CARVIEW |
Select Language
HTTP/2 200
date: Sat, 11 Oct 2025 14:18:49 GMT
content-type: text/html;charset=utf-8
content-encoding: gzip
x-vhost: blackduck
content-security-policy: default-src 'self' 'unsafe-hashes' 'unsafe-inline' 'unsafe-eval' data: blob: edge.adobedc.net adobedc.demdex.net *.adobe.com *.adobe.io cdn.cookielaw.org assets.adobedtm.com kit.fontawesome.com ka-p.fontawesome.com munchkin.marketo.net adobedc.demdex.net snap.licdn.com *.drift.com js.driftt.com js.zi-scripts.com j.6sc.co geolocation.onetrust.com ipv6.6sc.co c.6sc.co b.6sc.co epsilon.6sense.com px.ads.linkedin.com static.cloud.coveo.com boards.greenhouse.io *.mktoresp.com ws.zoominfo.com job-boards.greenhouse.io api.company-target.com *.org.coveo.com synopsysnonproduction2yln023as.analytics.org.coveo.com *.brighttalk.com brighttalk.com js.zi-scripts.com *.blackduck.com blackduck.com players.brightcove.net *.brightcove.com manifest.prod.boltdns.net *.brightcovecdn.com googletagmanager.com *.googletagmanager.com *.google.com *.google.ca *.google.co.uk google.co.in google.com *.google-analytics.com google-analytics.com googleads.g.doubleclick.net td.doubleclick.net *.googleapis.com *.gstatic.com *.leadspace.com *.clarity.ms *.bing.com *.bing.net *.bing-int.com *.6sc.co *.6sense.co 846-esg-342.mktoutil.com *.youtube.com;
cache-control: max-age=300
expires: Sat, 11 Oct 2025 14:23:49 GMT
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
set-cookie: affinity="fb1bf1dee263c44f"; Path=/; HttpOnly; secure
x-served-by: cache-bom-vanm7210033-BOM
x-cache: MISS
x-timer: S1760192329.611293,VS0,VS0,VE1172
vary: Accept-Encoding,User-Agent
cf-cache-status: BYPASS
server: cloudflare
cf-ray: 98cefd249b0ec7d3-BLR
Black Duck Editorial Team
From this Author
Black Duck named a 2025 Intellyx Digital Innovator Award winner
Jun 11, 2025
|
1 min read
BSIMM15: New focus on securing AI and the software supply chain
Jan 14, 2025
|
5 min read
Building Security In Podcast: New strategies for managing risk
Aug 22, 2023
|
4 min read
Solving cross-platform DevSecOps challenges with Black Duck
Aug 16, 2023
|
6 min read
CyRC Vulnerability Advisory: CVE-2023-0871 Vulnerability in OpenNMS Horizon
Aug 15, 2023
|
1 min read
Building Security In Podcast: Machine Learning + AI
Jul 16, 2023
|
1 min read
An Enterprise Guide: Periodic Cloud Security Risk Assessments
May 31, 2023
|
6 min read
Synopsys named in 2023 Fortress Cyber Security Awards
May 31, 2023
|
1 min read
Eliminate malicious code in your software supply chain
May 17, 2023
|
2 min read
AppSec Decoded: Evaluating threats with threat modeling risk analysis
Apr 25, 2023
|
1 min read
AppSec Decoded: Creating an attack model in threat modeling
Apr 20, 2023
|
1 min read
Polaris integrations: Secure development at the speed of business
Apr 18, 2023
|
3 min read
AppSec Decoded: Creating a system model in threat modeling
Apr 13, 2023
|
1 min read
AppSec Decoded: Scoping + data gathering in threat modeling
Apr 03, 2023
|
1 min read
AppSec Decoded: Continuous AppSec testing in DevSecOps with Seeker IAST
Mar 15, 2023
|
7 min read
AppSec Decoded: Managing your open source risks
Mar 01, 2023
|
1 min read
AppSec Decoded: Takeaways from the 2022 “Software Vulnerability Snapshot” report
Feb 26, 2023
|
1 min read
Spotlight on CRED: Benchmarking security with a BSIMM assessment
Feb 08, 2023
|
3 min read
AppSec Decoded: The research behind the 2022 “Software Vulnerability Snapshot”
Jan 10, 2023
|
1 min read
SBOM: What’s in your software ingredients list?
