Web applications are becoming more ubiquitous. All manner of physical devices are now connected and often have a variety of web applications and web-interfaces. This proliferation of web applications has been accompanied by an increase in reported software vulnerabilities. The objective of this analysis of vulnerability data is to understand the current landscape of reported web application flaws. Along those lines, this work reviews ten years (2011 - 2020) of vulnerability data in the National Vulnerability Database. Based on this data, most common web application weaknesses are identified and their profiles presented. A weakness ontology is developed to capture the attributes of these weaknesses. These include their attack method and attack vectors. Also described is the impact of the weaknesses to software quality attributes. Additionally, the technologies that are susceptible to each weakness are presented, they include programming languages, frameworks, communication protocols, and data formats.
CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models
Digital Technology and Innovation, Siemens Healthineers USA（美国西门子医疗数字技术与创新部门）；Cybersecurity, Siemens Healthineers Germany（德国西门子医疗网络安全部门）；Corporate Technology, Siemens AG Romania（罗马尼亚西门子公司企业技术部门）
Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?
Singapore Management University（新加坡管理大学）；Monash University（蒙纳士大学）；Chinese University of Hong Kong（香港中文大学）；University of Groningen（格罗宁根大学）；Wuhan University（武汉大学）；GovTech（政府科技局）
LLM-HyPZ: Hardware Vulnerability Discovery using an LLM-Assisted Hybrid Platform for Zero-Shot Knowledge Extraction and Refinement
Department of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, USA（电气与计算机工程系，亚利桑那大学）；Department of Systems and Industrial Engineering, University of Arizona, Tucson, AZ, USA（系统与工业工程系，亚利桑那大学）；College of Information Science, University of Arizona, Tucson, AZ, USA（信息科学学院，亚利桑那大学）；School of Electrical Engineering and Computer Science, University of North Dakota, Grand Forks, ND, USA（电气工程与计算机科学学院，北达科他大学）；Department of Computer Science, University of California Davis, CA, USA（计算机科学系，加州大学戴维斯分校）
CyberForge: Verified Vulnerability Injection at Repository Level for Cybersecurity Agent Training
National Institute of Standards and Technology（美国国家标准与技术研究院）；Université Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；CNRS（法国国家科学研究中心）；University of Maryland, College Park（马里兰大学帕克分校）
Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study
School of Information Technologies Tallinn University of Technology（塔林理工大学信息技术学院）；School of Informatics, Computing, and Cyber Systems Northern Arizona University（北亚利桑那大学信息学、计算与网络系统学院）
VulReaD: Knowledge-Graph-guided Software Vulnerability Reasoning and Detection
The University of Manchester（曼彻斯特大学）；Agency for Science, Technology and Research（科技研究局）；Singapore University of Technology and Design（新加坡科技设计大学）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）
ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment
Information Security Lab, University of Information Technology（信息安全部，信息科技大学）；Vietnam National University（越南国家大学）；School of Computer Science and Information Technology, Adelaide University（计算机科学与信息技术学院，阿德莱德大学）
SecureFalcon: Are We There Yet in Automated Software Vulnerability Detection with LLMs?
Guelma University（盖勒马大学）；Technology Innovation Institute（技术创新研究院）；Khalifa University of Science and Technology（哈利法科技大学）；University of Manchester（曼彻斯特大学）
