> you would need to establish that it's a normal thing to have such data
> in there to start with, and it's not.
as a security professional you must know cve.mitre.org and all the links they have to various resources that disclose this kind of information. you were saying...?