Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 3.1.2Report Generated On : May 5, 2019 at 09:08:18 +00:00Dependencies Scanned : 172 (148 unique)Vulnerable Dependencies : 23 Vulnerabilities Found : 67Vulnerabilities Suppressed : 0...
NVD CVE 2002 : 02/05/2019 09:15:31NVD CVE 2003 : 04/05/2019 08:45:56NVD CVE 2004 : 01/05/2019 09:15:33NVD CVE 2005 : 02/05/2019 09:15:32NVD CVE 2006 : 04/05/2019 08:45:56NVD CVE 2007 : 04/05/2019 08:45:56NVD CVE 2008 : 04/05/2019 08:45:57NVD CVE 2009 : 04/05/2019 08:45:57NVD CVE 2010 : 04/05/2019 08:45:57NVD CVE 2011 : 04/05/2019 08:45:57NVD CVE 2012 : 04/05/2019 08:15:38NVD CVE 2013 : 04/05/2019 08:15:39NVD CVE 2014 : 04/05/2019 08:15:39NVD CVE 2015 : 04/05/2019 08:15:39NVD CVE 2016 : 04/05/2019 08:15:39NVD CVE 2017 : 04/05/2019 07:45:42NVD CVE 2018 : 04/05/2019 07:45:42NVD CVE 2019 : 05/05/2019 07:15:28NVD CVE Checked : 05/05/2019 07:31:20NVD CVE Modified : 05/05/2019 05:15:30VersionCheckOn : 1557041480499
Display:
Showing Vulnerable Dependencies (click to show all)
Dependencies
File Path: /home/ciagent/.m2/repository/org/exoplatform/platform-ui/platform-ui-skin/5.3.x-SNAPSHOT/platform-ui-skin-5.3.x-SNAPSHOT.warMD5: 0b64497374982b5046da775925c1da42SHA1: 2bb2a87b6ec11a970a356e248b1374ca91baa092
Referenced In Project/Scope:
eXo PLF:: WCM Resources:provided
Evidence
Type Source Name Value Confidence Vendor file name platform-ui-skin High Vendor pom groupid org.exoplatform.platform-ui Highest Vendor Manifest specification-vendor eXo Platform SAS Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom artifactid platform-ui-skin Low Vendor pom groupid exoplatform.platform-ui Highest Vendor pom name eXo PLF:: Platform UI - Skin High Vendor Manifest implementation-url https://projects.exoplatform.org/platform-ui/platform-ui-skin Low Vendor pom parent-artifactid platform-ui Low Vendor Manifest Implementation-Vendor-Id org.exoplatform.platform-ui Medium Vendor pom parent-groupid org.exoplatform.platform-ui Medium Vendor Manifest date 2019-05-02T07:36:16Z Low Product Manifest implementation-url https://projects.exoplatform.org/platform-ui/platform-ui-skin Low Product file name platform-ui-skin High Product Manifest Implementation-Title eXo PLF:: Platform UI - Skin High Product Manifest specification-title eXo PLF:: Platform UI - Skin Medium Product pom parent-artifactid platform-ui Medium Product pom groupid exoplatform.platform-ui Low Product pom parent-groupid org.exoplatform.platform-ui Low Product pom artifactid platform-ui-skin Highest Product Manifest date 2019-05-02T07:36:16Z Low Product pom name eXo PLF:: Platform UI - Skin High Version pom version 5.3.x-20190502.073655-23 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.platform-ui:platform-ui-skin:5.3.x-SNAPSHOT
Confidence :High
File Path: /home/ciagent/.m2/repository/args4j/args4j/2.0.16/args4j-2.0.16.jarMD5: 6571d69d142dd2a003c4ffae6138f0eeSHA1: 9f00fb12820743b9e05c686eba543d64dd43f2b1
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name args4j High Vendor jar package name args4j Low Vendor central groupid args4j Highest Vendor pom groupid args4j Highest Vendor pom artifactid args4j Low Vendor pom parent-artifactid args4j-site Low Vendor jar package name spi Low Vendor pom name args4j High Vendor jar package name kohsuke Low Product file name args4j High Product jar package name args4j Low Product central artifactid args4j Highest Product jar package name spi Low Product pom parent-artifactid args4j-site Medium Product pom name args4j High Product pom artifactid args4j Highest Product pom groupid args4j Low Version file version 2.0.16 Highest Version central version 2.0.16 Highest Version pom version 2.0.16 Highest
Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/com/google/guava/guava/18.0/guava-18.0.jar
MD5: 947641f6bb535b1d942d1bc387c45290
SHA1: cce0823396aa693798f8882e64213b1772032b09
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-docurl https://guava-libraries.googlecode.com/ Low Vendor file name guava High Vendor pom name Guava: Google Core Libraries for Java High Vendor central groupid com.google.guava Highest Vendor pom parent-artifactid guava-parent Low Vendor Manifest bundle-symbolicname com.google.guava Medium Vendor pom groupid com.google.guava Highest Vendor pom description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low Vendor pom artifactid guava Low Vendor manifest Bundle-Description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low Vendor pom parent-groupid com.google.guava Medium Vendor pom groupid google.guava Highest Product Manifest bundle-docurl https://guava-libraries.googlecode.com/ Low Product file name guava High Product pom groupid google.guava Low Product pom name Guava: Google Core Libraries for Java High Product pom parent-groupid com.google.guava Low Product Manifest bundle-symbolicname com.google.guava Medium Product pom artifactid guava Highest Product pom parent-artifactid guava-parent Medium Product pom description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low Product central artifactid guava Highest Product manifest Bundle-Description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low Product Manifest Bundle-Name Guava: Google Core Libraries for Java Medium Version file version 18.0 Highest Version central version 18.0 Highest Version pom version 18.0 Highest
Published Vulnerabilities
CVE-2018-10237 suppress
Severity:
Medium
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Vulnerable Software & Versions: (show all )
Description:
JSON (JavaScript Object Notation) is a lightweight data-interchange format.
It is easy for humans to read and write. It is easy for machines to parse and generate.
It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition
- December 1999. JSON is a text format that is completely language independent but uses
conventions that are familiar to programmers of the C-family of languages, including C, C++, C#,
Java, JavaScript, Perl, Python, and many others.
These properties make JSON an ideal data-interchange language.
