Abstract:Advancing our understanding of software vulnerabilities, automating their identification, the analysis of their impact, and ultimately their mitigation is necessary to enable the development of software that is more secure. While operating a vulnerability assessment tool, which we developed, and that is currently used by hundreds of development units at SAP, we manually collected and curated a dataset of vulnerabilities of open-source software, and the commits fixing them. The data were obtained both from the National Vulnerability Database (NVD), and from project-specific web resources, which we monitor on a continuous basis. From that data, we extracted a dataset that maps 624 publicly disclosed vulnerabilities affecting 205 distinct open-source Java projects, used in SAP products or internal tools, onto the 1282 commits that fix them. Out of 624 vulnerabilities, 29 do not have a CVE (Common Vulnerability and Exposure) identifier at all, and 46, which do have such identifier assigned by a numbering authority, are not available in the NVD yet. The dataset is released under an open-source license, together with supporting scripts that allow researchers to automatically retrieve the actual content of the commits from the corresponding repositories, and to augment the attributes available for each instance. Moreover, these scripts allow to complement the dataset with additional instances that are not security fixes (which is useful, for example, in machine learning applications). Our dataset has been successfully used to train classifiers that could automatically identify security-relevant commits in code repositories. The release of this dataset and the supporting code as open-source will allow future research to be based on data of industrial relevance; it also represents a concrete step towards making the maintenance of this dataset a shared effort involving open-source communities, academia, and the industry.

Is the OWASP Top 10 list comprehensive enough for writing secure code?

Understanding The Top 10 OWASP Vulnerabilities

Static analysis for discovering IoT vulnerabilities

Vulnerabilities Mapping based on OWASP-SANS: a Survey for Static Application Security Testing (SAST)

A Novel VAPT Algorithm: Enhancing Web Application Security Trough OWASP top 10 Optimization

Known Vulnerabilities of Open Source Projects: Where Are the Fixes?

My Software has a Vulnerability, should I worry?

To Healthier Ethereum: A Comprehensive and Iterative Smart Contract Weakness Enumeration

A Historical and Statistical Studyof the Software Vulnerability Landscape

Vulnerable Open Source Dependencies: Counting Those That Matter

Unveiling the Landscape of Operating System Vulnerabilities

Vulnerability discovery based on source code patch commit mining: a systematic literature review

Measuring the Exploitation of Weaknesses in the Wild

An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications

An Empirical Study of Static Analysis Tools for Secure Code Review

A Comparative Analysis of Vulnerability Management Tools: Evaluating Nessus, Acunetix, and Nikto for Risk Based Security Solutions

An Empirical Study of High-Risk Vulnerabilities in IoT Systems

Toward effective secure code reviews: an empirical study of security-related coding weaknesses

A Data-Mining Based Study of Security Vulnerability Types and Their Mitigation in Different Languages

Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem

A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software