Web Application Security Vulnerabilities
59 papers on this topic
SCoPE: Evaluating LLMs for Software Vulnerability Detection
In recent years, code security has become increasingly important, especially with the rise of interconnected technologies. Detecting vulnerabilities early in the software development process has...
From Theory to Practice: Code Generation Using LLMs for CAPEC and CWE Frameworks
The increasing complexity and volume of software systems have heightened the importance of identifying and mitigating security vulnerabilities. The existing software vulnerability datasets...
LLMpatronous: Harnessing the Power of LLMs For Vulnerability Detection
Despite the transformative impact of Artificial Intelligence (AI) across various sectors, cyber security continues to rely on traditional static and dynamic analysis tools, hampered by high false...
Enabling Cyber Security Education through Digital Twins and Generative AI
Digital Twins (DTs) are gaining prominence in cybersecurity for their ability to replicate complex IT (Information Technology), OT (Operational Technology), and IoT (Internet of Things)...
An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains
In modern software development workflows, the open-source software supply chain contributes significantly to efficient and convenient engineering practices. With increasing system complexity,...
A Preliminary Study on Using Large Language Models in Software Pentesting
Large language models (LLM) are perceived to offer promising potentials for automating security tasks, such as those found in security operation centers (SOCs). As a first step towards evaluating...
Decoding Latent Attack Surfaces in LLMs: Prompt Injection via HTML in Web Summarization
Large Language Models (LLMs) are increasingly integrated into web-based systems for content summarization, yet their susceptibility to prompt injection attacks remains a pressing concern. In this...
FuzzTheREST: An Intelligent Automated Black-box RESTful API Fuzzer
Software's pervasive impact and increasing reliance in the era of digital transformation raise concerns about vulnerabilities, emphasizing the need for software security. Fuzzy testing is a...
CPE-Identifier: Automated CPE identification and CVE summaries annotation with Deep Learning and NLP
With the drastic increase in the number of new vulnerabilities in the National Vulnerability Database (NVD) every year, the workload for NVD analysts to associate the Common Platform Enumeration...
A Multi-Dataset Evaluation of Models for Automated Vulnerability Repair
Software vulnerabilities pose significant security threats, requiring effective mitigation. While Automated Program Repair (APR) has advanced in fixing general bugs, vulnerability patching, a...
Machine Learning for Detection and Mitigation of Web Vulnerabilities and Web Attacks
Detection and mitigation of critical web vulnerabilities and attacks like cross-site scripting (XSS), and cross-site request forgery (CSRF) have been a great concern in the field of web security....
LLaVul: A Multimodal LLM for Interpretable Vulnerability Reasoning about Source Code
Increasing complexity in software systems places a growing demand on reasoning tools that unlock vulnerabilities manifest in source code. Many current approaches focus on vulnerability analysis as...
Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents
Large Language Model (LLM)-enabled agents are rapidly emerging across a wide range of applications, but their deployment introduces vulnerabilities with security implications. While prior work has...
Challenges in Developing Secure Mobile Health Applications, A Systematic Review
Mobile health (mHealth) applications (apps) have gained significant popularity over the last few years due to its tremendous benefits, such as lowering healthcare cost and increasing patient...
Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages
Vulnerabilities in open source packages can be a security risk for the client projects that use these packages as dependencies. When a new vulnerability is discovered in a package, the package...
Improving Developers' Understanding of Regex Denial of Service Tools through Anti-Patterns and Fix Strategies
Regular expressions are used for diverse purposes, including input validation and firewalls. Unfortunately, they can also lead to a security vulnerability called ReDoS (Regular Expression Denial...
REST API Fuzzing by Coverage Level Guided Blackbox Testing
With the growth of web applications, REST APIs have become the primary communication method between services. In order to ensure system reliability and security, software quality can be assured by...
An Empirical Study of Developers' Discussions about Security Challenges of Different Programming Languages
Given programming languages can provide different types and levels of security support, it is critically important to consider security aspects while selecting programming languages for developing...