Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 3.1.2Report Generated On : Nov 27, 2018 at 14:49:51 +00:00Dependencies Scanned : 29 (20 unique)Vulnerable Dependencies : 4 Vulnerabilities Found : 13Vulnerabilities Suppressed : 0...
NVD CVE 2002 : 27/11/2018 09:08:21NVD CVE 2003 : 22/11/2018 09:07:02NVD CVE 2004 : 27/11/2018 09:05:51NVD CVE 2005 : 27/11/2018 09:04:33NVD CVE 2006 : 27/11/2018 14:17:24NVD CVE 2007 : 27/11/2018 14:17:29NVD CVE 2008 : 27/11/2018 08:55:49NVD CVE 2009 : 27/11/2018 14:17:25NVD CVE 2010 : 27/11/2018 08:49:00NVD CVE 2011 : 27/11/2018 14:17:25NVD CVE 2012 : 27/11/2018 08:39:42NVD CVE 2013 : 27/11/2018 08:36:24NVD CVE 2014 : 27/11/2018 08:32:59NVD CVE 2015 : 27/11/2018 08:28:55NVD CVE 2016 : 27/11/2018 08:24:50NVD CVE 2017 : 27/11/2018 14:17:24NVD CVE 2018 : 27/11/2018 14:17:28NVD CVE Checked : 27/11/2018 14:45:55NVD CVE Modified : 27/11/2018 13:01:45VersionCheckOn : 1543329955984
Display:
Showing Vulnerable Dependencies (click to show all)
Dependencies
Description: The javax.inject API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/travis/.m2/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom groupid javax.inject Highest Vendor file name javax.inject-1 High Vendor pom artifactid javax.inject Low Vendor jar package name inject Low Vendor pom name javax.inject High Vendor pom url http://code.google.com/p/atinject/ Highest Vendor pom description The javax.inject API Medium Vendor jar package name javax Low Vendor central groupid javax.inject Highest Product file name javax.inject-1 High Product jar package name inject Low Product pom name javax.inject High Product central artifactid javax.inject Highest Product pom artifactid javax.inject Highest Product pom description The javax.inject API Medium Product pom groupid javax.inject Low Product pom url http://code.google.com/p/atinject/ Medium Version file version 1 Medium Version pom version 1 Highest Version central version 1 Highest
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom groupid commons-lang Highest Vendor pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor central groupid commons-lang Highest Vendor pom parent-artifactid commons-parent Low Vendor pom name Commons Lang High Vendor manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest bundle-docurl http://commons.apache.org/lang/ Low Vendor pom url http://commons.apache.org/lang/ Highest Vendor file name commons-lang High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest bundle-symbolicname org.apache.commons.lang Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor pom artifactid commons-lang Low Product pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Product pom url http://commons.apache.org/lang/ Medium Product pom name Commons Lang High Product pom parent-groupid org.apache.commons Low Product Manifest Implementation-Title Commons Lang High Product manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Product Manifest bundle-docurl http://commons.apache.org/lang/ Low Product file name commons-lang High Product central artifactid commons-lang Highest Product Manifest bundle-symbolicname org.apache.commons.lang Medium Product pom parent-artifactid commons-parent Medium Product Manifest Bundle-Name Commons Lang Medium Product pom groupid commons-lang Low Product pom artifactid commons-lang Highest Product Manifest specification-title Commons Lang Medium Version file version 2.6 Highest Version Manifest Implementation-Version 2.6 High Version pom version 2.6 Highest Version central version 2.6 Highest
Description: Types that extend and augment the Java Collections Framework.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor file name commons-collections High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest bundle-symbolicname org.apache.commons.collections Medium Vendor pom parent-artifactid commons-parent Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low Vendor Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low Vendor pom description Types that extend and augment the Java Collections Framework. Medium Vendor pom url http://commons.apache.org/collections/ Highest Vendor pom parent-groupid org.apache.commons Medium Vendor pom groupid commons-collections Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor central groupid commons-collections Highest Vendor Manifest implementation-url http://commons.apache.org/collections/ Low Vendor pom name Apache Commons Collections High Vendor Manifest bundle-docurl http://commons.apache.org/collections/ Low Vendor pom artifactid commons-collections Low Vendor manifest Bundle-Description Types that extend and augment the Java Collections Framework. Medium Product file name commons-collections High Product Manifest specification-title Apache Commons Collections Medium Product Manifest bundle-symbolicname org.apache.commons.collections Medium Product pom url http://commons.apache.org/collections/ Medium Product pom artifactid commons-collections Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low Product pom parent-groupid org.apache.commons Low Product Manifest Bundle-Name Apache Commons Collections Medium Product Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low Product pom description Types that extend and augment the Java Collections Framework. Medium Product Manifest Implementation-Title Apache Commons Collections High Product pom parent-artifactid commons-parent Medium Product Manifest implementation-url http://commons.apache.org/collections/ Low Product pom groupid commons-collections Low Product pom name Apache Commons Collections High Product Manifest bundle-docurl http://commons.apache.org/collections/ Low Product central artifactid commons-collections Highest Product manifest Bundle-Description Types that extend and augment the Java Collections Framework. Medium Version central version 3.2.2 Highest Version Manifest Implementation-Version 3.2.2 High Version pom version 3.2.2 Highest Version file version 3.2.2 Highest
