Script Returning Empty Data

[rongshiu]

Hi, the sample CVE is returning empty data?

[dhenrygithub]

You are getting no results because their code is incorrect. Also, there is a known issue at the MS github samples that the /Updates/{id}/ endpoint does not filter at all and incorrectly always returns them all:
microsoft/MSRC-Microsoft-Security-Updates-API#78

I'll try submitting a pull request, but note the changes below:
(
-#minus sign means remove this line of code
+#plus sign means add this line of code in place of it
)

1. As of Feb 2021 the API no longer requires the API Key. I spent a significant amount of time trying to find the link to create a key until I found an obscure blog post that noted the change about a week prior to my vain attempts. The code works if you leave all the API key related stuff alone, or you could delete it. I think the API ignores it.

2. The API path for POST is wrong. it should be [/cvrf/v2.0/{}] not [/cvrf/{}?api-Version={}]

My suggested code change below is a kludge (not sure how to algorithmically determine current version of API) but works:
-base_url = "https://api.msrc.microsoft.com/"
+base_url = "https://api.msrc.microsoft.com/cvrf/v2.0/"

Remove API version from path:
-url = "{}Updates('{}')?api-version={}".format(base_url, str(cve), str(datetime.datetime.now().year))
+url = "{}Updates('{}')".format(base_url, str(cve))

-url = "{}cvrf/{}?api-Version={}".format(base_url, id, str(datetime.datetime.now().year))
+url = "{}cvrf/{}".format(base_url, id)

3. Finally, as I said above, there is a known issue with the /Updates/{ID} endpoint not filtering the IDs returned, it just always returns them all from 2016 onward. This will cause you to always pick the first in the list (2016-Apr), and thus get no KB hits for most of your calls.

[EDIT] Oh yeah, and if there is no "Remediation" section in your CVE (maybe because the patch hasn't been released yet), you will also get an empty result set, but no indication of why.