← 研踪 PaperTrailarXiv:2611.14164 · v1
An Empirical Study on CVE-based Vulnerabilities Propagation from one System to another System (IntraProject vs InterProject)
首次提交 2026-11-10 22:49
版本更新 2026-11-10 22:49
雷达观测 2026-11-11 13:08
摘要
Vulnerabilities in applications, including browsers, media players, online services and document readers, etc. are often exploited and cause a serious damage. The vulnerabilities could exist in your system maybe because of some coding errors, design oversights, outdated software, AI generated codes or maybe transferred from another system during development (e.g., code clones). The propagation of software vulnerabilities is a critical concern in cybersecurity. This study examines the root cause problem of vulnerabilities propagation with experiments. We analyzed the propagation of CVE (Common Vulnerabilities and Exposures) based vulnerabilities within and between different software projects (IntraProject vs. InterProject). We performed several experiments on CVE based vulnerability dataset (retrieved from NVD source) by using our vulnerability detection tool (SQVDT). In the results, we discovered similar patterns of vulnerable code in several very famous recently used software, including latest version of Linux, Android operating systems, and in thousands of open source projects available on GitHub. We found several very high severity level (CVSS) vulnerabilities that propagated from one system to another system, just because of copy/paste (reuse) the code. Furthermore, we performed an empirical evaluation and verification of these vulnerable patterns that propagated to other systems by also considering the frequency of their propagation. Finlay, we recommended the impact of these vulnerabilities propagation on the interconnected systems.
作者备注：17 Pages, 14 Figures
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-10 22:49 · 最新观测版本
An Empirical Study on CVE-based Vulnerabilities Propagation from one System to another System (IntraProject vs InterProject)
Vulnerabilities in applications, including browsers, media players, online services and document readers, etc. are often exploited and cause a serious damage. The vulnerabilities could exist in your system maybe because of some coding errors, design oversights, outdated software, AI generated codes or maybe transferred from another system during development (e.g., code clones). The propagation of software vulnerabilities is a critical concern in cybersecurity. This study examines the root cause problem of vulnerabilities propagation with experiments. We analyzed the propagation of CVE (Common Vulnerabilities and Exposures) based vulnerabilities within and between different software projects (IntraProject vs. InterProject). We performed several experiments on CVE based vulnerability dataset (retrieved from NVD source) by using our vulnerability detection tool (SQVDT). In the results, we discovered similar patterns of vulnerable code in several very famous recently used software, including latest version of Linux, Android operating systems, and in thousands of open source projects available on GitHub. We found several very high severity level (CVSS) vulnerabilities that propagated from one system to another system, just because of copy/paste (reuse) the code. Furthermore, we performed an empirical evaluation and verification of these vulnerable patterns that propagated to other systems by also considering the frequency of their propagation. Finlay, we recommended the impact of these vulnerabilities propagation on the interconnected systems.
查看此版本解读 →查看此版本原文 ↗