Description:
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/commons-fileupload/commons-fileupload/1.3.2/commons-fileupload-1.3.2.jar
MD5: f76891c36a08e87e3f806d3a83fcb4bc
SHA1: 5d7491ed6ebd02b6a8d2305f8e6b7fe5dbd95f72
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor file name commons-fileupload High Vendor pom artifactid commons-fileupload Low Vendor pom parent-artifactid commons-parent Low Vendor Manifest bundle-symbolicname org.apache.commons.fileupload Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest implementation-build tags/FILEUPLOAD_1_3_2_RC1@r1745203; 2016-05-23 14:47:52+0000 Low Vendor pom name Apache Commons FileUpload High Vendor pom url http://commons.apache.org/proper/commons-fileupload/ Highest Vendor pom groupid commons-fileupload Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor central groupid commons-fileupload Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-fileupload/ Low Vendor Manifest implementation-url http://commons.apache.org/proper/commons-fileupload/ Low Vendor manifest Bundle-Description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Vendor pom description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Product central artifactid commons-fileupload Highest Product file name commons-fileupload High Product Manifest specification-title Apache Commons FileUpload Medium Product Manifest bundle-symbolicname org.apache.commons.fileupload Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product pom artifactid commons-fileupload Highest Product pom parent-groupid org.apache.commons Low Product pom groupid commons-fileupload Low Product Manifest implementation-build tags/FILEUPLOAD_1_3_2_RC1@r1745203; 2016-05-23 14:47:52+0000 Low Product pom name Apache Commons FileUpload High Product Manifest Bundle-Name Apache Commons FileUpload Medium Product pom parent-artifactid commons-parent Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-fileupload/ Low Product Manifest implementation-url http://commons.apache.org/proper/commons-fileupload/ Low Product pom url http://commons.apache.org/proper/commons-fileupload/ Medium Product Manifest Implementation-Title Apache Commons FileUpload High Product manifest Bundle-Description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Product pom description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Version file version 1.3.2 Highest Version Manifest Implementation-Version 1.3.2 High Version pom version 1.3.2 Highest Version central version 1.3.2 Highest
Published Vulnerabilities
CVE-2016-1000031 suppress
Severity:
High
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Vulnerable Software & Versions:
Description:
The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/commons-io/commons-io/2.5/commons-io-2.5.jar
MD5: e2d74794fba570ec2115fb9d5b05dc9b
SHA1: 2852e6e05fbb95076fc091f6d1780f1f8fe35e0f
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-io/ Low Vendor pom url http://commons.apache.org/proper/commons-io/ Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest bundle-symbolicname org.apache.commons.io Medium Vendor pom description
The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Vendor pom parent-artifactid commons-parent Low Vendor file name commons-io High Vendor Manifest implementation-url http://commons.apache.org/proper/commons-io/ Low Vendor pom groupid commons-io Highest Vendor pom parent-groupid org.apache.commons Medium Vendor manifest Bundle-Description The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Vendor Manifest implementation-build tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid commons-io Low Vendor central groupid commons-io Highest Vendor pom name Apache Commons IO High Product pom groupid commons-io Low Product Manifest specification-title Apache Commons IO Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-io/ Low Product pom artifactid commons-io Highest Product Manifest bundle-symbolicname org.apache.commons.io Medium Product pom description
The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Product Manifest Bundle-Name Apache Commons IO Medium Product pom url http://commons.apache.org/proper/commons-io/ Medium Product file name commons-io High Product Manifest implementation-url http://commons.apache.org/proper/commons-io/ Low Product pom parent-groupid org.apache.commons Low Product Manifest Implementation-Title Apache Commons IO High Product manifest Bundle-Description The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Product Manifest implementation-build tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400 Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom parent-artifactid commons-parent Medium Product pom name Apache Commons IO High Product central artifactid commons-io Highest Version Manifest Implementation-Version 2.5 High Version file version 2.5 Highest Version pom version 2.5 Highest Version central version 2.5 Highest
