The default type for representing vulnerabilities in STIX is CVRF1.1InstanceType in cvrf1.1.xsd