File Path: /home/ciagent/.m2/repository/org/json/json/20070829/json-20070829.jarMD5: 4a913140f9099519dfc0212fa5d9a457SHA1: 89190ff77b57203c3417555f32226998da97ff38
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but... Low Vendor central groupid org.json Highest Vendor pom artifactid json Low Vendor pom organization url http://json.org/ Medium Vendor pom name JSON (JavaScript Object Notation) High Vendor pom organization name JSON High Vendor pom url http://www.json.org/java/index.html Highest Vendor jar package name json Low Vendor pom groupid json Highest Vendor file name json-20070829 High Vendor pom groupid org.json Highest Product pom description JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but... Low Product pom name JSON (JavaScript Object Notation) High Product pom groupid json Low Product pom url http://www.json.org/java/index.html Medium Product central artifactid json Highest Product pom organization name JSON Low Product file name json-20070829 High Product pom artifactid json Highest Product pom organization url http://json.org/ Low Version pom version 20070829 Highest Version file version 20070829 Medium Version central version 20070829 Highest
Description:
Closure Compiler is a JavaScript optimizing compiler. It parses your
JavaScript, analyzes it, removes dead code and rewrites and minimizes
what's left. It also checks syntax, variable references, and types, and
warns about common JavaScript pitfalls. It is used in many of Google's
JavaScript apps, including Gmail, Google Web Search, Google Maps, and
Google Docs.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/com/google/javascript/closure-compiler/v20131014/closure-compiler-v20131014.jar
MD5: e9b4b20ef9ff13c13fb159a9efff33ea
SHA1: 5be964798a558aa8f7ddff395d5a9e030b49fae2
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description Closure Compiler is a JavaScript optimizing compiler. It parses your JavaScript, analyzes it, removes dead code and rewrites and minimizes what's left. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. It is used in many of Google's JavaScript apps, including Gmail, Google Web Search, Google Maps, and Google Docs. Low Vendor jar package name jscomp Low Vendor jar package name google Low Vendor file name closure-compiler-v20131014 High Vendor pom groupid com.google.javascript Highest Vendor pom groupid google.javascript Highest Vendor central groupid com.google.javascript Highest Vendor jar package name javascript Low Vendor pom organization name Google High Vendor pom name Closure Compiler High Vendor pom artifactid closure-compiler Low Vendor pom url http://code.google.com/p/closure-compiler/ Highest Vendor pom organization url http://www.google.com Medium Product pom description Closure Compiler is a JavaScript optimizing compiler. It parses your JavaScript, analyzes it, removes dead code and rewrites and minimizes what's left. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. It is used in many of Google's JavaScript apps, including Gmail, Google Web Search, Google Maps, and Google Docs. Low Product jar package name jscomp Low Product pom organization url http://www.google.com Low Product central artifactid closure-compiler Highest Product pom organization name Google Low Product jar package name javascript Low Product file name closure-compiler-v20131014 High Product pom name Closure Compiler High Product pom url http://code.google.com/p/closure-compiler/ Medium Product pom groupid google.javascript Low Product pom artifactid closure-compiler Highest Version file name closure-compiler-v20131014 Medium Version central version v20131014 Highest Version file version 20131014 Medium Version pom version v20131014 Highest
Published Vulnerabilities
CVE-2017-17689 suppress
Severity:
Medium
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
Vulnerable Software & Versions: (show all )
Description:
An implementation of the GoF Chain of Responsibility pattern
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-chain/commons-chain/1.2/commons-chain-1.2.jar
MD5: e18e2c87826644e4c8c08635572c154f
SHA1: 744a13e8766e338bd347b6fbc28c6db12979d0c6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid commons-chain Low Vendor pom parent-artifactid commons-parent Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor manifest Bundle-Description An implementation of the GoF Chain of Responsibility pattern Medium Vendor Manifest bundle-docurl http://commons.apache.org/chain/ Low Vendor Manifest bundle-symbolicname org.apache.commons.chain Medium Vendor pom parent-groupid org.apache.commons Medium Vendor pom description
An implementation of the GoF Chain of Responsibility pattern
Medium Vendor central groupid commons-chain Highest Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor pom name Commons Chain High Vendor pom groupid commons-chain Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor file name commons-chain High Vendor pom url http://commons.apache.org/chain/ Highest Product manifest Bundle-Description An implementation of the GoF Chain of Responsibility pattern Medium Product central artifactid commons-chain Highest Product Manifest bundle-docurl http://commons.apache.org/chain/ Low Product Manifest Bundle-Name Commons Chain Medium Product pom groupid commons-chain Low Product pom parent-groupid org.apache.commons Low Product Manifest bundle-symbolicname org.apache.commons.chain Medium Product pom url http://commons.apache.org/chain/ Medium Product pom description
An implementation of the GoF Chain of Responsibility pattern
Medium Product pom parent-artifactid commons-parent Medium Product pom artifactid commons-chain Highest Product Manifest specification-title Commons Chain Medium Product Manifest Implementation-Title Commons Chain High Product pom name Commons Chain High Product file name commons-chain High Version Manifest Implementation-Version 1.2 High Version central version 1.2 Highest Version file version 1.2 Highest Version pom version 1.2 Highest
Description:
The Digester package lets you configure an XML to Java object mapping module
which triggers certain actions called rules whenever a particular
pattern of nested XML elements is recognized.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-digester/commons-digester/2.1/commons-digester-2.1.jar
MD5: 528445033f22da28f5047b6abcd1c7c9
SHA1: 73a8001e7a54a255eef0f03521ec1805dc738ca0
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/digester/ Highest Vendor Manifest bundle-docurl http://commons.apache.org/digester/ Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom name Commons Digester High Vendor central groupid commons-digester Highest Vendor file name commons-digester High Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor manifest Bundle-Description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low Vendor pom groupid commons-digester Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom artifactid commons-digester Low Vendor Manifest bundle-symbolicname org.apache.commons.digester Medium Product Manifest bundle-docurl http://commons.apache.org/digester/ Low Product Manifest Bundle-Name Commons Digester Medium Product Manifest Implementation-Title Commons Digester High Product pom description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low Product pom parent-groupid org.apache.commons Low Product central artifactid commons-digester Highest Product pom artifactid commons-digester Highest Product pom name Commons Digester High Product pom parent-artifactid commons-parent Medium Product pom groupid commons-digester Low Product file name commons-digester High Product manifest Bundle-Description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low Product Manifest specification-title Commons Digester Medium Product pom url http://commons.apache.org/digester/ Medium Product Manifest bundle-symbolicname org.apache.commons.digester Medium Version Manifest Implementation-Version 2.1 High Version central version 2.1 Highest Version file version 2.1 Highest Version pom version 2.1 Highest
