redundant analyses and assessments of what often turns out to be the same flaw.
Unlike OASIS’ AVDL, OVAL, because it is intended for use in concert with
the CVE, is not limited to expressing application-level vulnerability information.
Also unlike AVDL, the focus of OVAL is not exchange of such information