Dec 08, 2022
|
3 min read
Beyond NVD data: Using Black Duck Security Advisories for version accuracy
Nov 21, 2022
|
5 min read
JavaScript security best practices for securing your applications
Nov 08, 2022
|
11 min read
Avoid anaphylactic shock by auditing dependencies in software due diligence
Oct 28, 2022
|
4 min read
Real-time OWASP vulnerabilities as you code with Code Sight and Rapid Scan Static
Oct 16, 2022
|
2 min read
I have my Black Duck Audit reports; What’s next?
Oct 13, 2022
|
3 min read
Commercial software licenses in software due diligence
Sep 23, 2022
|
3 min read
AppSec Decoded: The NIST guidance on supply chain risk management
Aug 23, 2022
|
1 min read
AppSec Decoded: An introduction to the Black Duck Cybersecurity Research Center
Aug 10, 2022
|
1 min read
Synopsys and ESG report points to prevalence of software supply chain risks
Aug 09, 2022
|
5 min read
CyRC Vulnerability Advisory: Local privilege escalation in Kaspersky VPN
Aug 03, 2022
|
1 min read
CyRC Vulnerability Analysis: Repo jacking in the software supply chain
Aug 01, 2022
|
6 min read
AppSec Decoded: Application security orchestration and correlation
Jul 18, 2022
|
1 min read
AppSec Decoded: Get the most out of your open source software
Jul 13, 2022
|
1 min read
AppSec Decoded: Security at the speed of DevOps
Jun 09, 2022
|
1 min read
AppSec Decoded: Managing software supply chain risks
May 22, 2022
|
1 min read
Two-factor authentication misconfiguration bypass
May 12, 2022
|
3 min read
Product Security Advisory: Reflected cross-site scripting in Black Duck Hub
May 08, 2022
|
1 min read
AppSec Decoded: Is an SBOM a silver bullet for software supply chain security?
Apr 05, 2022
|
1 min read
BYOD in the workforce: MDM and MAM with Microsoft Intune
Mar 31, 2022
|
4 min read
#BreakTheBias: A conversation about tackling gender equality in the workforce
Mar 07, 2022
|
1 min read
Navigating the road ahead for automotive cybersecurity
Feb 20, 2022
|
10 min read
Black History Month: Uplifting voices at Black Duck
Feb 14, 2022
|
3 min read
AppSec Decoded: Building security into DevSecOps
Jan 31, 2022
|
1 min read
Scale and mature your AppSec program with a managed services partner
Jan 23, 2022
|
3 min read
AppSec Decoded: Why Biden’s executive order should be on your radar
Oct 28, 2021
|
1 min read
Top 10 Spring Security best practices for Java developers
Oct 16, 2021
|
7 min read
AppSec Decoded: Cyber security measures for technology buyers and suppliers
Sep 26, 2021
|
1 min read
Strengthen your cloud security posture with Azure Sentinel
Sep 10, 2021
|
4 min read
ASOC series part 2: How to scale AppSec with application security automation
Sep 08, 2021
|
5 min read
Reflections on trusting plugins: Backdooring Jenkins builds
Aug 19, 2021
|
6 min read
Keep infrastructure as code secure with Black Duck
Aug 08, 2021
|
5 min read
AppSec Decoded: New executive order changes dynamic of software security standards
Jul 28, 2021
|
1 min read
Reduce open source software risks in your supply chain
Jul 11, 2021
|
6 min read
Getting started with writing checkers using CodeXM
Jul 08, 2021
|
3 min read
Reduce open source risk in M&A with software due diligence
Jun 17, 2021
|
1 min read
Web application security testing at scale with Coverity SAST
Jun 05, 2021
|
3 min read
Cybersecurity Executive Order requires new software security standards
May 12, 2021
|
4 min read
AppSec Decoded: Manufacturing more-secure IoT devices
Jan 31, 2021
|
1 min read
AppSec Decoded: The security dilemma of IoT devices
Oct 20, 2020
|
1 min read
Developing a COVID-19 track and trace app — through the lens of Black Duck
Aug 25, 2020
|
4 min read
Are you following the top 10 software security best practices?