Description: Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.command/5.3.x-SNAPSHOT/exo.kernel.component.command-5.3.x-SNAPSHOT.jarMD5: b714466d2a266d499ff59ec3d35c0253SHA1: 728efa1960e01bf66af1f66b3d00aa5fdea14d64
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium Vendor pom name eXo PLF:: Kernel :: Component :: Command Service High Vendor pom parent-groupid org.exoplatform.kernel Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid kernel-parent Low Vendor file name exo.kernel.component.command High Vendor pom description Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project. Medium Vendor pom groupid exoplatform.kernel Highest Vendor pom artifactid exo.kernel.component.command Low Vendor pom groupid org.exoplatform.kernel Highest Product pom name eXo PLF:: Kernel :: Component :: Command Service High Product pom artifactid exo.kernel.component.command Highest Product Manifest specification-title exo-kernel Medium Product pom parent-groupid org.exoplatform.kernel Low Product Manifest Implementation-Title eXo PLF:: Kernel :: Component :: Command Service High Product pom parent-artifactid kernel-parent Medium Product file name exo.kernel.component.command High Product pom description Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project. Medium Product pom groupid exoplatform.kernel Low Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-20190428.124458-14 Highest Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.kernel:exo.kernel.component.command:5.3.x-SNAPSHOT
Confidence :High
Description: Enterprise Job Scheduler
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
Apache Software License, Version 2.0 File Path: /home/ciagent/.m2/repository/org/quartz-scheduler/quartz/2.2.2/quartz-2.2.2.jar
MD5: 6acfd6ada2f4ad0abf4de916654dcaea
SHA1: 6fd24da6803ab7c3a08bc519a62219a9bebeb0df
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name quartz High Vendor Manifest buildinfo-url https://svn.terracotta.org/repo/quartz/tags/quartz-2.2.2 Low Vendor Manifest buildinfo-timestamp 20151012-045213 Low Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.6 Low Vendor Manifest buildinfo-host tc-c65-jenkins-slave-001.eur.ad.sag Low Vendor manifest Bundle-Description Enterprise Job Scheduler Medium Vendor Manifest bundle-symbolicname org.quartz-scheduler.quartz Medium Vendor manifest terracotta-description Enterprise Job Scheduler Medium Vendor pom name quartz High Vendor Manifest buildinfo-user jenkins-slave Low Vendor pom parent-groupid org.quartz-scheduler Medium Vendor Manifest terracotta-name quartz Medium Vendor pom groupid quartz-scheduler Highest Vendor central groupid org.quartz-scheduler Highest Vendor pom groupid org.quartz-scheduler Highest Vendor pom description Enterprise Job Scheduler Medium Vendor Manifest bundle-docurl http://www.terracotta.org Low Vendor pom artifactid quartz Low Vendor Manifest buildinfo-revision 2464 Low Vendor pom parent-artifactid quartz-parent Low Product file name quartz High Product Manifest buildinfo-url https://svn.terracotta.org/repo/quartz/tags/quartz-2.2.2 Low Product Manifest buildinfo-timestamp 20151012-045213 Low Product pom parent-groupid org.quartz-scheduler Low Product Manifest bundle-requiredexecutionenvironment JavaSE-1.6 Low Product Manifest buildinfo-host tc-c65-jenkins-slave-001.eur.ad.sag Low Product manifest Bundle-Description Enterprise Job Scheduler Medium Product Manifest bundle-symbolicname org.quartz-scheduler.quartz Medium Product manifest terracotta-description Enterprise Job Scheduler Medium Product pom name quartz High Product Manifest buildinfo-user jenkins-slave Low Product pom groupid quartz-scheduler Low Product Manifest terracotta-name quartz Medium Product central artifactid quartz Highest Product pom description Enterprise Job Scheduler Medium Product Manifest bundle-docurl http://www.terracotta.org Low Product pom artifactid quartz Highest Product Manifest buildinfo-revision 2464 Low Product pom parent-artifactid quartz-parent Medium Product Manifest Bundle-Name quartz Medium Version pom version 2.2.2 Highest Version central version 2.2.2 Highest Version file version 2.2.2 Highest
Description: JavaMail API (compat)
License:
http://www.sun.com/cddl, https://glassfish.java.net/public/CDDL+GPL_1_1.html File Path: /home/ciagent/.m2/repository/javax/mail/mail/1.4.7/mail-1.4.7.jar
MD5: 77f53ff0c78ba43c4812ecc9f53e20f8
SHA1: 9add058589d5d85adeb625859bf2c5eeaaedf12d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-groupid com.sun.mail Medium Vendor Manifest bundle-docurl http://www.oracle.com Low Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor pom name JavaMail API (compat) High Vendor central groupid org.zenframework.z8.dependencies.commons High Vendor Manifest extension-name javax.mail Medium Vendor Manifest specification-vendor Oracle Low Vendor pom groupid javax.mail Highest Vendor file name mail High Vendor Manifest probe-provider-xml-file-names META-INF/gfprobe-provider.xml Medium Vendor Manifest bundle-symbolicname javax.mail Medium Vendor manifest Bundle-Description JavaMail API (compat) Medium Vendor Manifest (hint) specification-vendor sun Low Vendor central groupid javax.mail High Vendor pom artifactid mail Low Vendor Manifest (hint) Implementation-Vendor sun High Vendor Manifest Implementation-Vendor Oracle High Vendor pom parent-artifactid all Low Vendor Manifest originally-created-by 1.7.0_15 (Oracle Corporation) Low Product Manifest Implementation-Title javax.mail High Product Manifest bundle-docurl http://www.oracle.com Low Product central artifactid mail-1.4.7 High Product pom artifactid mail Highest Product Manifest specification-title JavaMail(TM) API Design Specification Medium Product pom name JavaMail API (compat) High Product Manifest extension-name javax.mail Medium Product file name mail High Product Manifest probe-provider-xml-file-names META-INF/gfprobe-provider.xml Medium Product Manifest bundle-symbolicname javax.mail Medium Product central artifactid mail High Product manifest Bundle-Description JavaMail API (compat) Medium Product pom parent-groupid com.sun.mail Low Product Manifest Bundle-Name JavaMail API (compat) Medium Product pom groupid javax.mail Low Product pom parent-artifactid all Medium Product Manifest originally-created-by 1.7.0_15 (Oracle Corporation) Low Version file version 1.4.7 Highest Version Manifest Implementation-Version 1.4.7 High Version central version 1.4.7 High Version central version 2.0 High Version pom version 1.4.7 Highest
Description: Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.common/5.3.x-SNAPSHOT/exo.kernel.component.common-5.3.x-SNAPSHOT.jarMD5: 39cfac4eefe054444c2a6e3f53539612SHA1: 7bcf5ddcaa300b0393c4f239e65d5cf515038ca2
