2023年软件漏洞快照

抱歉，尚不支持此语言

AI-generated code | Harness the power of AI coding assistants while managing the risks.
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Consolidation | Simplify your application security program
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud.
Open Source License Compliance | Effective solutions for ensuring open source license compliance.
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality & Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators.

Static Analysis (SAST) | Analyzing code for security vulnerabilities without executing it.
Software Composition Analysis (SCA) | Analyzing software components for security and license compliance.
Dynamic Analysis (DAST) | Testing running applications for security vulnerabilities.
Interactive Analysis (IAST) | Real-time security testing during application execution.
Penetration Testing | Simulated cyberattacks to identify vulnerabilities.
Mobile Application Security Testing (MAST) | Ensuring the security of mobile applications.
Application Security Posture Management (ASPM) | Managing and improving application security posture.
Fuzz Testing | Identifying vulnerabilities by inputting random data to applications.

Automotive | Security solutions for automotive industry applications.
Financial Services | Security solutions tailored for financial services.
IoT & Embedded | Security for Internet of Things and embedded systems.
Medical Device | Security solutions for medical devices.
Public Sector | Security solutions for government and public sector organizations.

Dev and DevOps Teams | Security tools and practices for development and DevOps teams.
Security Teams | Solutions and support for dedicated security teams.
Legal Teams | Resources and compliance tools for legal teams.

软件漏洞快照报告

对三年来10类最常见网络和软件应用漏洞的分析

立即下载

为了制作《软件漏洞快照》报告，Black Duck网络安全研究中心 (CyRC)的研究人员和Black Duck安全测试服务部的顾问使用了商业软件系统和应用测试三年的匿名数据。

Black Duck测试发现了仍对网络和软件应用安全造成重大威胁的已知漏洞，尤其是与以下各项相关的高危漏洞：

这些测试还凸显出易受攻击的第三方库带来的持续危险，以及软件开发环境对强大软件供应链安全的需求 — 在软件开发中，超过90%的软件中包含开源代码。

该报告涉及16个垂直行业，包括软件和互联网、金融服务、保险、商业服务、制造业、媒体和娱乐以及医疗保健。

该报告清楚地解释了为何说全方位的AppSec测试对于管理软件风险至关重要。虽然静态应用安全测试 (SAST) 等测试工具可以在软件开发生命周期的早期揭示安全问题，但却无法发现运行时漏洞。同样，某些漏洞是自动测试工具无法检测到的，需要人工监督才能发现。

通过长达三年的大约1.2万次测试，CyRC发现：

对三年来10类最常见的网络和软件应用漏洞的分析