National Vulnerability Database Research Articles

A Robust Chinese Named Entity Recognition Method Based on Integrating Dual-Layer Features and CSBERT

In the rapidly evolving field of cybersecurity, the integration of multi-source, heterogeneous, and fragmented data into a coherent knowledge graph has garnered considerable attention. Such a graph elucidates semantic interconnections, thereby facilitating sophisticated analytical decision support. Central to the construction of a cybersecurity knowledge graph is Named Entity Recognition (NER), a critical technology that converts unstructured text into structured data. The efficacy of NER is pivotal, as it directly influences the integrity of the knowledge graph. The task of NER in cybersecurity, particularly within the Chinese linguistic context, presents distinct challenges. Chinese text lacks explicit space delimiters and features complex contextual dependencies, exacerbating the difficulty in discerning and categorizing named entities. These linguistic characteristics contribute to errors in word segmentation and semantic ambiguities, impeding NER accuracy. This paper introduces a novel NER methodology tailored for the Chinese cybersecurity corpus, termed CSBERT-IDCNN-BiLSTM-CRF. This approach harnesses Iterative Dilated Convolutional Neural Networks (IDCNN) for extracting local features, and Bi-directional Long Short-Term Memory networks (BiLSTM) for contextual understanding. It incorporates CSBERT, a pre-trained model adept at processing few-shot data, to derive input feature representations. The process culminates with Conditional Random Fields (CRF) for precise sequence labeling. To compensate for the scarcity of publicly accessible Chinese cybersecurity datasets, this paper synthesizes a bespoke dataset, authenticated by data from the China National Vulnerability Database, processed via the YEDDA annotation tool. Empirical analysis affirms that the proposed CSBERT-IDCNN-BiLSTM-CRF model surpasses existing Chinese NER frameworks, with an F1-score of 87.30% and a precision rate of 85.89%. This marks a significant advancement in the accurate identification of cybersecurity entities in Chinese text, reflecting the model’s robust capability to address the unique challenges presented by the language’s structural intricacies.

A Deep Learning Approach to Discover Router Firmware Vulnerabilities

An attack on Industrial IoT systems can cause severe damage to connected devices and their owners. Therefore, detecting router firmware vulnerabilities has become a critical issue. However, collecting a dataset of firmware samples is challenging as no open-source datasets are available online. A manual effort was required to verify the states of samples in both the Common Vulnerabilities and Exposures (CVE) and The National Vulnerability Database (NVD) databases as either vulnerable or benign. After verification, 1450 samples were collected. This paper investigates the effectiveness of using convolutional neural networks (CNNs) and computer vision techniques to analyze home router firmware. The collected firmware samples were read as an array of byte strings, divided into sub-arrays based on the image's dimensions, then layered on top of one another to produce the firmware images. The images were divided by manufacturer and used as inputs for various CNN models to test their accuracy. Three statistical filtering algorithms were used on each manufacturer's set to produce multiple versions of each set, totaling 24 datasets across four manufacturers, with six datasets per manufacturer (4 filtered images and two grayscale and RGB images). The image filter algorithms used include local binary pattern (LBP), histogram-oriented gradients (HOG), and Gabor filter used on the LBP and HOG sets. After testing all combinations of the filtered/normal datasets with the CNN training model, the HOG filter was the most accurate, with an average accuracy of 85.81% across all tests and models, with results as high as 97.94% when used with the appropriate CNN model.

CLFuzz: Vulnerability Detection of Cryptographic Algorithm Implementation via Semantic-aware Fuzzing

Cryptography is a core component of many security applications, and flaws hidden in its implementation will affect the functional integrity or, more severely, pose threats to data security. Hence, guaranteeing the correctness of the implementation is important. However, the semantic characteristics (e.g., diverse input data and complex functional transformation) challenge those traditional program validation techniques (e.g., static analysis and dynamic fuzzing). In this article, we propose CLFuzz, a semantic-aware fuzzer for the vulnerability detection of cryptographic algorithm implementation. CLFuzz first extracts the semantic information of targeted algorithms including their cryptographic-specific constraints and function signatures. Based on them, CLFuzz generates high-quality input data adaptively to trigger error-prone situations efficiently. Furthermore, CLFuzz applies innovative logical cross-check that strengthens the logical bug detection ability. We evaluate CLFuzz on the widely used implementations of 54 cryptographic algorithms. It outperforms state-of-the-art cryptographic fuzzing tools. For example, compared with Cryptofuzz, it achieves a coverage speedup of 3.4× and increases the final coverage by 14.4%. Furthermore, CLFuzz has detected 12 previously unknown implementation bugs in 8 cryptographic algorithms (e.g., CMAC in OpenSSL and Message Digest in SymCrypt), most of which are security-critical and have been successfully collected in the national vulnerability database (7 in NVD/CNVD) and is awarded by the Microsoft bounty program (2 for $1,000).