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium Vendor pom description Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project. Medium Vendor file name exo.kernel.component.common High Vendor pom parent-groupid org.exoplatform.kernel Medium Vendor pom artifactid exo.kernel.component.common Low Vendor Manifest specification-vendor eXo Platform SAS Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid kernel-parent Low Vendor pom name eXo PLF:: Kernel :: Component :: Common Service High Vendor pom groupid exoplatform.kernel Highest Vendor pom groupid org.exoplatform.kernel Highest Product pom description Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project. Medium Product file name exo.kernel.component.common High Product Manifest specification-title exo-kernel Medium Product pom parent-groupid org.exoplatform.kernel Low Product Manifest Implementation-Title eXo PLF:: Kernel :: Component :: Common Service High Product pom parent-artifactid kernel-parent Medium Product pom name eXo PLF:: Kernel :: Component :: Common Service High Product pom artifactid exo.kernel.component.common Highest Product pom groupid exoplatform.kernel Low Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.component.common:5.3.x-SNAPSHOT
Confidence :High
Description:
The Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-io/commons-io/2.4/commons-io-2.4.jar
MD5: 7f97854dc04c119d461fed14f5d8bb96
SHA1: b1b6ea3b7e4aa4f492509a4952029cd8e48019ad
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-io Low Vendor pom description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Vendor manifest Bundle-Description The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest bundle-docurl http://commons.apache.org/io/ Low Vendor pom name Commons IO High Vendor central groupid commons-io Highest Vendor pom groupid commons-io Highest Vendor file name commons-io High Vendor pom url http://commons.apache.org/io/ Highest Vendor Manifest implementation-build tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400 Low Vendor Manifest bundle-symbolicname org.apache.commons.io Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Product Manifest Bundle-Name Commons IO Medium Product central artifactid commons-io Highest Product pom description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Product pom url http://commons.apache.org/io/ Medium Product pom artifactid commons-io Highest Product pom parent-groupid org.apache.commons Low Product manifest Bundle-Description The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low Product Manifest Implementation-Title Commons IO High Product Manifest bundle-docurl http://commons.apache.org/io/ Low Product pom parent-artifactid commons-parent Medium Product pom name Commons IO High Product file name commons-io High Product Manifest implementation-build tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400 Low Product Manifest bundle-symbolicname org.apache.commons.io Medium Product Manifest specification-title Commons IO Medium Product pom groupid commons-io Low Version file version 2.4 Highest Version pom version 2.4 Highest Version Manifest Implementation-Version 2.4 High Version central version 2.4 Highest
Description:
The Apache FontBox library is an open source Java tool to obtain low level information
from font files. FontBox is a subproject of Apache PDFBox.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/fontbox/1.8.14/fontbox-1.8.14.jar
MD5: 901640f7e2bd12508ae4a7cccba3df79
SHA1: 9c7caec614a6a132bedc83f1d6d247bb96ca0df3
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom url http://pdfbox.apache.org/ Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom groupid apache.pdfbox Highest Vendor pom description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low Vendor pom groupid org.apache.pdfbox Highest Vendor Manifest bundle-docurl http://pdfbox.apache.org Low Vendor pom name Apache FontBox High Vendor Manifest bundle-symbolicname org.apache.pdfbox.fontbox Medium Vendor central groupid org.apache.pdfbox Highest Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor Manifest Implementation-Vendor-Id org.apache.pdfbox Medium Vendor file name fontbox High Vendor pom parent-artifactid pdfbox-parent Low Vendor manifest Bundle-Description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom artifactid fontbox Low Vendor pom parent-groupid org.apache.pdfbox Medium Product pom description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low Product central artifactid fontbox Highest Product Manifest bundle-docurl http://pdfbox.apache.org Low Product pom parent-artifactid pdfbox-parent Medium Product Manifest Implementation-Title Apache FontBox High Product pom name Apache FontBox High Product pom url http://pdfbox.apache.org/ Medium Product Manifest bundle-symbolicname org.apache.pdfbox.fontbox Medium Product pom artifactid fontbox Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product Manifest specification-title Apache FontBox Medium Product file name fontbox High Product manifest Bundle-Description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low Product pom groupid apache.pdfbox Low Product pom parent-groupid org.apache.pdfbox Low Product Manifest Bundle-Name Apache FontBox Medium Version pom version 1.8.14 Highest Version central version 1.8.14 Highest Version file version 1.8.14 Highest Version Manifest Implementation-Version 1.8.14 High
Published Vulnerabilities
CVE-2018-11797 suppress
Severity:
Medium
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerable Software & Versions: (show all )
CVE-2018-8036 suppress
Severity:
Medium
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Vulnerable Software & Versions: (show all )
Description:
The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM)
specification. JempBox is a subproject of Apache PDFBox.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/jempbox/1.8.14/jempbox-1.8.14.jar
MD5: 393135759731daf4e301903b3de2fbbb
SHA1: 7f94c7cd4efc21e78729436cc4cf0c09eeea0f38
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom groupid apache.pdfbox Highest Vendor pom groupid org.apache.pdfbox Highest Vendor Manifest bundle-symbolicname org.apache.pdfbox.jempbox Medium Vendor Manifest bundle-docurl http://pdfbox.apache.org Low Vendor pom name Apache JempBox High Vendor central groupid org.apache.pdfbox Highest Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor Manifest Implementation-Vendor-Id org.apache.pdfbox Medium Vendor file name jempbox High Vendor pom parent-artifactid pdfbox-parent Low Vendor manifest Bundle-Description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom artifactid jempbox Low Vendor pom parent-groupid org.apache.pdfbox Medium Vendor pom description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low Product central artifactid jempbox Highest Product Manifest bundle-symbolicname org.apache.pdfbox.jempbox Medium Product Manifest bundle-docurl http://pdfbox.apache.org Low Product pom parent-artifactid pdfbox-parent Medium Product pom name Apache JempBox High Product pom artifactid jempbox Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product Manifest Implementation-Title Apache JempBox High Product Manifest specification-title Apache JempBox Medium Product file name jempbox High Product manifest Bundle-Description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low Product pom groupid apache.pdfbox Low Product pom parent-groupid org.apache.pdfbox Low Product Manifest Bundle-Name Apache JempBox Medium Product pom description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low Version pom version 1.8.14 Highest Version central version 1.8.14 Highest Version file version 1.8.14 Highest Version Manifest Implementation-Version 1.8.14 High