Description: Apache Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
MD5: 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1: 4bfc12adfe4842bf07b657f0369c4cb522955686
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom groupid commons-logging Highest Vendor pom parent-artifactid commons-parent Low Vendor pom description Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems. Low Vendor pom parent-groupid org.apache.commons Medium Vendor central groupid commons-logging Highest Vendor Manifest implementation-build tags/LOGGING_1_2_RC2@r1608092; 2014-07-05 20:11:44+0200 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Vendor pom url http://commons.apache.org/proper/commons-logging/ Highest Vendor Manifest bundle-symbolicname org.apache.commons.logging Medium Vendor manifest Bundle-Description Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems. Low Vendor pom name Apache Commons Logging High Vendor pom artifactid commons-logging Low Vendor file name commons-logging High Product Manifest specification-title Apache Commons Logging Medium Product pom description Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems. Low Product Manifest Bundle-Name Apache Commons Logging Medium Product pom parent-groupid org.apache.commons Low Product Manifest Implementation-Title Apache Commons Logging High Product pom groupid commons-logging Low Product pom artifactid commons-logging Highest Product Manifest implementation-build tags/LOGGING_1_2_RC2@r1608092; 2014-07-05 20:11:44+0200 Low Product Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Product pom parent-artifactid commons-parent Medium Product central artifactid commons-logging Highest Product Manifest bundle-symbolicname org.apache.commons.logging Medium Product manifest Bundle-Description Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems. Low Product pom name Apache Commons Logging High Product pom url http://commons.apache.org/proper/commons-logging/ Medium Product file name commons-logging High Version central version 1.2 Highest Version file version 1.2 Highest Version pom version 1.2 Highest Version Manifest Implementation-Version 1.2 High
Description: Spring Core
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/travis/.m2/repository/org/springframework/spring-core/4.3.12.RELEASE/spring-core-4.3.12.RELEASE.jar
MD5: 01ab7f742861c65f7339acba6333326c
SHA1: 4cebc69478c6d350dbd5af28e3db7d5694f416e3
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom artifactid spring-core Low Vendor file name spring-core High Vendor hint analyzer vendor vmware High Vendor pom name Spring Core High Vendor hint analyzer vendor pivotal software High Vendor pom organization url http://projects.spring.io/spring-framework Medium Vendor hint analyzer vendor pivotal software Highest Vendor pom url spring-projects/spring-framework Highest Vendor pom organization name Spring IO High Vendor pom groupid org.springframework Highest Vendor hint analyzer vendor SpringSource High Vendor central groupid org.springframework Highest Vendor pom description Spring Core Medium Vendor pom groupid springframework Highest Product Manifest Implementation-Title spring-core High Product pom groupid springframework Low Product file name spring-core High Product pom organization url http://projects.spring.io/spring-framework Low Product pom name Spring Core High Product pom organization name Spring IO Low Product pom artifactid spring-core Highest Product pom description Spring Core Medium Product central artifactid spring-core Highest Product pom url spring-projects/spring-framework High Product hint analyzer product springsource_spring_framework High Version pom version 4.3.12.RELEASE Highest Version central version 4.3.12.RELEASE Highest Version Manifest Implementation-Version 4.3.12.RELEASE High
Related Dependencies
spring-beans-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-beans/4.3.12.RELEASE/spring-beans-4.3.12.RELEASE.jar
SHA1: 0547dd432d47d0f01d9ccbedc4b705f9f7c1240a
MD5: 016d6b84ad5520b96b0d73ced6b729be
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
maven: org.springframework:spring-beans:4.3.12.RELEASE ✓
spring-web-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-web/4.3.12.RELEASE/spring-web-4.3.12.RELEASE.jar
SHA1: 86c29588cca74d0fc848b194cb13fcdfd12bc990
MD5: 7564e45fbffa0c682cc1575f98c04bd0
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
maven: org.springframework:spring-web:4.3.12.RELEASE ✓
spring-context-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-context/4.3.12.RELEASE/spring-context-4.3.12.RELEASE.jar
SHA1: 5e6d26f36636f36b7efec1d6a0c5991284fbd95b
MD5: e403d653908491418191f2c12c77a6b6
maven: org.springframework:spring-context:4.3.12.RELEASE ✓
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
spring-expression-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-expression/4.3.12.RELEASE/spring-expression-4.3.12.RELEASE.jar
SHA1: 790f69f6ad7f9da8d4a92c603ad7244c398c8309
MD5: 406bc89c8e55275190cc04e65fabc05d
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
maven: org.springframework:spring-expression:4.3.12.RELEASE ✓
spring-context-support-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-context-support/4.3.12.RELEASE/spring-context-support-4.3.12.RELEASE.jar
SHA1: 6f3a71b93b69f38ac545b6043fab7e474addee15
MD5: f5de29c45e3c0b4138ecb5eaeab4c966
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
maven: org.springframework:spring-context-support:4.3.12.RELEASE ✓
