MITRE Corporation began defining OVAL [41] to provide a standard schema and
language for expressing information about the publicly known vulnerabilities
and exposures defined and categorized in the CVE. OVAL is now a de facto
international standard in which vulnerability information is expressed in both