Jun 28, 2020
|
4 min read
How to overcome the top 6 application security challenges
Jun 03, 2020
|
2 min read
Critical gap in developer security training puts applications at risk
May 13, 2020
|
3 min read
3 ways to boost your security with role-based security compliance training
May 05, 2020
|
4 min read
3 long-term benefits of an application security training strategy
May 03, 2020
|
2 min read
CyRC analysis: CVE-2020-7958 biometric data extraction in Android devices
Apr 27, 2020
|
15 min read
How 5G and IoT devices open up the attack surface on enterprises
Apr 07, 2020
|
3 min read
3 ways to improve your software development skills
Mar 29, 2020
|
3 min read
Mobile security app-titude best practices for secure app design and data privacy
Feb 03, 2020
|
4 min read
Ask the Experts: What’s most rewarding about your career in cyber security?
Feb 02, 2020
|
5 min read
Synopsys acquires Tinfoil Security, DAST and API testing solutions provider
Jan 08, 2020
|
1 min read
SAST vs. SCA: What’s the difference? Do I need both?
Nov 19, 2019
|
3 min read
CloudBees and Synopsys: Putting “Sec” into DevSecOps
Oct 09, 2019
|
2 min read
Wormwood – An Explicit Way to Test Absinthe GraphQL APIs
Sep 29, 2019
|
4 min read
Coverity release ties in well to the latest MITRE CWE Top 25
Sep 26, 2019
|
2 min read
Q&A: Fuzz testing, agent instrumentation, and Defensics
Sep 19, 2019
|
4 min read
What are the different types of security vulnerabilities?
Aug 26, 2019
|
3 min read
[Infographic] Financial cybersecurity by the numbers
Aug 13, 2019
|
2 min read
The license and security risks of using Node.js
Aug 11, 2019
|
6 min read
Ask the Experts: How can we prevent ransomware attacks?
Aug 04, 2019
|
5 min read
Join Synopsys at codenomi-con and Black Hat USA 2019
Jul 09, 2019
|
1 min read
Web AppSec interview questions every company should ask
Jun 18, 2019
|
7 min read
Ask the Experts: Should the US have a data privacy law similar to GDPR?
Jun 10, 2019
|
8 min read
How are code quality and code security related?
May 24, 2019
|
3 min read
Synopsys and Red Hat OpenShift 4: One smooth Operator!
May 06, 2019
|
4 min read
Are you making these software standards compliance mistakes?
Apr 18, 2019
|
2 min read
Complex but helpful: Negotiating FDA guidance to build a cybersecurity program
Apr 09, 2019
|
4 min read
Container scanning for security with Black Duck OpsSight 2.2
Feb 05, 2019
|
2 min read
How to “shift left” with application security tools, and how not to
Jan 30, 2019
|
2 min read
Server-side GraphQL Querying with Elixir Absinthe
Jan 29, 2019
|
3 min read
Should I include CSRF protection on a login form?
Nov 19, 2018
|
2 min read
Today I Learned: Using SCSS in your Vue Components
Nov 13, 2018
|
1 min read
Shared responsibility model: Who owns cloud security?
Nov 06, 2018
|
2 min read
Tineola: Taking a bite out of enterprise blockchain
Sep 22, 2018
|
4 min read
Let’s write more CodeXM checkers (second-stage ignition)
Sep 14, 2018
|
6 min read
The IoT within us: Network-connected medical devices
Sep 12, 2018
|
3 min read
What’s so special about zero-day vulnerabilities?
Sep 11, 2018
|
1 min read
Securing applications with Coverity’s static analysis results
Aug 26, 2018
|
3 min read
Integrating Coverity static analysis into development workflows
Aug 19, 2018
|
2 min read
How RASP complements application security testing to minimize risk
Jul 14, 2018
|
2 min read
The what, why, and who of runtime application self-protection (RASP)
Jun 14, 2018
|
3 min read
How does the TeenSafe data leak present a classic false sense of security?
May 25, 2018
|
3 min read
Detecting Spectre vulnerability exploits with static analysis
Mar 21, 2018
|
8 min read
Is shadow engineering developing your applications?
Jan 19, 2018
|
1 min read
The Data Protection Directive versus the GDPR: Understanding key changes
Jan 18, 2018
|
6 min read
Manage security risk in GitHub open source projects with CoPilot
Jan 09, 2018
|
1 min read
Is breach of the GPL license breach of contract?