spring-aop-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-aop/4.3.12.RELEASE/spring-aop-4.3.12.RELEASE.jar
SHA1: b3fef085902993c2ef874c45c7bfd79296d5a5a4
MD5: 43f27fd377b41bd4c1d59fb17bdc3a4d
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
maven: org.springframework:spring-aop:4.3.12.RELEASE ✓
spring-webmvc-4.3.12.RELEASE.jar
File Path: /home/travis/.m2/repository/org/springframework/spring-webmvc/4.3.12.RELEASE/spring-webmvc-4.3.12.RELEASE.jar
SHA1: 986e5dcd4435e780f6be64f8185eaa51523cf851
MD5: 71149ce3d60b8bf7bcd3ed5789d27040
cpe: cpe:/a:pivotal_software:spring_framework:4.3.12
maven: org.springframework:spring-webmvc:4.3.12.RELEASE ✓
Published Vulnerabilities
CVE-2018-11039 suppress
Severity:
Medium
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Vulnerable Software & Versions: (show all )
CVE-2018-11040 suppress
Severity:
Medium
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Vulnerable Software & Versions: (show all )
CVE-2018-1199 suppress
Severity:
Medium
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Vulnerable Software & Versions: (show all )
CVE-2018-1257 suppress
Severity:
Medium
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Vulnerable Software & Versions: (show all )
CVE-2018-1270 suppress
Severity:
High
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Vulnerable Software & Versions: (show all )
CVE-2018-1271 suppress
Severity:
Medium
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerable Software & Versions: (show all )
CVE-2018-1272 suppress
Severity:
Medium
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Vulnerable Software & Versions: (show all )
CVE-2018-1275 suppress
Severity:
High
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
Vulnerable Software & Versions: (show all )
Description: The slf4j API
File Path: /home/travis/.m2/repository/org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jarMD5: c9be56284a92dcb2576679282eff80bfSHA1: 139535a69a4239db087de9bab0bee568bf8e0b70
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom groupid slf4j Highest Vendor pom artifactid slf4j-api Low Vendor manifest Bundle-Description The slf4j API Medium Vendor pom parent-groupid org.slf4j Medium Vendor Manifest bundle-symbolicname slf4j.api Medium Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor pom groupid org.slf4j Highest Vendor pom url http://www.slf4j.org Highest Vendor file name slf4j-api High Vendor pom name SLF4J API Module High Vendor central groupid org.slf4j Highest Vendor pom parent-artifactid slf4j-parent Low Vendor pom description The slf4j API Medium Product Manifest Implementation-Title slf4j-api High Product pom url http://www.slf4j.org Medium Product pom parent-groupid org.slf4j Low Product manifest Bundle-Description The slf4j API Medium Product Manifest bundle-symbolicname slf4j.api Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product central artifactid slf4j-api Highest Product pom artifactid slf4j-api Highest Product file name slf4j-api High Product pom groupid slf4j Low Product pom parent-artifactid slf4j-parent Medium Product pom name SLF4J API Module High Product Manifest Bundle-Name slf4j-api Medium Product pom description The slf4j API Medium Version pom version 1.7.21 Highest Version Manifest Implementation-Version 1.7.21 High Version file version 1.7.21 Highest Version central version 1.7.21 Highest
Description: Java(TM) Servlet 3.1 API Design Specification
License:
CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: /home/travis/.m2/repository/javax/servlet/javax.servlet-api/3.1.0/javax.servlet-api-3.1.0.jar
MD5: 79de69e9f5ed8c7fcb8342585732bbf7
SHA1: 3cd63d075497751784b2fa84be59432f4905bf7c
Referenced In Project/Scope:
spring-i18n-support-web:provided
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid jvnet-parent Low Vendor pom name Java Servlet API High Vendor pom parent-groupid net.java Medium Vendor manifest Bundle-Description Java(TM) Servlet 3.1 API Design Specification Medium Vendor file name javax.servlet-api High Vendor Manifest Implementation-Vendor-Id org.glassfish Medium Vendor pom url http://servlet-spec.java.net Highest Vendor pom artifactid javax.servlet-api Low Vendor Manifest bundle-symbolicname javax.servlet-api Medium Vendor Manifest bundle-docurl https://glassfish.dev.java.net Low Vendor pom organization name GlassFish Community High Vendor Manifest specification-vendor Oracle Corporation Low Vendor Manifest Implementation-Vendor GlassFish Community High Vendor Manifest extension-name javax.servlet Medium Vendor pom organization url https://glassfish.dev.java.net Medium Vendor pom groupid javax.servlet Highest Vendor central groupid javax.servlet Highest Product pom artifactid javax.servlet-api Highest Product pom organization url https://glassfish.dev.java.net Low Product pom name Java Servlet API High Product Manifest Bundle-Name Java Servlet API Medium Product central artifactid javax.servlet-api Highest Product manifest Bundle-Description Java(TM) Servlet 3.1 API Design Specification Medium Product file name javax.servlet-api High Product pom url http://servlet-spec.java.net Medium Product Manifest bundle-symbolicname javax.servlet-api Medium Product Manifest bundle-docurl https://glassfish.dev.java.net Low Product pom parent-artifactid jvnet-parent Medium Product pom groupid javax.servlet Low Product Manifest extension-name javax.servlet Medium Product pom organization name GlassFish Community Low Product pom parent-groupid net.java Low Version central version 3.1.0 Highest Version Manifest Implementation-Version 3.1.0 High Version file version 3.1.0 Highest Version pom version 3.1.0 Highest
