How to find out what vulnerabilities X product has had/has?
What is the most effective / best method for obtaining information in regards to what vulnerabilities X device has or has had?
Checking the vendor's security advisories page is always a good start, anything they know about will usually go on there. As an example, here is a link to the Cisco Security Advisories page.
Is there anything else I can do short of checking the security advisories page?
Yes, there is. For example, any "major" vulnerabilities will be assigned a CVE these will also be very helpful in identifying whether or not a specific product has X vulnerability or not. A good resource for this is CVE Details
What if there is no security advisory page where else can I go?
If there isn't a security advisory on the vendor page then a few things could be applicable.
- The vendor doesn't yet know if they are affected.
- They're not aware of the vulnerability.
- They aren't affected.
What should you do in this scenario? A good idea would be to contact the Vendors support teams. Going back to the Cisco example you could use Cisco TAC. This would be applicable to all vendors, if there is no public information on the device in question your best chance is to contact their support teams and find out.
If they are not aware of the vulnerability it would be a good idea to inform them of the issue, especially if you found it whilst doing some digging and it appears obscure. If you cannot find any resources from the vendor themselves (whether they know about it or not) inform them, I can almost safely say it will help. In the Cisco example, you could contact Product Security Incident Response Team
What are some good resources I can use to find such vulnerabilities?
There are a lot of websites you can use other than the ones mentioned, the two below might also be helpful as mentioned by @Elsadek.
- SecurityFocus
- ExploitDB
You could also use CVE checkers as mentioned by @Forest.
- CVECheck-Tool
- CVEChecker
Another idea might be to subscribe to a security mailing list like the one below originally mentioned by @Forest.
Open Source Security Mailing List
This specifically is quite generalised however there are ones you could use which are more specific, as I mentioned earlier you could subscribe to Ciscos for example.