Jan 02, 2018
|
3 min read
PayPal uncovers TIO Networks data breach affecting 1.6 million users
Dec 06, 2017
|
1 min read
Navigating responsible vulnerability disclosure best practices
Nov 29, 2017
|
4 min read
How to proactively protect IoT devices from DDoS attacks
Nov 01, 2017
|
3 min read
ROCA: Cryptographic flaws in BitLocker, Secure Boot, and millions of smartcards
Oct 17, 2017
|
5 min read
Black Duck and Google Grafeas: Improving container visibility and security
Oct 12, 2017
|
1 min read
How to implement security measures without negatively affecting software quality
Sep 29, 2017
|
5 min read
Why do companies need a software security program?
Sep 21, 2017
|
3 min read
So Apache broke up with Facebook. How does that affect you?
Sep 13, 2017
|
3 min read
What you need to know about BlueBorne Bluetooth flaws
Sep 12, 2017
|
3 min read
Black Duck finds 3 Linux kernel vulnerabilities
Sep 10, 2017
|
3 min read
“Easy” to hack Apache Struts vulnerability CVE-2017-9805
Sep 05, 2017
|
2 min read
A journey through the secure software development life cycle phases
Sep 05, 2017
|
6 min read
DEF CON 25 exposes voting system vulnerabilities
Aug 28, 2017
|
4 min read
Scan nirvana: Hub Detect for all native build and CI tools
Aug 15, 2017
|
3 min read
Is threat modeling compatible with Agile and DevSecOps?
Jul 07, 2017
|
3 min read
3 permissive licenses and why they deserve a little respect
Jun 21, 2017
|
2 min read
4 key differences moving from Java to .NET Core
May 29, 2017
|
2 min read
When should threat modeling take place in the SDLC?
May 24, 2017
|
2 min read
Node.js: Preventing common vulnerabilities in the MEAN stack
May 16, 2017
|
2 min read
AngularJS: Preventing common vulnerabilities in the MEAN stack
May 08, 2017
|
5 min read
DoublePulsar continues to expose older Windows boxes: What you need to know
May 07, 2017
|
3 min read
.NET component vulnerability analysis in production
May 07, 2017
|
2 min read
What are the signs your web application has been hacked?
Apr 27, 2017
|
3 min read
ExpressJS: Preventing common vulnerabilities in the MEAN stack (Part 1)
Apr 20, 2017
|
2 min read
MongoDB: Preventing common vulnerabilities in the MEAN stack
Apr 13, 2017
|
5 min read
Attributes of secure web application architecture
Apr 04, 2017
|
7 min read
Does software quality equal software security? It depends
Mar 26, 2017
|
4 min read
Swift: Close to greatness in programming language design, Part 2
Mar 22, 2017
|
6 min read
CVE-2017-2636 strikes Linux kernel with double free vulnerability
Mar 18, 2017
|
2 min read
Howard Schmidt, the United States’ first Cybersecurity Czar, has died
Mar 01, 2017
|
2 min read
AngularJS security series part 1: Angular $http service
Feb 23, 2017
|
11 min read
Cloudbleed, like Heartbleed, may affect millions
Feb 22, 2017
|
3 min read
Examining vulnerability criticality when risk ranking vulnerabilities
Feb 16, 2017
|
2 min read
An overview of open standards for IoT communication protocols
Jan 31, 2017
|
3 min read
3 things to consider when risk ranking your applications
Jan 23, 2017
|
2 min read
5 reasons to use third-party authentication instead of creating your own
Nov 28, 2016
|
4 min read
Here are the top 10 best practices for securing Android apps
Nov 28, 2016
|
3 min read
Hearts and minds: Culture management vs. human resources
Nov 21, 2016
|
4 min read
How to respond to application security incidents
Nov 12, 2016
|
7 min read
OSS warranties and indemnities in technology transactions
Nov 06, 2016
|
5 min read
Synopsys expands security signoff solution with Cigital and Codiscope acquisition
Nov 05, 2016
|
2 min read
The pursuit of Hapi-ness: 5 must-have Hapi security plugins
Oct 21, 2016
|
2 min read
Brace yourselves: Application transport security is coming
Oct 19, 2016
|
4 min read
Vulnerability management: Designing severity risk ranking systems
Oct 19, 2016
|
3 min read
Open source security management: A question of when, not whether