File Path: /home/travis/.m2/repository/javax/servlet/jsp/jsp-api/2.2/jsp-api-2.2.jarMD5: dd575c153ec55c650d2a66aefc5ba9d3SHA1: 5bf0c26ef77df58c7c28be2d9d52246f2b437a54
Referenced In Project/Scope:
spring-i18n-support-web:provided
Evidence
Type Source Name Value Confidence Vendor pom artifactid jsp-api Low Vendor pom parent-artifactid jsp Low Vendor pom name JavaServer Pages(TM) API High Vendor file name jsp-api High Vendor pom parent-groupid org.glassfish.web Medium Vendor central groupid javax.servlet.jsp Highest Vendor jar package name javax Low Vendor jar package name jsp Low Vendor jar package name servlet Low Vendor pom groupid javax.servlet.jsp Highest Product pom groupid javax.servlet.jsp Low Product pom parent-artifactid jsp Medium Product pom name JavaServer Pages(TM) API High Product pom artifactid jsp-api Highest Product file name jsp-api High Product pom parent-groupid org.glassfish.web Low Product central artifactid jsp-api Highest Product jar package name jsp Low Product jar package name servlet Low Version central version 2.2 Highest Version pom version 2.2 Highest Version file version 2.2 Highest
File Path: /home/travis/.m2/repository/javax/servlet/jstl/1.2/jstl-1.2.jarMD5: 51e15f798e69358cb893e38c50596b9bSHA1: 74aca283cd4f4b4f3e425f5820cda58f44409547
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor central groupid jstl High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor central groupid javax.servlet High Vendor pom artifactid jstl Low Vendor pom groupid javax.servlet Highest Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High Vendor file name jstl High Vendor Manifest extension-name javax.servlet.jsp.jstl Medium Product pom groupid javax.servlet Low Product pom artifactid jstl Highest Product file name jstl High Product Manifest extension-name javax.servlet.jsp.jstl Medium Product central artifactid jstl High Product Manifest specification-title JavaServer Pages(TM) Standard Tag Library Medium Version central version 1.2 High Version file version 1.2 Highest Version pom version 1.2 Highest Version Manifest Implementation-Version 1.2 High
Description: Core Jackson abstractions, basic JSON streaming API implementation
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.8.10/jackson-core-2.8.10.jar
MD5: de528504165730b13b66f461a85b341e
SHA1: eb21a035c66ad307e66ec8fce37f5d50fd62d039
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom artifactid jackson-core Low Vendor Manifest specification-vendor FasterXML Low Vendor pom url FasterXML/jackson-core Highest Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor manifest Bundle-Description Core Jackson abstractions, basic JSON streaming API implementation Medium Vendor central groupid com.fasterxml.jackson.core Highest Vendor Manifest implementation-build-date 2017-08-24 04:24:19+0000 Low Vendor Manifest bundle-docurl https://github.com/FasterXML/jackson-core Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor file name jackson-core High Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium Vendor pom parent-artifactid jackson-parent Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom description Core Jackson abstractions, basic JSON streaming API implementation Medium Vendor pom name Jackson-core High Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom groupid fasterxml.jackson.core Highest Vendor Manifest Implementation-Vendor FasterXML High Product Manifest specification-title Jackson-core Medium Product central artifactid jackson-core Highest Product manifest Bundle-Description Core Jackson abstractions, basic JSON streaming API implementation Medium Product Manifest Bundle-Name Jackson-core Medium Product Manifest implementation-build-date 2017-08-24 04:24:19+0000 Low Product pom groupid fasterxml.jackson.core Low Product pom parent-artifactid jackson-parent Medium Product Manifest bundle-docurl https://github.com/FasterXML/jackson-core Low Product file name jackson-core High Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium Product Manifest Implementation-Title Jackson-core High Product pom url FasterXML/jackson-core High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom description Core Jackson abstractions, basic JSON streaming API implementation Medium Product pom name Jackson-core High Product pom parent-groupid com.fasterxml.jackson Low Product pom artifactid jackson-core Highest Version Manifest Implementation-Version 2.8.10 High Version central version 2.8.10 Highest Version file version 2.8.10 Highest Version pom version 2.8.10 Highest
Description: Core annotations used for value types, used by Jackson data binding package.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.8.0/jackson-annotations-2.8.0.jar
MD5: 288e6537849f0c63e76409b515c4fbe4
SHA1: 45b426f7796b741035581a176744d91090e2e6fb
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor FasterXML Low Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor central groupid com.fasterxml.jackson.core Highest Vendor Manifest bundle-docurl http://github.com/FasterXML/jackson Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom parent-artifactid jackson-parent Low Vendor pom name Jackson-annotations High Vendor pom description Core annotations used for value types, used by Jackson data binding package.
Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom url http://github.com/FasterXML/jackson Highest Vendor pom artifactid jackson-annotations Low Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-annotations Medium Vendor manifest Bundle-Description Core annotations used for value types, used by Jackson data binding package. Medium Vendor pom groupid fasterxml.jackson.core Highest Vendor file name jackson-annotations High Vendor Manifest implementation-build-date 2016-07-04 05:20:32+0000 Low Vendor Manifest Implementation-Vendor FasterXML High Product Manifest Implementation-Title Jackson-annotations High Product Manifest bundle-docurl http://github.com/FasterXML/jackson Low Product pom groupid fasterxml.jackson.core Low Product pom parent-artifactid jackson-parent Medium Product pom artifactid jackson-annotations Highest Product pom name Jackson-annotations High Product pom description Core annotations used for value types, used by Jackson data binding package.
Medium Product pom url http://github.com/FasterXML/jackson Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest Bundle-Name Jackson-annotations Medium Product central artifactid jackson-annotations Highest Product Manifest specification-title Jackson-annotations Medium Product pom parent-groupid com.fasterxml.jackson Low Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-annotations Medium Product manifest Bundle-Description Core annotations used for value types, used by Jackson data binding package. Medium Product file name jackson-annotations High Product Manifest implementation-build-date 2016-07-04 05:20:32+0000 Low Version Manifest Implementation-Version 2.8.0 High Version pom version 2.8.0 Highest Version central version 2.8.0 Highest Version file version 2.8.0 Highest
Description: General data-binding functionality for Jackson: works on core streaming API
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.8.10/jackson-databind-2.8.10.jar
MD5: a3562f755da926bdae53d13c4f7687e9
SHA1: f7b83cb2bc4b88d53961e749e1ad32f49ef017b7
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium Vendor Manifest specification-vendor FasterXML Low Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor pom artifactid jackson-databind Low Vendor central groupid com.fasterxml.jackson.core Highest Vendor Manifest implementation-build-date 2017-08-24 04:27:15+0000 Low Vendor manifest Bundle-Description General data-binding functionality for Jackson: works on core streaming API Medium Vendor Manifest bundle-docurl http://github.com/FasterXML/jackson Low Vendor pom name jackson-databind High Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom parent-artifactid jackson-parent Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor pom url http://github.com/FasterXML/jackson Highest Vendor pom description General data-binding functionality for Jackson: works on core streaming API Medium Vendor file name jackson-databind High Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom groupid fasterxml.jackson.core Highest Vendor Manifest Implementation-Vendor FasterXML High Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium Product Manifest specification-title jackson-databind Medium Product Manifest implementation-build-date 2017-08-24 04:27:15+0000 Low Product manifest Bundle-Description General data-binding functionality for Jackson: works on core streaming API Medium Product central artifactid jackson-databind Highest Product Manifest bundle-docurl http://github.com/FasterXML/jackson Low Product pom groupid fasterxml.jackson.core Low Product pom parent-artifactid jackson-parent Medium Product pom name jackson-databind High Product pom artifactid jackson-databind Highest Product pom url http://github.com/FasterXML/jackson Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest Implementation-Title jackson-databind High Product pom description General data-binding functionality for Jackson: works on core streaming API Medium Product file name jackson-databind High Product pom parent-groupid com.fasterxml.jackson Low Product Manifest Bundle-Name jackson-databind Medium Version Manifest Implementation-Version 2.8.10 High Version central version 2.8.10 Highest Version file version 2.8.10 Highest Version pom version 2.8.10 Highest
Published Vulnerabilities
CVE-2017-17485 suppress
Severity:
High
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
CVE-2018-5968 suppress
Severity:
Medium
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Vulnerable Software & Versions: (show all )
CVE-2018-7489 suppress
Severity:
High
FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar
MD5: 353cf6a2bdba09595ccfa073b78c7fcb
SHA1: 4b95f4897fa13f2cd904aee711aeafc0c5295cd8
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor central groupid commons-codec Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Vendor pom parent-artifactid commons-parent Low Vendor pom groupid commons-codec Highest Vendor pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Vendor file name commons-codec High Vendor manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low Vendor Manifest bundle-symbolicname org.apache.commons.codec Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid commons-codec Low Vendor pom name Apache Commons Codec High Vendor pom url http://commons.apache.org/proper/commons-codec/ Highest Product pom artifactid commons-codec Highest Product pom url http://commons.apache.org/proper/commons-codec/ Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Product pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Product file name commons-codec High Product manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Product pom parent-groupid org.apache.commons Low Product Manifest specification-title Apache Commons Codec Medium Product Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low Product Manifest bundle-symbolicname org.apache.commons.codec Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest Bundle-Name Apache Commons Codec Medium Product pom parent-artifactid commons-parent Medium Product pom name Apache Commons Codec High Product central artifactid commons-codec Highest Product Manifest Implementation-Title Apache Commons Codec High Product pom groupid commons-codec Low Version pom version 1.10 Highest Version central version 1.10 Highest Version file version 1.10 Highest Version Manifest Implementation-Version 1.10 High
Description: The Apache Commons Collections package contains types that extend and augment the Java Collections Framework.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/travis/.m2/repository/org/apache/commons/commons-collections4/4.1/commons-collections4-4.1.jar
