Vulnerability Proof-of-Concepts in Software Supply Chain: Real-World Usage Scenarios from the Perspective of Migration
The security community widely uses software composition analysis (SCA) to identify vulnerabilities introduced by third-party libraries (TPLs) in the software supply chain. However, static analysis produces many false positives, so a Proof-of-Concept (PoC) is needed to confirm that a vulnerability is exploitable. Existi...