Security vulnerabilities in healthcare: an analysis of medical devices and software

The integration of IoT in healthcare has introduced vulnerabilities in medical devices and software, posing risks to patient safety and system integrity. This study aims to bridge the research gap and provide valuable insights for addressing healthcare vulnerabilities and their mitigation mechanisms. Software vulnerabilities related to health systems from 2001 to 2022 were collected from the National Vulnerability Database (NVD) systematized by software developed by the researchers and assessed by a medical specialist for their impact on patient well-being. The analysis revealed electronic health records, wireless infusion pumps, endoscope cameras, and radiology information systems as the most vulnerable. In addition, critical vulnerabilities were identified, including poor credential management and hard-coded credentials. The investigation provides some insights into the consequences of vulnerabilities in health software products, projecting future security issues by 2025, offers mitigation suggestions, and highlights trends in attacks on life support and health systems are also provided. The healthcare industry needs significant improvements in protecting medical devices from cyberattacks. Securing communication channels and network schema and adopting secure software practices is necessary. In addition, collaboration, regulatory adherence, and continuous security monitoring are crucial. Industries, researchers, and stakeholders can utilize these findings to enhance security and safeguard patient safety.Graphical abstract

A new method for vulnerability and risk assessment of IoT

In this paper, we propose a generic vulnerability and risk assessment method for IoT-enabled systems. The main aim is to provide risk detection and vulnerability assessment for IoT-based systems. We present three phases of risk assessment methodology: graph construction, attack path detection, and attack path filtering for high-level attack paths. We give attack path detection, risk level computing, and attack path removing procedures to validate these phases. We represent the IoT-based network as a graphical structure. Then, we construct the topology for a given IoT-based system. The smart home system is considered as a case scenario to present a realistic instance. The National Vulnerability Database (NVD), Common Vulnerability Scoring System (CVSS), and Common Vulnerability Exposures (CVE) metrics are used to assign vulnerabilities to devices. We formulate risk factors to compute risk levels for each node, attack path, and entire graph. We use the modified Depth First Algorithm (DFS) to find all attack paths for a source and target nodes. In addition, we compute risk levels using computing procedures. Further, we filter detected attack paths considering dominance level using computational metrics. We perform the simulation on a custom Python simulator considering the designed IoT-based smart home system. We compare our proposed methods with the state of the art. According to the experimental results, the proposed methods outperform existing vulnerability-based risk assessment models regarding running time complexity and operational cost.

Exploring topic models to discern cyber threats on Twitter: A case study on Log4Shell

Gathering information about cyber threats from various sources can help organisations improve proactive cyber defense and mitigate potential cyber attacks. Recently, Twitter has shown to be beneficial in providing timely Cyber Threat Intelligence (CTI) concerning cyber threats, software vulnerabilities and exploits. However, manually identifying and investigating useful insights, patterns, and trends from abundant unstructured tweets is difficult. This work proposes an end-to-end data-driven framework to collect, analyze, and monitor tweets using unsupervised topic modeling techniques. A novel visualization technique is also proposed to monitor the dynamic topic trends over time, offering an interpretable way to gain insights into a topic's lifecycle. A case study is conducted on the Log4shell vulnerability incident to demonstrate the applicability of the proposed framework. Experiments are carried out on a real-world Twitter dataset collected from 47 users within the CTI community. Results indicate that the proposed framework can discover emerging topics relevant to real-world cybersecurity incidents, with Log4Shell-related topics identified before the common public disclosure date by the National Vulnerability Database (NVD). This framework can expedite the data processing workflow and visualization for cyber threat analysis, enabling organizations to identify trends and patterns that can potentially indicate a security breach or attack.