Oct 14, 2016
|
3 min read
Identifying and resolving software vulnerabilities: A balancing act
Sep 26, 2016
|
2 min read
Why there are at least 6,000 vulnerabilities without CVE-IDs
Sep 21, 2016
|
2 min read
Software testing included in final ISA / IEC 62443-4-1
Sep 15, 2016
|
1 min read
The Complete Security Vulnerability Assessment Checklist
Sep 07, 2016
|
2 min read
Recognizing Another Type of Threat: Non-targeted Attacks
Aug 31, 2016
|
3 min read
4 ineffective security controls that leave you with a false sense of security
Aug 24, 2016
|
3 min read
Pseudorandom number generation means pseudosecurity
Aug 24, 2016
|
2 min read
Avoiding false positives in application security through customization
Aug 08, 2016
|
3 min read
Web application security threats and countermeasures
Jul 18, 2016
|
2 min read
Rocket.Chat: Enabling privately hosted chat services
Jun 13, 2016
|
8 min read
4 threat modeling questions to ask before your next Agile sprint
Jun 01, 2016
|
3 min read
Best practices for free and open source software vulnerability management
May 14, 2016
|
5 min read
Man in the middle: When Bob met Alice, and Eve heard everything
Apr 28, 2016
|
3 min read
The open perimeter: Is your internal network protected?
Apr 27, 2016
|
2 min read
TLS 1.3 and the future of cryptographic protocols
Apr 12, 2016
|
7 min read
Black Duck discovers CVE-2015-5370 in Samba’s DCE/RPC protocol implementation
Apr 11, 2016
|
1 min read
How to avoid the top 10 software security flaws
Apr 04, 2016
|
2 min read
How to do static analysis testing in 6 easy steps
Mar 15, 2016
|
3 min read
Web application security basics: 3 tips to get started
Mar 12, 2016
|
2 min read
An examination of ineffective certificate pinning implementations
Mar 08, 2016
|
9 min read
Do you believe the 7 myths of software security?
Feb 04, 2016
|
2 min read
3 security risks that architecture analysis can resolve
Jan 24, 2016
|
4 min read
Pen testing best practices to take the pain out of penetration testing
Jan 18, 2016
|
4 min read
5 essentials of cloud-based application security testing
Jan 14, 2016
|
2 min read
How to mitigate your third-party mobile keyboard risk
Dec 21, 2015
|
4 min read
3 ways abuse cases can drive security requirements
Dec 05, 2015
|
3 min read
Software security myth #3: Penetration testing solves everything
Oct 22, 2015
|
5 min read
3 fundamentals of a software security initiative
Oct 07, 2015
|
4 min read
Adding security steps to your agile development process
Sep 27, 2015
|
4 min read
Agile and application security: A promising pair
Sep 22, 2015
|
4 min read
The cathedral and the bazaar of software security vulnerabilities
Aug 14, 2015
|
3 min read
Integrating Touch ID into your iOS applications
Aug 03, 2015
|
5 min read
3 reasons software security governance is essential to your business
Jul 27, 2015
|
3 min read
Samsung Galaxy phone hack: Making sense of the “Samsung” RCE vulnerability
Jun 18, 2015
|
3 min read
4 application security skills every expert ought to have
Jun 18, 2015
|
2 min read
Is conventional penetration testing enough to secure e-commerce applications?
Mar 30, 2015
|
3 min read
Build software security in. Don’t rely on a tower defense strategy.
Feb 04, 2015
|
1 min read
How to fix cross-site scripting: A developer’s guide
Dec 13, 2014
|
8 min read
How To Fix POODLE (And Why You’re Probably Still Vulnerable)
Aug 14, 2014
|
3 min read
Cordova InAppBrowser remote privilege escalation
May 19, 2014
|
4 min read
SecureRandom implementation (sun.security.provider.SecureRandom – SHA1PRNG)
Jan 15, 2014
|
3 min read
Issues to be aware of when using Java's SecureRandom
Jan 05, 2014
|
2 min read
Remote code execution in Apache Roller via OGNL injection
Oct 29, 2013
|
2 min read
2 path traversal defects in Oracle's JSF2 implementation
Oct 15, 2013
|
3 min read
Stop Paying For SSL Certificates You Don’t Need
Jul 09, 2013
|
6 min read