MD5: 45af6a8e5b51d5945de6c7411e290bd1
SHA1: a4cf4688fe1c7e3a63aa636cc96d013af537768e
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-symbolicname org.apache.commons.collections4 Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor manifest Bundle-Description The Apache Commons Collections package contains types that extend and augment the Java Collections Framework. Low Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest implementation-build tags/COLLECTIONS_4_1_RC2@r1716550; 2015-11-25 22:53:13+0100 Low Vendor central groupid org.apache.commons Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-collections/ Low Vendor pom groupid apache.commons Highest Vendor pom url http://commons.apache.org/proper/commons-collections/ Highest Vendor pom artifactid commons-collections4 Low Vendor pom description The Apache Commons Collections package contains types that extend and augment the Java Collections Framework. Low Vendor pom name Apache Commons Collections High Vendor file name commons-collections4 High Vendor pom groupid org.apache.commons Highest Product Manifest bundle-symbolicname org.apache.commons.collections4 Medium Product Manifest specification-title Apache Commons Collections Medium Product manifest Bundle-Description The Apache Commons Collections package contains types that extend and augment the Java Collections Framework. Low Product pom parent-groupid org.apache.commons Low Product pom artifactid commons-collections4 Highest Product Manifest Bundle-Name Apache Commons Collections Medium Product Manifest implementation-build tags/COLLECTIONS_4_1_RC2@r1716550; 2015-11-25 22:53:13+0100 Low Product central artifactid commons-collections4 Highest Product pom groupid apache.commons Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest Implementation-Title Apache Commons Collections High Product pom parent-artifactid commons-parent Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-collections/ Low Product pom description The Apache Commons Collections package contains types that extend and augment the Java Collections Framework. Low Product pom name Apache Commons Collections High Product file name commons-collections4 High Product pom url http://commons.apache.org/proper/commons-collections/ Medium Version pom version 4.1 Highest Version central version 4.1 Highest Version file version 4.1 Highest Version Manifest Implementation-Version 4.1 High
Description: Apache POI - Java API To Access Microsoft Format Files
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/travis/.m2/repository/org/apache/poi/poi/3.15/poi-3.15.jar
MD5: 180cd5f6f178cbedd00316d44a42a171
SHA1: 965bba8899988008bb2341e300347de62aad5391
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom description Apache POI - Java API To Access Microsoft Format Files Medium Vendor pom url http://poi.apache.org/ Highest Vendor Manifest Implementation-Vendor-Id org.apache.poi Medium Vendor pom organization url http://www.apache.org/ Medium Vendor pom groupid org.apache.poi Highest Vendor pom groupid apache.poi Highest Vendor pom name Apache POI High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom organization name Apache Software Foundation High Vendor pom artifactid poi Low Vendor file name poi High Vendor central groupid org.apache.poi Highest Product pom name Apache POI High Product pom description Apache POI - Java API To Access Microsoft Format Files Medium Product central artifactid poi Highest Product pom organization name Apache Software Foundation Low Product Manifest Implementation-Title Apache POI High Product Manifest specification-title Apache POI Medium Product pom organization url http://www.apache.org/ Low Product pom artifactid poi Highest Product pom groupid apache.poi Low Product file name poi High Product pom url http://poi.apache.org/ Medium Version central version 3.15 Highest Version Manifest Implementation-Version 3.15 High Version file version 3.15 Highest Version pom version 3.15 Highest
Related Dependencies
poi-ooxml-3.15.jar
File Path: /home/travis/.m2/repository/org/apache/poi/poi-ooxml/3.15/poi-ooxml-3.15.jar
SHA1: e2800856735b07b8edd417aee07685470216a00f
MD5: 6b95361cab76a22e60109010f22c6628
maven: org.apache.poi:poi-ooxml:3.15 ✓
poi-ooxml-schemas-3.15.jar
File Path: /home/travis/.m2/repository/org/apache/poi/poi-ooxml-schemas/3.15/poi-ooxml-schemas-3.15.jar
SHA1: de4a50ca39de48a19606b35644ecadb2f733c479
MD5: 327a013becf0b826c134c42b252e7766
maven: org.apache.poi:poi-ooxml-schemas:3.15 ✓
Description: StAX API is the standard java XML processing API defined by JSR-173
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/travis/.m2/repository/stax/stax-api/1.0.1/stax-api-1.0.1.jar
MD5: 7d436a53c64490bee564c576babb36b4
SHA1: 49c100caf72d658aca8e58bd74a4ba90fa2b0d70
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom name StAX API High Vendor file name stax-api High Vendor central groupid stax Highest Vendor pom artifactid stax-api Low Vendor Manifest specification-vendor JCP-173 Low Vendor pom groupid stax Highest Vendor pom description StAX API is the standard java XML processing API defined by JSR-173 Medium Vendor pom url http://stax.codehaus.org/ Highest Vendor Manifest Implementation-Vendor JCP High Product central artifactid stax-api Highest Product pom name StAX API High Product file name stax-api High Product Manifest specification-title StAX Medium Product pom groupid stax Low Product pom url http://stax.codehaus.org/ Medium Product pom artifactid stax-api Highest Product pom description StAX API is the standard java XML processing API defined by JSR-173 Medium Product Manifest Implementation-Title StAX 1.0 API High Version Manifest Implementation-Version 1.0.1 High Version pom version 1.0.1 Highest Version central version 1.0.1 Highest Version file version 1.0.1 Highest
cpe: cpe:/a:st_project:st:1.0.1
Confidence :Low
suppress
maven: stax:stax-api:1.0.1 ✓
Confidence :Highest
Published Vulnerabilities
CVE-2017-16224 suppress
Severity:
Medium
st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A request for: http://some.server.com//nodesecurity.org/%2e%2e would result in a 301 to //nodesecurity.org/%2e%2e which most browsers treat as a proper redirect as // is translated into the current schema being used. Mitigating factor: In order for this to work, st must be serving from the root of a server (/) rather than the typical sub directory (/static/) and the redirect URL will end with some form of URL encoded .. ("%2e%2e", "%2e.", ".%2e").