Published Vulnerabilities
CVE-2018-11797 suppress
Severity:
Medium
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerable Software & Versions: (show all )
CVE-2018-8036 suppress
Severity:
Medium
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Vulnerable Software & Versions: (show all )
Description:
The Apache PDFBox library is an open source Java tool for working with PDF documents.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/pdfbox/1.8.14/pdfbox-1.8.14.jar
MD5: c90740e185fc2f8013d1119f509ea4f3
SHA1: 7550298240c8540b721733ede6dc88fcf4fa2b0f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name Apache PDFBox High Vendor manifest Bundle-Description The Apache PDFBox library is an open source Java tool for working with PDF documents. Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom groupid apache.pdfbox Highest Vendor pom groupid org.apache.pdfbox Highest Vendor Manifest bundle-docurl http://pdfbox.apache.org Low Vendor central groupid org.apache.pdfbox Highest Vendor Manifest bundle-symbolicname org.apache.pdfbox Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor pom artifactid pdfbox Low Vendor Manifest Implementation-Vendor-Id org.apache.pdfbox Medium Vendor pom description
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Medium Vendor pom parent-artifactid pdfbox-parent Low Vendor file name pdfbox High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.pdfbox Medium Product pom artifactid pdfbox Highest Product Manifest specification-title Apache PDFBox Medium Product pom name Apache PDFBox High Product manifest Bundle-Description The Apache PDFBox library is an open source Java tool for working with PDF documents. Medium Product Manifest Implementation-Title Apache PDFBox High Product Manifest bundle-docurl http://pdfbox.apache.org Low Product pom parent-artifactid pdfbox-parent Medium Product central artifactid pdfbox Highest Product Manifest bundle-symbolicname org.apache.pdfbox Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product Manifest Bundle-Name Apache PDFBox Medium Product pom description
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Medium Product file name pdfbox High Product pom groupid apache.pdfbox Low Product pom parent-groupid org.apache.pdfbox Low Version pom version 1.8.14 Highest Version central version 1.8.14 Highest Version file version 1.8.14 Highest Version Manifest Implementation-Version 1.8.14 High
Published Vulnerabilities
CVE-2018-11797 suppress
Severity:
Medium
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerable Software & Versions: (show all )
CVE-2018-8036 suppress
Severity:
Medium
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Vulnerable Software & Versions: (show all )
Description: HTML Lexer is the low level lexical analyzer.
File Path: /home/ciagent/.m2/repository/org/htmlparser/htmllexer/2.1/htmllexer-2.1.jarMD5: 1cb7184766a0c52f4d98d671bb08be19SHA1: 2ebf2c073e649b7e674cddd0558ff102a486402f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name htmlparser Low Vendor central groupid org.htmlparser Highest Vendor pom name HTML Lexer Jar High Vendor file name htmllexer High Vendor pom parent-groupid org.htmlparser Medium Vendor pom parent-artifactid HTMLParserProject Low Vendor pom description HTML Lexer is the low level lexical analyzer. Medium Vendor pom groupid org.htmlparser Highest Vendor pom url http://htmlparser.org Highest Vendor pom groupid htmlparser Highest Vendor pom artifactid htmllexer Low Product pom name HTML Lexer Jar High Product pom parent-artifactid HTMLParserProject Medium Product file name htmllexer High Product pom description HTML Lexer is the low level lexical analyzer. Medium Product pom groupid htmlparser Low Product central artifactid htmllexer Highest Product pom artifactid htmllexer Highest Product pom parent-groupid org.htmlparser Low Product pom url http://htmlparser.org Medium Version central version 2.1 Highest Version file version 2.1 Highest Version pom version 2.1 Highest
Description: HTML Parser is the high level syntactical analyzer.
File Path: /home/ciagent/.m2/repository/org/htmlparser/htmlparser/2.1/htmlparser-2.1.jarMD5: aa05b921026c228f92ef8b4a13c26f8dSHA1: c752e5984b7767533cbd3fdffa48cecb52fa226c
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name htmlparser Low Vendor central groupid org.htmlparser Highest Vendor pom artifactid htmlparser Low Vendor pom parent-groupid org.htmlparser Medium Vendor pom parent-artifactid HTMLParserProject Low Vendor pom groupid org.htmlparser Highest Vendor file name htmlparser High Vendor pom name HTML Parser Jar High Vendor pom description HTML Parser is the high level syntactical analyzer. Medium Vendor pom url http://htmlparser.org Highest Vendor pom groupid htmlparser Highest Product pom parent-artifactid HTMLParserProject Medium Product pom artifactid htmlparser Highest Product pom groupid htmlparser Low Product central artifactid htmlparser Highest Product file name htmlparser High Product pom name HTML Parser Jar High Product pom description HTML Parser is the high level syntactical analyzer. Medium Product pom parent-groupid org.htmlparser Low Product pom url http://htmlparser.org Medium Version central version 2.1 Highest Version file version 2.1 Highest Version pom version 2.1 Highest
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar
MD5: 353cf6a2bdba09595ccfa073b78c7fcb
SHA1: 4b95f4897fa13f2cd904aee711aeafc0c5295cd8
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Vendor pom url http://commons.apache.org/proper/commons-codec/ Highest Vendor manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom parent-groupid org.apache.commons Medium Vendor central groupid commons-codec Highest Vendor Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low Vendor file name commons-codec High Vendor pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Vendor pom groupid commons-codec Highest Vendor pom name Apache Commons Codec High Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor pom artifactid commons-codec Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest bundle-symbolicname org.apache.commons.codec Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Product central artifactid commons-codec Highest Product manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Product Manifest Bundle-Name Apache Commons Codec Medium Product pom artifactid commons-codec Highest Product pom parent-groupid org.apache.commons Low Product Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low Product Manifest specification-title Apache Commons Codec Medium Product file name commons-codec High Product Manifest Implementation-Title Apache Commons Codec High Product pom parent-artifactid commons-parent Medium Product pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low Product pom name Apache Commons Codec High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom url http://commons.apache.org/proper/commons-codec/ Medium Product Manifest bundle-symbolicname org.apache.commons.codec Medium Product pom groupid commons-codec Low Version Manifest Implementation-Version 1.10 High Version file version 1.10 Highest Version pom version 1.10 Highest Version central version 1.10 Highest