Lost in the middle – a pragmatic approach for ERP managers to prioritize known vulnerabilities by applying classification and regression trees (CART)

PurposeCyber risk has significantly increased over the past twenty years. In many organizations, data and operations are managed through a complex technology stack underpinned by an Enterprise Resource Planning (ERP) system such as systemanalyse programmentwicklung (SAP). The ERP environment by itself can be overwhelming for a typical ERP Manager, coupled with increasing cybersecurity issues that arise creating periods of intense time pressure, stress and workload, increasing risk to the organization. This paper aims to identify a pragmatic approach to prioritize vulnerabilities for the ERP Manager.Design/methodology/approachApplying attention-based theory, a pragmatic approach is developed to prioritize an organization’s response to the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) vulnerabilities using a Classification and Regression Tree (CART).FindingsThe application of classification and regression tree (CART) to the National Institute of Standards and Technology’s National Vulnerability Database identifies prioritization unavailable within the NIST’s categorization.Practical implicationsThe ERP Manager is a role between technology, functionality, centralized control and organization data. Without CART, vulnerabilities are left to a reactive approach, subject to overwhelming situations due to intense time pressure, stress and workload.Originality/valueTo the best of the authors’ knowledge, this work is original and has not been published elsewhere, nor is it currently under consideration for publication elsewhere. CART has previously not been applied to the prioritizing cybersecurity vulnerabilities.

Evidence-based cybersecurity policy? A meta-review of security control effectiveness

ABSTRACT Cybersecurity policy should guide firms towards implementing the most effective security controls and procedures. However, there is no authority that collects evidence and ranks cybersecurity controls by efficacy. The evidence needed by policymakers is distributed across academic studies and industry white papers. To address this gap, we conduct a meta-review of studies that empirically evaluate the efficacy of cybersecurity interventions. Attack surface management and patch cadence were consistently the first and second most effective interventions. Reduced cyber insurance claims frequency was associated with migrating to cloud email and avoiding specific VPN providers. Multi-factor authentication was effective in protecting individual accounts, although inconsistent MFA-implementation undermines efficacy when rolled out across an organisation. The evidence suggests effectiveness is driven by how a control is implemented more than by a binary yes-no regarding whether it is implemented. Thus, policy measures that mandate specific controls are unlikely to result in risk reduction. Instead, policymakers should aim to support organisations in administering security controls and making risk-based decisions. Successful examples can be seen in policy measures that improve the efficiency of patch management, such as funding for the US National Vulnerability Database, CERT/CC, and the Known Exploited Vulnerabilities catalog.

A Statistical Relational Learning Approach Towards Products, Software Vulnerabilities and Exploits

Data on software vulnerabilities, products, and exploits are typically collected from multiple non-structured sources. Valuable information, e.g., on which products are affected by which exploits, is conveyed by matching data from those sources, i.e., through their relations. In this paper, we leverage this simple albeit unexplored observation to introduce a statistical relational learning (SRL) approach for the analysis of vulnerabilities, products, and exploits. In particular, we focus on the problem of determining the existence of an exploit for a given product, given information about the relations between products and vulnerabilities, and vulnerabilities and exploits, focusing on Industrial Control Systems (ICS), the National Vulnerability Database, and ExploitDB. Using RDN-Boost, we were able to reach an AUC ROC of 0.80 and an AUC PR of 0.65 for the problem at hand. To reach that performance, we indicate that it is instrumental to include textual features, e.g., extracted from the description of vulnerabilities, as well as structured information, e.g., about product categories. In addition, using interpretable relational, we report simple rules that shed insight on factors impacting the weaponization of ICS products.

V-Gas: Generating High Gas Consumption Inputs to Avoid Out-of-Gas Vulnerability

Out-of-gas errors occur when smart contract programs are provided with inputs that cause excessive gas consumption and which will be easily exploited to perform Denial-of-Service attacks. Various approaches have been proposed to estimate the gas limit of a function in smart contracts to avoid such error. However, underestimation often occurs when the contract is complex In this work, we propose V-Gas, which automatically generates inputs that maximize the gas cost and reduce underestimation. V-Gas is designed based on static analysis and feedback-directed mutational fuzz testing. First, V-Gas builds the gas weighted control flow graph of functions in smart contracts. Then, V-Gas develops gas consumption guided selection and mutation strategies to generate the input that maximize the gas consumption. For evaluation, we implement V-Gas based on js-evm, a widely used Ethereum virtual machine written in Javascript, and conduct experiments on 736 real-world transactions recorded on Ethereum. A total of 44.02% of the transactions would have out-of-gas errors based on the estimation results given by solc, meaning that the recorded real gas consumption for those transactions is larger than the gas limit estimated by solc. In comparison, V-Gas could reduce the underestimation ratio to 13.86%. To evaluate the performance of feedback-directed engine in V-Gas, we implemented other directed fuzzing engines and compared their performance with that of V-Gas. The results showed that V-Gas generates the same or higher gas estimation value on 97.8% of the transactions with less time, usually within 5 minutes. Furthermore, V-Gas has exposed 25 previously unknown out-of-gas vulnerabilities in widely used smart contracts, 6 of which have been assigned unique CVE identifiers in the U.S. National Vulnerability Database.

