Database</p></figcaption></figure>

For this example, click on the Snyk vulnerability Identifier to see how Hibernate core and its libraries are vulnerable to SQL injection:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-b4bd2161ca3811f4d9a0d5d02e0b3bf4197f8b8b%2Fimage%20(149)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(2).png?alt=media" alt="Snyk Vulnerability Database example entry"><figcaption><p>Snyk Vulnerability Database example entry</p></figcaption></figure>

{% hint style="info" %}
[Snyk Code](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/scan-application-code/snyk-code) and [Snyk IaC](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/scan-cloud-deployment/snyk-infrastructure-as-code) issue cards have separate information sets for these areas.
{% endhint %}

#### Access Snyk Learn

Click **Learn about this type of vulnerability** to access [Snyk Learn](https://learn.snyk.io/) security educational materials:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FVEPPF492kz4czKTjvLiW%2Fimage.png?alt=media&#x26;token=e804d0b9-1633-4d74-a155-f39da796b0bb" alt="Access Snyk Learn from a vulnerability card"><figcaption><p>Access Snyk Learn from a vulnerability card</p></figcaption></figure>

For example, see [Snyk Learn SQL injection](https://learn.snyk.io/lessons/sql-injection/javascript/) for more details about this type of vulnerability.

{% hint style="info" %}
Some cards may not have Snyk Learn lessons available - if so, no links are presented..
{% endhint %}

### Understand the Snyk Priority Score

The [Snyk Priority Score](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/manage-issues/issue-management/priority-score), ranging from 0 - 1,000, is our evaluation of the seriousness of the vulnerability. The Snyk Priority Score includes [CVSS](https://www.first.org/cvss/calculator/3.1) (Common Vulnerability Scoring System) information, plus other factors such as attack complexity and known exploits. For example, this **Hibernate** vulnerability has no known exploit allowing attackers to take advantage of that vulnerability.

Other factors also affect the score. For example, SQL injections are easy to run (you just need a web browser and submit a form), so increasing the score, but it takes more work to understand and exploit the results for that attack, so decreasing the score.

### Open source vulnerabilities: fixes and dependency information

For open-source library scans by Snyk Open Source, you can also access fix and dependency information., in the **Fixes** and **Dependencies** tabs of your Project results.

#### Fixes tab

Snyk's knowledge of the transitive dependencies in your project make it possible for Snyk to offer fix advice, in the **Fixes** tab:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-142fbc0d4a69423ed2f4bfe69aac12109bbb5089%2FScreenshot%202021-10-19%20at%2011.57.07.png?alt=media&#x26;token=6094978a-11e0-40fd-9ad0-c0956f382e91" alt="Fix advice for Open Source vulnerabilities"><figcaption><p>Fix advice for Open Source vulnerabilities</p></figcaption></figure>

See [Fix your first vulnerability](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/getting-started/walkthrough-code-repository-projects/fix-your-first-vulnerability) for more details.

#### Dependencies tab

Snyk uses the package manager of your application to build the dependency tree and display it in the **Dependencies** tab of the project view:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-7872f9fea57022c1f0266129c782f9cab3a32ea0%2Fimage%20(321).png?alt=media" alt="Dependencies for Open Source vulnerabilities"><figcaption><p>Dependencies for Open Source vulnerabilities</p></figcaption></figure>

Click the file tree icon (![](https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FjZ1xohVJVLkcuCFiQgEt%2Fimage.png?alt=media\&token=81173326-799b-4fb8-9e16-92f375b7e3b4)) to build the dependency tree, showing which components introduce a vulnerability. This helps you understand how the dependency was introduced to the application:

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-95d06930a8c1e8f98958043a24183e83d6091b52%2Fimage23.png?alt=media" alt="Dependency tree details"><figcaption><p>Dependency tree details</p></figcaption></figure>

For example, the above screenshot shows a vulnerability based on the transitive dependency **qs\@2.2.4**, brought in from the direct dependency **body-parser@ 1.9.0**.

### What's next?

Now you understand your vulnerability information, you can decide how to fix it.

See [Fix your first vulnerability](https://docs.snyk.io/~/changes/m2hJeDrttXy2N83AnRjM/getting-started/walkthrough-code-repository-projects/fix-your-first-vulnerability).