Description: Apache POI - Java API To Access Microsoft Format Files
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi/3.13/poi-3.13.jar
MD5: 1b43f32e2211546040597a9e2d07b869
SHA1: 0f59f504ba8c521e61e25f417ec652fd485010f3
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom groupid apache.poi Highest Vendor pom groupid org.apache.poi Highest Vendor Manifest Implementation-Vendor-Id org.apache.poi Medium Vendor pom organization url http://www.apache.org/ Medium Vendor pom url http://poi.apache.org/ Highest Vendor pom artifactid poi Low Vendor central groupid org.apache.poi Highest Vendor pom organization name Apache Software Foundation High Vendor pom name Apache POI High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom description Apache POI - Java API To Access Microsoft Format Files Medium Vendor file name poi High Product Manifest Implementation-Title Apache POI High Product Manifest specification-title Apache POI Medium Product pom organization name Apache Software Foundation Low Product pom artifactid poi Highest Product pom name Apache POI High Product pom organization url http://www.apache.org/ Low Product pom url http://poi.apache.org/ Medium Product pom description Apache POI - Java API To Access Microsoft Format Files Medium Product file name poi High Product pom groupid apache.poi Low Product central artifactid poi Highest Version central version 3.13 Highest Version pom version 3.13 Highest Version file version 3.13 Highest Version Manifest Implementation-Version 3.13 High
Related Dependencies
poi-ooxml-3.13.jar
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi-ooxml/3.13/poi-ooxml-3.13.jar
SHA1: c364a8f5422d613e3a56db3b4b889f2989d7ee73
MD5: 38bb36c35a16030d4bc0ac14421430d7
cpe: cpe:/a:apache:poi:3.13
maven: org.apache.poi:poi-ooxml:3.13 ✓
poi-ooxml-schemas-3.13.jar
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi-ooxml-schemas/3.13/poi-ooxml-schemas-3.13.jar
SHA1: 56fb0b9f3ffc3d7f7fc9b59e17b5fa2c3ab921e7
MD5: ca12e13961e9df83ddd5471733d73d91
cpe: cpe:/a:apache:poi:3.13
maven: org.apache.poi:poi-ooxml-schemas:3.13 ✓
poi-scratchpad-3.13.jar
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi-scratchpad/3.13/poi-scratchpad-3.13.jar
SHA1: 09d763275e6c7fa05d47e2581606748669e88c55
MD5: d8dbe05b289da779874e4783881e1b57
cpe: cpe:/a:apache:poi:3.13
maven: org.apache.poi:poi-scratchpad:3.13 ✓
Published Vulnerabilities
CVE-2016-5000 suppress
Severity:
Medium
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerable Software & Versions:
CVE-2017-5644 suppress
Severity:
High
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Vulnerable Software & Versions:
Description: This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/tika/tika-core/1.5/tika-core-1.5.jar
MD5: e864bf637f51283dc525087b015d7b1a
SHA1: 194ca0fb3d73b07737524806fbc3bec89063c03a
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid apache.tika Highest Vendor pom name Apache Tika core High Vendor pom artifactid tika-core Low Vendor pom url http://tika.apache.org/ Highest Vendor central groupid org.apache.tika Highest Vendor manifest Bundle-Description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low Vendor pom parent-groupid org.apache.tika Medium Vendor pom groupid org.apache.tika Highest Vendor Manifest bundle-docurl http://tika.apache.org/ Low Vendor pom description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low Vendor Manifest bundle-symbolicname org.apache.tika.core Medium Vendor pom organization url http://www.apache.org Medium Vendor pom parent-artifactid tika-parent Low Vendor file name tika-core High Vendor pom organization name The Apache Software Foundation High Product pom name Apache Tika core High Product manifest Bundle-Description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low Product pom url http://tika.apache.org/ Medium Product central artifactid tika-core Highest Product pom groupid apache.tika Low Product pom parent-groupid org.apache.tika Low Product Manifest bundle-docurl http://tika.apache.org/ Low Product Manifest Bundle-Name Apache Tika core Medium Product pom description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low Product pom artifactid tika-core Highest Product Manifest bundle-symbolicname org.apache.tika.core Medium Product pom parent-artifactid tika-parent Medium Product pom organization url http://www.apache.org Low Product pom organization name The Apache Software Foundation Low Product file name tika-core High Version file version 1.5 Highest Version pom version 1.5 Highest Version central version 1.5 Highest
Related Dependencies
tika-parsers-1.5.jar
File Path: /home/ciagent/.m2/repository/org/apache/tika/tika-parsers/1.5/tika-parsers-1.5.jar
SHA1: 9b895231b7a0dae7349dfb42cb1b926c345b5281
MD5: f1056da5d1021ad1bbac7dab01b335d1
cpe: cpe:/a:apache:tika:1.5
maven: org.apache.tika:tika-parsers:1.5 ✓
Published Vulnerabilities
CVE-2016-6809 suppress
Severity:
High
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Vulnerable Software & Versions:
CVE-2018-11761 suppress
Severity:
Medium
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Vulnerable Software & Versions: (show all )
CVE-2018-11762 suppress
Severity:
Medium
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Vulnerable Software & Versions: (show all )
CVE-2018-11796 suppress
Severity:
Medium
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Vulnerable Software & Versions: (show all )
CVE-2018-1335 suppress
Severity:
High
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1338 suppress
Severity:
Medium
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1339 suppress
Severity:
Medium
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-8017 suppress
Severity:
Medium
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Vulnerable Software & Versions: (show all )
File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-core/0.1/vorbis-java-core-0.1-tests.jarMD5: d58f076c08a917277d03f3417aa867a6SHA1: c849979e199d8a7c3da1a00799c623c00f94efac
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.gagravarr Highest Vendor pom url Gagravarr/VorbisJava Highest Vendor jar package name gagravarr Low Vendor jar package name ogg Low Vendor pom groupid gagravarr Highest Vendor pom parent-groupid org.gagravarr Medium Vendor pom parent-artifactid vorbis-java-parent Low Vendor pom artifactid vorbis-java-core Low Vendor pom groupid org.gagravarr Highest Vendor file name vorbis-java-core High Vendor pom name Ogg and Vorbis for Java, Core High Product central artifactid vorbis-java-core Highest Product pom parent-groupid org.gagravarr Low Product jar package name ogg Low Product pom url Gagravarr/VorbisJava High Product pom artifactid vorbis-java-core Highest Product pom groupid gagravarr Low Product pom parent-artifactid vorbis-java-parent Medium Product file name vorbis-java-core High Product pom name Ogg and Vorbis for Java, Core High Version pom version 0.1 Highest Version file version 0.1 Highest Version central version 0.1 Highest
