Security Vulnerabilities in OpenSource Java Libraries
summary
Survey of NVD, OSVDB and Exploit-DB data finds Tomcat ≈100 CVEs while proprietary WebLogic/WebSphere each approach ~200 CVEs with many CVSS 9–10 criticals; open‑source containers account for roughly 30% of reported holes versus double that for closed products. Common failures are information leakage, XSS, permission/privilege errors, CSRF and path traversal; SQL injection is rare. Struts2 shows 14 CVEs (nine in 2012) with OGNL/escaping enabling RCE via crafted URLs. CVSS scores inflate when vendors hide details; prioritize trends, complexity and vendor security culture.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:26Study motivation
- 6:02Libraries and servers
- 14:39Server vulnerabilities
- 28:58Confidentiality, integrity and availability impact
- 33:44Vulnerability statistics
- 38:51Web framework vulnerabilities
- 44:39Library security assessment
related talks
56mThe Anatomy of Java Vulnerabilities
25mOWASP Top 10 Risks for Open Source Software
50mStranger Danger: Your Java Attack Surface Just Got Bigger
49mThe Anatomy of Java Vulnerabilities
01h 04mSecurity Vulnerabilities in Third Party Code: FIX ALL THE THINGS!
48mThe Hidden Security Hazards in Your Java Stack
46mThe Anatomy of Java Vulnerabilities
14mThe State of Open Source Vulnerabilities Management in 2019