Understanding
the risk
Historically, many serious vulnerabilities in applications stem from undetected weaknesses in this code. Well known critical bugs such as Heartbleed were lying quietly in the code for years. Heartbleed for 2 years, Log4Shell for 8 years!
*Source: 2024 Synopsys “Open Source Security and Risk Analysis” (OSSRA)
Discovered in 2014, this OpenSSL flaw allowed attackers to read sensitive data from affected servers. Undetected for over two years, it impacted 17% of secure web servers, costing companies an estimated $500 million in mitigation.
Found in October 2022 in the Apache Commons Text library, allows remote code execution through untrusted input. The root cause was hidden in the code for 4 years. It poses significant risks due to its widespread use in enterprise applications.
(IBM - United States)
A critical Log4j flaw, undetected from 2013 until December 2021 (8 years), allowed arbitrary code execution. The vulnerability's widespread impact prompted urgent global response, with potential costs running into billions due to its extensive use.
The Sudo buffer overflow vulnerability, disclosed in 2021, was hidden for nearly a decade. It allowed unprivileged users to gain root access on affected systems, leading to urgent patching due to the high risk and ease of exploitation.
PrintDemon is a Windows Print Spooler flaw allowing low-privileged users to gain SYSTEM privileges. It affects multiple Windows versions and was patched in the May 2020 update after being hidden in the code for 24 years. Its ease of exploitation posed significant security risks.
Current tools are inadequate
Existing analysis tools to scan and detect these bugs are currently unable to scale to the level needed to inspect the hundreds of thousands of Open Source projects. They are overwhelmed by the cost and complexity of processing vast amounts of warnings across numerous projects
Until now...
We Detect Bugs at Scale