File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-tika/0.1/vorbis-java-tika-0.1.jarMD5: 1fccc6796a0924ba4f32eb1d44b8616bSHA1: 6966c8663a7f689021accb13cceaa6101f53ea3d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.gagravarr Highest Vendor pom url Gagravarr/VorbisJava Highest Vendor jar package name gagravarr Low Vendor pom groupid gagravarr Highest Vendor pom parent-groupid org.gagravarr Medium Vendor pom artifactid vorbis-java-tika Low Vendor pom parent-artifactid vorbis-java-parent Low Vendor jar package name tika Low Vendor file name vorbis-java-tika High Vendor pom name Apache Tika plugin for Ogg, Vorbis and FLAC High Vendor pom groupid org.gagravarr Highest Product pom artifactid vorbis-java-tika Highest Product pom parent-groupid org.gagravarr Low Product pom url Gagravarr/VorbisJava High Product pom groupid gagravarr Low Product jar package name tika Low Product file name vorbis-java-tika High Product pom name Apache Tika plugin for Ogg, Vorbis and FLAC High Product pom parent-artifactid vorbis-java-parent Medium Product central artifactid vorbis-java-tika Highest Version pom version 0.1 Highest Version file version 0.1 Highest Version central version 0.1 Highest
Published Vulnerabilities
CVE-2016-6809 suppress
Severity:
High
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Vulnerable Software & Versions:
CVE-2018-11761 suppress
Severity:
Medium
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Vulnerable Software & Versions: (show all )
CVE-2018-11796 suppress
Severity:
Medium
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Vulnerable Software & Versions: (show all )
CVE-2018-1335 suppress
Severity:
High
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1338 suppress
Severity:
Medium
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1339 suppress
Severity:
Medium
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
Description: The NetCDF-Java Library is a Java interface to NetCDF files,
as well as to many other types of scientific data formats.
License:
(MIT-style) netCDF C library license.: http://www.unidata.ucar.edu/software/netcdf/copyright.html
File Path: /home/ciagent/.m2/repository/edu/ucar/netcdf/4.2-min/netcdf-4.2-min.jar
MD5: eb00b40b0511f0fc1dfcfc9cb89e3c53
SHA1: 0f3c3f3db4c54483aa1fbc4497e300879ce24da1
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom url http://www.unidata.ucar.edu/software/netcdf-java/ Highest Vendor pom description The NetCDF-Java Library is a Java interface to NetCDF files, as well as to many other types of scientific data formats. Low Vendor pom name The NetCDF-Java Library High Vendor pom groupid edu.ucar Highest Vendor file name netcdf High Vendor Manifest Implementation-Vendor UCAR/Unidata High Vendor pom artifactid netcdf Low Vendor central groupid edu.ucar Highest Vendor Manifest built-on 2010-11-24 05:51:29 Low Product central artifactid netcdf Highest Product pom groupid edu.ucar Low Product pom description The NetCDF-Java Library is a Java interface to NetCDF files, as well as to many other types of scientific data formats. Low Product pom artifactid netcdf Highest Product Manifest Implementation-Title NetCDF-Java-Library High Product pom name The NetCDF-Java Library High Product file name netcdf High Product pom url http://www.unidata.ucar.edu/software/netcdf-java/ Medium Product Manifest built-on 2010-11-24 05:51:29 Low Version file version 4.2 Highest Version pom version 4.2-min Highest Version central version 4.2-min Highest
Description: Java stream based MIME message parser
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/james/apache-mime4j-core/0.7.2/apache-mime4j-core-0.7.2.jar
MD5: 88f799546eca803c53eee01a4ce5edcd
SHA1: a81264fe0265ebe8fd1d8128aad06dc320de6eef
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid apache-mime4j-core Low Vendor pom groupid apache.james Highest Vendor central groupid org.apache.james Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest bundle-symbolicname org.apache.james.apache-mime4j-core Medium Vendor Manifest bundle-docurl http://www.apache.org/ Low Vendor pom name Apache JAMES Mime4j (Core) High Vendor pom parent-artifactid apache-mime4j-project Low Vendor manifest Bundle-Description Java stream based MIME message parser Medium Vendor Manifest url http://james.apache.org/mime4j/apache-mime4j-core Low Vendor file name apache-mime4j-core High Vendor pom groupid org.apache.james Highest Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.james Medium Product Manifest bundle-symbolicname org.apache.james.apache-mime4j-core Medium Product Manifest Implementation-Title Apache Mime4j High Product Manifest specification-title Apache Mime4j Medium Product Manifest bundle-docurl http://www.apache.org/ Low Product pom parent-artifactid apache-mime4j-project Medium Product pom name Apache JAMES Mime4j (Core) High Product pom groupid apache.james Low Product manifest Bundle-Description Java stream based MIME message parser Medium Product Manifest url http://james.apache.org/mime4j/apache-mime4j-core Low Product file name apache-mime4j-core High Product central artifactid apache-mime4j-core Highest Product Manifest Bundle-Name Apache JAMES Mime4j (Core) Medium Product pom parent-groupid org.apache.james Low Product pom artifactid apache-mime4j-core Highest Version Manifest Implementation-Version 0.7.2 High Version pom version 0.7.2 Highest Version central version 0.7.2 Highest Version file version 0.7.2 Highest
Related Dependencies
apache-mime4j-dom-0.7.2.jar
File Path: /home/ciagent/.m2/repository/org/apache/james/apache-mime4j-dom/0.7.2/apache-mime4j-dom-0.7.2.jar
SHA1: 1c289aa264548a0a1f1b43685a9cb2ab23f67287
MD5: dedc747b5c367fbd7f8a7235d1d7cbee
maven: org.apache.james:apache-mime4j-dom:0.7.2 ✓
Description: XZ data compression
License:
Public Domain
File Path: /home/ciagent/.m2/repository/org/tukaani/xz/1.2/xz-1.2.jar
MD5: 04bd31459826c30c2a3c304e3b225ad4
SHA1: bfc66dda280a18ab341b5023248925265c00394c
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest implementation-url http://tukaani.org/xz/java.html Low Vendor file name xz High Vendor pom name XZ for Java High Vendor pom url http://tukaani.org/xz/java.html Highest Vendor pom description XZ data compression Medium Vendor central groupid org.tukaani Highest Vendor pom artifactid xz Low Vendor Manifest bundle-docurl http://tukaani.org/xz/java.html Low Vendor Manifest bundle-symbolicname org.tukaani.xz Medium Vendor pom groupid org.tukaani Highest Vendor pom groupid tukaani Highest Product central artifactid xz Highest Product pom url http://tukaani.org/xz/java.html Medium Product pom name XZ for Java High Product Manifest bundle-docurl http://tukaani.org/xz/java.html Low Product pom artifactid xz Highest Product Manifest bundle-symbolicname org.tukaani.xz Medium Product Manifest Bundle-Name XZ data compression Medium Product Manifest implementation-url http://tukaani.org/xz/java.html Low Product file name xz High Product pom description XZ data compression Medium Product pom groupid tukaani Low Product Manifest Implementation-Title XZ data compression High Version Manifest Implementation-Version 1.2 High Version central version 1.2 Highest Version file version 1.2 Highest Version pom version 1.2 Highest
maven: org.tukaani:xz:1.2 ✓
Confidence :Highest
cpe: cpe:/a:tukaani:xz:1.2
Confidence :Low
suppress
Published Vulnerabilities
CVE-2015-4035 suppress
Severity:
Medium
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.
