Automated Vulnerability Check in Continuous Integration

Context Using components with known vulnerabilities is still one of the most frequent causes for security incidents today [5]. It is of the essence, therefore, to possess a comprehensive overview of the software components utilized by the software, in order to mitigate the vulnerabilities they may withold prior to releasing the software. On the one hand, tools like Maven provide a reliable overview of the used components and libraries. On the other hand, entities like NIST through its National Vulnerability Database (NVD) provide the required information about existing security vulnerabilities. By augmenting the two breeds of tools/repositories we can address the problem at hand via highlighting the vulnerable components used by the software.