English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The use of open-source software (OSS) is ever-increasing, and so is thenumber of open-source vulnerabilities being discovered and publicly disclosed.The gains obtained from the reuse of community-developed libraries may beoffset by the cost of detecting, assessing, and mitigating theirvulnerabilities in a timely fashion.  In this paper we present a novel method to detect, assess and mitigate OSSvulnerabilities that improves on state-of-the-art approaches, which commonlydepend on metadata to identify vulnerable OSS dependencies. Our solutioninstead is code-centric and combines static and dynamic analysis to determinethe reachability of the vulnerable portion of libraries used (directly ortransitively) by an application. Taking this usage into account, our approachthen supports developers in choosing among the existing non-vulnerable libraryversions.  VULAS, the tool implementing our code-centric and usage-based approach, isofficially recommended by SAP to scan its Java software, and has beensuccessfully used to perform more than 250000 scans of about 500 applicationssince December 2016. We report on our experience and on the lessons we learnedwhen maturing the tool from a research prototype to an industrial-gradesolution.

Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software