Machine Learning: Research on Detection of Network Security Vulnerabilities by Extracting and Matching Features

The existence of vulnerabilities is a serious threat to the security of networks, which needs to be detected timely. In this paper, machine learning methods were mainly studied. Firstly, network security vulnerabilities were briefly introduced, and then a Convolutional Neural Network (CNN) + Long Short-Term Memory (LSTM) method was designed to extract and match vulnerability features by preprocessing vulnerability data based on National Vulnerability Database. It was found that the CNN-LSTM method had high training accuracy, and its recall rate, precision, F1, and Mathews correlation coefficient (MCC) values were better than those of support vector machine and other methods in detecting the test set; its F1 and MCC values reached 0.8807 and 0.9738, respectively; the F1 value was above 0.85 in detecting different categories of vulnerabilities. The results demonstrate the reliability of the CNN-LSTM method for vulnerability detection. The CNN-LSTM method can be applied to real networks.

Vulnerability Identification and Assessment for Critical Infrastructures in the Energy Sector

Vulnerability identification and assessment is a key process in risk management. While enumerations of vulnerabilities are available, it is challenging to identify vulnerability sets focused on the profiles and roles of specific organizations. To this end, we have employed systematized knowledge and relevant standards (including National Electric Sector Cybersecurity Organization Resource (NESCOR), ISO/IEC 27005:2018 and National Vulnerability Database (NVD)) to identify a set of 250 vulnerabilities for operators of energy-related critical infrastructures. We have elaborated a “double-mapping” scheme to associate (arbitrarily) categorized assets, with the pool of identified Physical, Cyber and Human/Organizational vulnerabilities. We have designed and implemented an extensible vulnerability identification and assessment framework, allowing historized assessments, based on the CVSS (Common Vulnerability Scoring System) scoring mechanism. This framework has been extended to allow modelling of the vulnerabilities and assessments using the Structured Threat Information eXpression (STIX) JSON format, as Cyber Threat Intelligence (CTI) information, to facilitate information sharing between Electrical Power and Energy Systems (EPES) and to promote collaboration and interoperability scenarios. Vulnerability assessments from the initial analysis of the project in the context of Research and Technology Development (RTD) projects have been statistically processed, offering insights in terms of the assessment’s importance and distribution. The assessments have also been transformed into a dynamic dataset processed to identify and quantify correlation and start the discussion on the interpretation of the way assessments are performed.

Vulnerability diffusions in software product networks

AbstractDuring software product development, the combination of digital resources (such as application programming interfaces and software development kits) establishes loose and tight edges between nodes, which form a software product network (SPN). These edges serve as observable conduits that may help practitioners and researchers better understand how vulnerabilities diffuse through SPNs. We apply network theory to analyze data from over 12 years of records extracted from the National Vulnerability Database. We contribute novel measures established using machine learning to gauge the properties influencing vulnerability diffusion within an SPN. We observed an SPN having a discernable shape that changed over time via network updates. We propose hypotheses and find empirical evidence that vulnerability diffusion is influenced by edge dynamics, developer responses, and their interaction. Implications for practice are that increased developer responses reduce software vulnerability diffusion attributed to edge dynamics.

Common vulnerability scoring system prediction based on open source intelligence information sources

The number of newly published vulnerabilities is constantly increasing. Until now, the information available when a new vulnerability is published is manually assessed by experts using a Common Vulnerability Scoring System (CVSS) vector and score. This assessment is time consuming and requires expertise. Various works already try to predict CVSS vectors or scores using machine learning based on the textual descriptions of the vulnerability to enable faster assessment. However, for this purpose, previous works only use the texts available in databases such as National Vulnerability Database. With this work, the publicly available web pages referenced in the National Vulnerability Database are analyzed and made available as sources of texts through web scraping. A Deep Learning based method for predicting the CVSS vector is implemented and evaluated. The present work provides a classification of the National Vulnerability Database’s reference texts based on the suitability and crawlability of their texts. While we identified the overall influence of the additional texts is negligible, we outperformed the state-of-the-art with our Deep Learning prediction models.

