{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,23]],"date-time":"2026-04-23T00:21:45Z","timestamp":1776903705722,"version":"3.51.2"},"reference-count":56,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2014,3,1]],"date-time":"2014-03-01T00:00:00Z","timestamp":1393632000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2014,3]]},"DOI":"10.1109\/tdsc.2013.37","type":"journal-article","created":{"date-parts":[[2013,9,6]],"date-time":"2013-09-06T18:04:10Z","timestamp":1378490650000},"page":"89-100","source":"Crossref","is-referenced-by-count":34,"title":["Analysis of Field Data on Web Security Vulnerabilities"],"prefix":"10.1109","volume":"11","author":[{"given":"Jose","family":"Fonseca","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nuno","family":"Seixas","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Marco","family":"Vieira","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Henrique","family":"Madeira","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Is Your Website Hackable? Do a Web Security Audit with Acunetix Web Vulnerability Scanner","year":"2013"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(03)00512-1"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2009.25"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2004.2"},{"key":"ref5","article-title":"Homepage","volume-title":"US-CERT Vulnerability Notes Database","year":"2013"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/32.177364"},{"key":"ref7","article-title":"Unforgivable Vulnerabilities","volume-title":"Proc. Black Hat Briefings","author":"Christey"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/FTCS.1996.534615"},{"key":"ref9","article-title":"A Study in Scarlet, Exploiting Common Vulnerabilities in PHP Applications","author":"Clowes","year":"2013"},{"key":"ref10","article-title":"C# Coding Standards and Best Practices","author":"Manjaly","year":"2013"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.4324\/9780203771587"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2006.9"},{"key":"ref13","article-title":"Conceptual Model and Architecture of MAFTIA","author":"Adelsbach","year":"2003"},{"key":"ref14","article-title":"C# Coding Standards and Best Programming Practices","volume-title":"Dotnet Spider","year":"2013"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2006.113"},{"key":"ref16","volume-title":"XSS Attacks: Cross Site Scripting Exploits and Defense","author":"Fogie","year":"2007"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/PRDC.2008.43"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2009.5270349"},{"key":"ref19","article-title":"Symantec Internet Security Threat Report: Trends for 2010","volume-title":"Symantec Enterprise Security","author":"Fossi","year":"2011"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/RE.2005.43"},{"key":"ref21","article-title":"A Classification of SQL Injection Attacks and Countermeasures","volume-title":"Proc. Black Hat Briefings","author":"Halfond"},{"issue":"8","key":"ref22","first-page":"104","article-title":"The Chimera of Software Quality","volume":"40","author":"Hatton","year":"2007","journal-title":"IEEE Software"},{"key":"ref23","article-title":"19 Deadly Sins of Software Security: Programming Flaws and How to Fix Them","author":"Howard","year":"2005"},{"key":"ref24","article-title":"IBM Internet Security Systems X-Force\u00ae 2010 Trend & Risk Report","year":"2011"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/1134744.1134751"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2012.6227211"},{"key":"ref27","first-page":"18","article-title":"Finding Security Vulnerabilities in Java Applications with Static Analysis","volume-title":"Proc. USENIX Security Symp.","author":"Livshits"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.21236\/ADA443139"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1147\/sj.291.0004"},{"key":"ref30","volume-title":"The Art of Deception: Controlling the Human Element of Security","author":"Mitnick","year":"2002"},{"key":"ref31","article-title":"Vulnerability Type Distributions in CVE","author":"Christey","year":"2007"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2004.30"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2010.53"},{"key":"ref34","article-title":"Tests Show Rise in Number of Vulnerabilities Affecting Web Applications with SQL Injection and XSS Most Common Flaws","volume-title":"NTA","year":"2013"},{"key":"ref35","article-title":"Open Sourced Vulnerability Database","volume-title":"OSVDB","year":"2013"},{"key":"ref36","article-title":"OWASP Top 10","volume-title":"OWASP Foundation","year":"2010"},{"key":"ref37","article-title":"Vulnerability Discovery & Software Security","author":"Ozment","year":"2007"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.4324\/9781003117445"},{"key":"ref39","article-title":"Homepage","year":"2013"},{"key":"ref40","article-title":"Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, version 1.2","volume-title":"PCI Security Standards Council","year":"2008"},{"key":"ref41","article-title":"Homepage","volume-title":"PHP-Nuke","year":"2007"},{"key":"ref42","article-title":"Description of Core php.ini Directives","volume-title":"The PHP Group","year":"2013"},{"key":"ref43","article-title":"Chronology of Data Breaches: Security Breaches 2005-Present","volume-title":"The Privacy Rights Clearinghouse","year":"2013"},{"key":"ref44","first-page":"283","article-title":"Static Enforcement of Web Application Integrity through Strong Typing","volume-title":"Proc. 18th Conf. USENIX Security Symp. (USENIX \u201909)","author":"Robertson"},{"key":"ref45","article-title":"Top 25 Most Dangerous Programming Errors","volume-title":"SANS Inst.","year":"2013"},{"key":"ref46","first-page":"1419","article-title":"An Empirical Analysis of Input Validation Mechanisms","volume-title":"Proc. ACM Symp. Applied Computing","author":"Scholte"},{"key":"ref47","article-title":"Homepage","volume-title":"Secunia","year":"2013"},{"key":"ref48","article-title":"2007 Community Choice Awards","volume-title":"Sourceforge","year":"2013"},{"key":"ref49","volume-title":"The Web Application Hackers Handbook: Discovering and Exploiting Security Flaws","author":"Stuttard","year":"2007"},{"key":"ref50","article-title":"Symantec Report on the Underground Economy","volume-title":"Symantec","year":"2008"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ROBOT.2004.1308784"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/11506881_8"},{"key":"ref53","article-title":"2011 Data Breach Investigations Report","volume-title":"Verizon","year":"2011"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2009.5314215"},{"key":"ref55","article-title":"WhiteHat Website Security Statistics Report, ninth ed.","volume-title":"WhiteHat Security Inc.","year":"2010"},{"key":"ref56","article-title":"Automatic Detection of Web Application Security Flaws","volume-title":"Proc. IEEE Int\u2019l Symp. Secure Software Eng.","author":"Zanero"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/6785951\/06589556.pdf?arnumber=6589556","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,19]],"date-time":"2025-03-19T06:03:19Z","timestamp":1742364199000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6589556\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,3]]},"references-count":56,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2013.37","relation":{},"ISSN":["1545-5971"],"issn-type":[{"value":"1545-5971","type":"print"}],"subject":[],"published":{"date-parts":[[2014,3]]}}}