G.Name of the file

H.The programming language used in the file

1.3.Take a screenshot and underline (in red color)the code lines within the source code files you have identified that contain the vulnerabilities you found.There will be a total of 6 screenshots.For each of  the screenshot,explain(within  100 words for each vulnerability)how the vulnerable lines correlate to the definition or causes of the vulnerability(e.g.,SQL injection)and how this vulnerable code can be exploited  by  the  attacker.(3%)

1.4.Explain(within  100 words for each vulnerability)that  how each of the vulnerability can be fixed. (1%)

Part  2-Exploring  and understanding vulnerability resources.

2.1.Visit the website  and  study  about  Common  Vulnerabilities  and  Exposures(CVE),National

Vulnerability  Database(NVD),Common  Weakness  Enumeration  (CWE),Common  Vulnerability

Scoring System(CVSS).This  part  helps you to  gain  background  about the security vulnerabilities.You do not have to submit this part.

2.2.Install and learn how to use Git commands(e.g.,git  log,git  show,git diff).You  DO  NOT  have  to submit this part.

2.3.Register a GitHub account or reuse your existing one.

2.4.Determine the CWE(type)of each vulnerability.Include the CWE you  have found  in the  report. (1%)

2.5.Study about the process of how to go from CVE-ID to the corresponding GitHub repository for assigned vulnerability.Describe step-by-step in the report how you have found to go from vulnerability to  its  software  repository.(200-300  words)(2%)
2.6.Identify  and  describe the bug report in the  issue  tracking  system(e.g.,Jira,BugZilla,GitHub repository  itself)that  reports about the fix of the vulnerability.Include the screenshot,link,the fixing commit and your comments about the status of the vulnerability in the report.(3%)
2.7.Compare the fixing commits you have identified for the vulnerability with the ones provided for you in the link above.If they are not matched,you have to explain (in up to 300 words)in the report.Also    put the results in the following table.(1%)

2.8.Imagine you are a developer responsible for a vulnerable project and you have found your vulnerability.And you are going to report the vulnerability to NVD to include in their database,you may need to suggest to them an assessment of each vulnerability based on CVSS 2.0(commonly used version)and  CVSS  3.0(new version).Include your CVSS  (versions  2  and  3.0)metrics for each vulnerability with detailed explanation.Then,compute the base scores of CVSS versions 2 and 3.0 and compare them with the ones provided on NVD.Make sure you compute the scores using your reasoning first without looking at NVD.If there is no available score on NVD,then you can skip the  comparison  step.Record these in the  above  table.(1%)

Submission:A PDF document with Times New Roman of font size 12.

Tips about how I would go about doing this assignment:

Part  1

I will first study the vulnerabilities mentioned in the task on the Common Weakness Enumeration website.Google is also always worth a try if l want to explore more.Then,I will try to use the name of the vulnerability and search it on GitHub.After l find the repositories,I will filter them using the above  criteria.Then,I will focus on the vulnerable files and analyze them line-by-line or use existing tools.If  there is already a fix for that vulnerability,I will include it in my report.Otherwise,I will try to see howl  can fix it using the mitigation techniques I have learned for the vulnerability.I will explain how my findings match with the materials I have learned for that vulnerability.

Part  2

I would first study about CVE,NVD,CWE and GitHub to see how they link with each other.Afterl understand their connection,I can  identify  CWE  and  describe the  process for the vulnerability.Then,I  can start searching for bug reports in the suggested locations above.If you cannot find it there,Google is always worth a try.After l found the bug report,I would try to find whether the developers/testers mention the link they fixed that vulnerability.That would likely be my fixing commit.Finally,I would compare the one l have found with the provided one.If it does not match,then I try to investigate the provided commit to see how it is related to the vulnerability I am working on and also to my identified commit.To do this investigation step,cloning the GitHub repositories locally is a good way to go.I will use my experience and reasoning to fill in the value for each metric and then compute the score using the CVSS calculator.I will then compare my scores with the ones on NVD if they are available and give my detailed reflections.Then,I will describe and explain in detail each task for each vulnerability in the report.