What type of information does CVSS provide for a vulnerability?