Vulnerable Software & Versions:
Description: XmlBeans main jar
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/travis/.m2/repository/org/apache/xmlbeans/xmlbeans/2.6.0/xmlbeans-2.6.0.jar
MD5: 6591c08682d613194dacb01e95c78c2c
SHA1: 29e80d2dd51f9dcdef8f9ffaee0d4dc1c9bbfc87
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor file name xmlbeans High Vendor pom groupid apache.xmlbeans Highest Vendor pom description XmlBeans main jar Medium Vendor pom artifactid xmlbeans Low Vendor pom organization url http://xmlbeans.apache.org/ Medium Vendor pom groupid org.apache.xmlbeans Highest Vendor pom name XmlBeans High Vendor central groupid org.apache.xmlbeans Highest Vendor pom organization name XmlBeans High Vendor manifest: org/apache/xmlbeans/ Implementation-Vendor Apache Software Foundation Medium Vendor pom url http://xmlbeans.apache.org Highest Product manifest: org/apache/xmlbeans/ Implementation-Title org.apache.xmlbeans Medium Product file name xmlbeans High Product pom organization name XmlBeans Low Product pom description XmlBeans main jar Medium Product pom organization url http://xmlbeans.apache.org/ Low Product central artifactid xmlbeans Highest Product pom groupid apache.xmlbeans Low Product pom url http://xmlbeans.apache.org Medium Product pom name XmlBeans High Product pom artifactid xmlbeans Highest Version central version 2.6.0 Highest Version file version 2.6.0 Highest Version pom version 2.6.0 Highest
Description: Implementation of various mathematical curves that define themselves over a set of control points. The API is written in Java. The curves supported are: Bezier, B-Spline, Cardinal Spline, Catmull-Rom Spline, Lagrange, Natural Cubic Spline, and NURBS.
License:
BSD License: http://opensource.org/licenses/BSD-3-Clause
File Path: /home/travis/.m2/repository/com/github/virtuald/curvesapi/1.04/curvesapi-1.04.jar
MD5: 0dcbd9b7e498d1118c920d1d55046743
SHA1: 3386abf821719bc89c7685f9eaafaf4a842f0199
Referenced In Project/Scope:
spring-i18n-support-web:compile
Evidence
Type Source Name Value Confidence Vendor pom artifactid curvesapi Low Vendor pom groupid github.virtuald Highest Vendor pom description Implementation of various mathematical curves that define themselves over a set of control points. The API is written in Java. The curves supported are: Bezier, B-Spline, Cardinal Spline, Catmull-Rom Spline, Lagrange, Natural Cubic Spline, and NURBS. Low Vendor jar package name math Low Vendor jar package name graphbuilder Low Vendor pom groupid com.github.virtuald Highest Vendor file name curvesapi High Vendor central groupid com.github.virtuald Highest Vendor pom url virtuald/curvesapi Highest Vendor pom name curvesapi High Product pom artifactid curvesapi Highest Product pom url virtuald/curvesapi High Product pom groupid github.virtuald Low Product pom description Implementation of various mathematical curves that define themselves over a set of control points. The API is written in Java. The curves supported are: Bezier, B-Spline, Cardinal Spline, Catmull-Rom Spline, Lagrange, Natural Cubic Spline, and NURBS. Low Product jar package name math Low Product file name curvesapi High Product central artifactid curvesapi Highest Product pom name curvesapi High Version pom version 1.04 Highest Version central version 1.04 Highest Version file version 1.04 Highest