Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 3.1.2
Report Generated On: Oct 13, 2019 at 08:22:49 +00:00
Dependencies Scanned: 1 (1 unique)
Vulnerable Dependencies: 1
Vulnerabilities Found: 1
Vulnerabilities Suppressed: 0
...
NVD CVE 2002: 10/10/2019 09:15:36
NVD CVE 2003: 11/10/2019 08:45:55
NVD CVE 2004: 08/10/2019 13:32:07
NVD CVE 2005: 11/10/2019 08:45:55
NVD CVE 2006: 11/10/2019 08:45:55
NVD CVE 2007: 10/10/2019 09:15:36
NVD CVE 2008: 11/10/2019 08:45:55
NVD CVE 2009: 11/10/2019 08:45:55
NVD CVE 2010: 12/10/2019 08:45:35
NVD CVE 2011: 10/10/2019 08:45:44
NVD CVE 2012: 10/10/2019 08:45:45
NVD CVE 2013: 11/10/2019 08:45:56
NVD CVE 2014: 10/10/2019 08:45:45
NVD CVE 2015: 12/10/2019 08:45:35
NVD CVE 2016: 12/10/2019 08:15:30
NVD CVE 2017: 12/10/2019 08:15:30
NVD CVE 2018: 12/10/2019 07:45:35
NVD CVE 2019: 12/10/2019 07:45:35
NVD CVE Checked: 13/10/2019 07:53:12
NVD CVE Modified: 13/10/2019 05:15:31
VersionCheckOn: 1570953192127

Display: Showing Vulnerable Dependencies (click to show all)

Dependency	CPE	Coordinates	Highest Severity	CVE Count	CPE Confidence	Evidence Count
cometd-javascript-jquery-3.0.8.war	cpe:/a:jquery:jquery:3.0.8	org.cometd.javascript:cometd-javascript-jquery:3.0.8	Medium	1	Low	24

Dependencies

cometd-javascript-jquery-3.0.8.war

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html

File Path: /home/ciagent/.m2/repository/org/cometd/javascript/cometd-javascript-jquery/3.0.8/cometd-javascript-jquery-3.0.8.war
MD5: 26eb81a00cb777d04c290480d1614027
SHA1: eed7d93b72c3161f7070c0b27044e76286bbcd3c
Referenced In Project/Scope: eXo PLF:: Commons - Comet WebApp:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	Manifest	bundle-contactaddress	http://cometd.org/cometd-javascript-project/cometd-javascript-jquery	Low
Vendor	pom	parent-artifactid	cometd-javascript-project	Low
Vendor	pom	parent-groupid	org.cometd.javascript	Medium
Vendor	manifest	Bundle-Description	The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques	Low
Vendor	Manifest	bundle-docurl	http://docs.cometd.org	Low
Vendor	pom	groupid	cometd.javascript	Highest
Vendor	file	name	cometd-javascript-jquery	High
Vendor	pom	name	CometD :: JavaScript :: jQuery	High
Vendor	pom	artifactid	cometd-javascript-jquery	Low
Vendor	pom	groupid	org.cometd.javascript	Highest
Vendor	Manifest	bundle-symbolicname	cometd-javascript-jquery	Medium
Product	Manifest	bundle-contactaddress	http://cometd.org/cometd-javascript-project/cometd-javascript-jquery	Low
Product	pom	groupid	cometd.javascript	Low
Product	Manifest	Bundle-Name	CometD :: JavaScript :: jQuery	Medium
Product	manifest	Bundle-Description	The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques	Low
Product	Manifest	bundle-docurl	http://docs.cometd.org	Low
Product	pom	artifactid	cometd-javascript-jquery	Highest
Product	file	name	cometd-javascript-jquery	High
Product	pom	name	CometD :: JavaScript :: jQuery	High
Product	pom	parent-artifactid	cometd-javascript-project	Medium
Product	Manifest	bundle-symbolicname	cometd-javascript-jquery	Medium
Product	pom	parent-groupid	org.cometd.javascript	Low
Version	pom	version	3.0.8	Highest
Version	file	version	3.0.8	Highest

Identifiers

cpe: cpe:/a:jquery:jquery:3.0.8 Confidence:Low
maven: org.cometd.javascript:cometd-javascript-jquery:3.0.8 Confidence:High

Published Vulnerabilities

CVE-2007-2379

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."

Vulnerable Software & Versions:

cpe:/a:jquery:jquery

How to read the report | Suppressing false positives | Getting Help: google group | github issues

Project: eXo PLF:: Commons - Comet WebApp

org.exoplatform.commons:commons-comet-webapp:6.0.x-SNAPSHOT

Dependencies

cometd-javascript-jquery-3.0.8.war

Evidence

Identifiers

Published Vulnerabilities