Review and Comparison of US, EU, and UK Regulations on Cyber Risk/Security of the Current Blockchain Technologies: Viewpoint from 2023

AbstractThe first cryptocurrency was invented in 2008/09, but the Blockchain-Web3 concept is still in its infancy, and the cyber risk is constantly changing. Cybersecurity should also be adapting to these changes to ensure security of personal data and continuation of operations. This article starts with a comparison of existing cybersecurity standards and regulations from the National Institute of Standards and Technology (NIST) and the International Organisation for Standardisation (ISO)—ISO27001, followed by a discussion on more specific and recent standards and regulations, such as the Markets in Crypto-Assets Regulation (MiCA), Committee on Payments and Market Infrastructures and the International Organisation of Securities Commissions (CPMI-IOSCO), and more general cryptography (and post-quantum cryptography), in the context of cybersecurity. These topics are followed up by a review of recent technical reports on cyber risk/security and a discussion on cloud security questions. Comparison of Blockchain cyber risk is also performed on the recent EU standards on cyber security, including European Cybersecurity Certification Scheme (EUCS)—cloud, and US standards—The National Vulnerability Database (NVD) Common Vulnerability Scoring System (CVSS). The study includes a review of Blockchain endpoint security, and new technologies e.g., IoT. The research methodology applied is a review and case study analysing secondary data on cybersecurity. The research significance is the integration of knowledge from the United States (US), the European Union (EU), the United Kingdom (UK), and international standards and frameworks on cybersecurity that can be alighted to new Blockchain projects. The results show that cybersecurity standards are not designed in close cooperation between the two major western blocks: US and EU. In addition, while the US is still leading in this area, the security standards for cryptocurrencies, internet-of-things, and blockchain technologies have not evolved as fast as the technologies have. The key finding from this study is that although the crypto-market has grown into a multi-trillion industry, the crypto-market has also lost over 70% since its peak, causing significant financial loss for individuals and cooperation’s. Despite this significant impact to individuals and society, cybersecurity standards and financial governance regulations are still in their infancy, specifically in the UK.

Adaptive modeling for security vulnerability propagation to predict the impact of business process redesign

Background: Business process redesign (BPR) is typical in organizations and is followed by adaptive maintenance on supporting applications. However, BPR leads to information security vulnerabilities that can propagate to its supporting applications. Methods: This study proposes a new method called Node Strength-based Vulnerability Modeling (NSVM) for modeling security vulnerability propagation in the business processes and IT service layers. We applied the concept of social network strength to build our propagation model. The propagation model is needed to predict the impact of BPR on application vulnerabilities. We chose e-commerce applications as a case study. We evaluated the vulnerability propagation model by comparing the predicted vulnerability scores from the model with the actual scores of e-commerce applications in the National Vulnerability Database. Results: Our experimentation indicates that the propagation strength between nodes is influenced by Common Weakness Enumerations (CWEs) between them. Thus, the vulnerability propagation model can predict vulnerability scores at module nodes in the IT service layer. In the NSVM, the best prediction scores were obtained by aggregating the adjacency and initial scores using the maximum principle approach. The best evaluation results yield mean absolute error (MAE), root mean squared error (RMSE), and mean squared error (MSE) scores of 0.60, 1.44, and 1.16, respectively. Conclusion: Our study shows that the vulnerability propagation model with an adaptive mechanism based on BPR can be used to predict security vulnerability scores as the impact of business process redesign.

Empirical Validation of Automated Vulnerability Curation and Characterization

Prior research has shown that public vulnerability systems such as US National Vulnerability Database (NVD) rely on a manual, time-consuming, and error-prone process which has led to inconsistencies and delays in releasing final vulnerability results. This work provides an approach to curate vulnerability reports in real-time and map textual vulnerability reports to machine readable structured vulnerability attribute data. Designed to support the time consuming human analysis done by vulnerability databases, the system leverages the Common Vulnerabilities and Exposures (CVE) list of vulnerabilities and the vulnerability attributes described by the National Institute of Standards and Technology (NIST) Vulnerability Description Ontology (VDO) framework. Our work uses Natural Language Processing (NLP), Machine Learning (ML) and novel Information Theoretical (IT) methods to provide automated techniques for near real-time publishing, and characterization of vulnerabilities using 28 attributes in 5 domains. Experiment results indicate that vulnerabilities can be evaluated up to 95 hours earlier than using manual methods, they can be characterized with F-Measure values over 0.9, and the proposed automated approach could save up to 47% of the time spent for CVE characterization.

A hybrid scoring system for prioritization of software vulnerabilities

While security experts, firms, security providers, threat analysts all around the globe are working hard to provide ironclad security for information system softwares, vulnerabilities in softwares are still being detected on a daily basis. Although it is very important to neutralize all these vulnerabilities as quickly as possible, prioritization of vulnerabilities to determine the order for resolving these vulnerabilities is an equally important step for optimization of the remediation process. Among different available techniques for prioritization of vulnerabilities, scoring the vulnerabilities is the most common practice. In this paper, we have proposed a novel hybrid technique, VIEWSS: Variable Impact-Exploitability Weightage Scoring System, which scores vulnerabilities by varying the Impact-Exploitability score ratio towards calculation of base scores. We have also discussed three popular quantitative vulnerability scoring techniques; CVSS (Common Vulnerability Scoring System), VRSS (Vulnerability Rating and Scoring System) and WIVSS (Weighted Impact Vulnerability Scoring System) by explaining the underlying metrics, scoring systems, formulas and some limitations of these techniques. The proposed technique, VIEWSS is also compared with the discussed techniques by generating scores for around 83,500 vulnerabilities reported on NVD (National Vulnerability Database) in the last five years. It is observed that our proposed technique generates the greatest number of distinct scores and also the score distribution of our technique performs well on different parameters including skewness and kurtosis. Further when these techniques were applied on a dataset containing around 12,200 ‘high-risk’ vulnerabilities extracted by cross-referencing NVD and Exploit-DB, our proposed technique outperformed all the discussed techniques in terms of identifying the threat accurately.

Attack Path Detection for IIoT Enabled Cyber Physical Systems: Revisited

In this paper, we propose a generic vulnerability and risk assessment method for IIoT-enabled critical systems. We focus on reducing risk factors and vulnerable structures in order to provide security issues for the IIoT and enabled complex systems. In addition to the existing risk assessment and related methods, we represent the IIoT-enabled network topology as a directed graph, and we develop an attack tree-based approach using graph theory. We assume that each device is a potential critical node due to the existing vulnerabilities, which are defined in the National Vulnerability Database (NVD), and we establish directed relations between nodes, considering cyber and physical interactions. We improve existing attack path-identifying methods using the Depth First Search (DFS) algorithm to find all the paths from the source to the target nodes. In the generated topology, each node has the pre-assigned Common Vulnerability Scoring System (CVSS) scores acting as a weight. We also implement the Floyd-Warshall algorithm to identify path risk levels. Finally, we assess the identified vulnerable paths from varying source and target pairs via path and node-reducing procedures, considering risk thresholds. We perform our simulation on a custom Python simulator, considering the transportation and supply sectors. We compare our results with the previous ones. Simulation results show that our proposed methods and procedures outperform existing risk assessment and filtering methods in terms of running time and attack path identification and filtering.

The Secret Life of Software Vulnerabilities: A Large-Scale Empirical Study

Software vulnerabilities are weaknesses in source code that can be potentially exploited to cause loss or harm. While researchers have been devising a number of methods to deal with vulnerabilities, there is still a noticeable lack of knowledge on their software engineering life cycle, for example how vulnerabilities are introduced and removed by developers. This information can be exploited to design more effective methods for vulnerability prevention and detection, as well as to understand the granularity at which these methods should aim. To investigate the life cycle of known software vulnerabilities, we focus on how, when, and under which circumstances the contributions to the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">introduction</i> of vulnerabilities in software projects are made, as well as how long, and how they are <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">removed</i> . We consider 3,663 vulnerabilities with public patches from the National Vulnerability Database—pertaining to 1,096 open-source software projects on <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">GitHub</small> —and define an eight-step process involving both automated parts (e.g., using a procedure based on the SZZ algorithm to find the vulnerability-contributing commits) and manual analyses (e.g., how vulnerabilities were fixed). The investigated vulnerabilities can be classified in 144 categories, take on average at least 4 contributing commits before being introduced, and half of them remain unfixed for at least more than one year. Most of the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">contributions</i> are done by developers with high workload, often when doing maintenance activities, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">removed</i> mostly with the addition of new source code aiming at implementing further checks on inputs. We conclude by distilling practical implications on how vulnerability detectors should work to assist developers in timely identifying these issues.