Vulnerable Software & Versions:
Description:
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/commons/commons-compress/1.5/commons-compress-1.5.jar
MD5: 5e18cfcf472548c2e0b90a4ea1cedf42
SHA1: d2bd2c0bd328f1dabdf33e10b6d223ebcbe93343
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid apache.commons Highest Vendor pom parent-artifactid commons-parent Low Vendor file name commons-compress High Vendor pom groupid org.apache.commons Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest bundle-docurl http://commons.apache.org/compress/ Low Vendor Manifest bundle-symbolicname org.apache.commons.compress Medium Vendor manifest Bundle-Description Apache Commons Compress software defines an API for working with compression and archive formats.These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low Vendor pom artifactid commons-compress Low Vendor pom url http://commons.apache.org/compress/ Highest Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest implementation-build tags/COMPRESS-1.5_RC1@r1455005; 2013-03-11 07:12:20+0100 Low Vendor pom description
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low Vendor Manifest extension-name org.apache.commons.compress Medium Vendor pom name Commons Compress High Vendor central groupid org.apache.commons Highest Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Product Manifest Implementation-Title Commons Compress High Product file name commons-compress High Product Manifest bundle-docurl http://commons.apache.org/compress/ Low Product Manifest Bundle-Name Commons Compress Medium Product Manifest bundle-symbolicname org.apache.commons.compress Medium Product manifest Bundle-Description Apache Commons Compress software defines an API for working with compression and archive formats.These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low Product pom parent-groupid org.apache.commons Low Product Manifest specification-title Commons Compress Medium Product Manifest implementation-build tags/COMPRESS-1.5_RC1@r1455005; 2013-03-11 07:12:20+0100 Low Product pom description
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low Product pom parent-artifactid commons-parent Medium Product pom groupid apache.commons Low Product Manifest extension-name org.apache.commons.compress Medium Product pom name Commons Compress High Product pom artifactid commons-compress Highest Product central artifactid commons-compress Highest Product pom url http://commons.apache.org/compress/ Medium Version file version 1.5 Highest Version pom version 1.5 Highest Version central version 1.5 Highest Version Manifest Implementation-Version 1.5 High
Description: The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs. If the S/MIME API is used, the JavaMail API and the Java activation framework will also be needed.
License:
Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcmail-jdk15/1.45/bcmail-jdk15-1.45.jar
MD5: 13321fc7eff7bcada7b4fedfb592025c
SHA1: 3aed7e642dd8d39dc14ed1dec3ff79e084637148
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name Bouncy Castle CMS and S/MIME API High Vendor pom groupid org.bouncycastle Highest Vendor pom groupid bouncycastle Highest Vendor Manifest extension-name org.bouncycastle.bcmail Medium Vendor central groupid org.bouncycastle Highest Vendor pom description The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider ... Low Vendor Manifest Implementation-Vendor-Id org.bouncycastle Medium Vendor Manifest specification-vendor BouncyCastle.org Low Vendor pom url http://www.bouncycastle.org/java.html Highest Vendor Manifest Implementation-Vendor BouncyCastle.org High Vendor pom artifactid bcmail-jdk15 Low Vendor file name bcmail-jdk15 High Product pom name Bouncy Castle CMS and S/MIME API High Product pom description The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider ... Low Product central artifactid bcmail-jdk15 Highest Product pom url http://www.bouncycastle.org/java.html Medium Product pom artifactid bcmail-jdk15 Highest Product Manifest extension-name org.bouncycastle.bcmail Medium Product file name bcmail-jdk15 High Product pom groupid bouncycastle Low Version central version 1.45 Highest Version pom version 1.45 Highest Version Manifest Implementation-Version 1.45.0 High Version file version 1.45 Highest
Description: The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5.
License:
Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcprov-jdk15/1.45/bcprov-jdk15-1.45.jar
MD5: 2062f8e3d15748443ea60a94b266371c
SHA1: 7741883cb07b4634e8b5fd3337113b6ea770a9bb
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid org.bouncycastle Highest Vendor pom groupid bouncycastle Highest Vendor pom description The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Low Vendor central groupid org.bouncycastle Highest Vendor file name bcprov-jdk15 High Vendor Manifest Implementation-Vendor-Id org.bouncycastle Medium Vendor Manifest specification-vendor BouncyCastle.org Low Vendor pom url http://www.bouncycastle.org/java.html Highest Vendor Manifest Implementation-Vendor BouncyCastle.org High Vendor Manifest extension-name org.bouncycastle.bcprovider Medium Vendor pom name Bouncy Castle Provider High Vendor pom artifactid bcprov-jdk15 Low Product file name bcprov-jdk15 High Product pom url http://www.bouncycastle.org/java.html Medium Product pom artifactid bcprov-jdk15 Highest Product Manifest extension-name org.bouncycastle.bcprovider Medium Product pom name Bouncy Castle Provider High Product pom description The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Low Product pom groupid bouncycastle Low Product central artifactid bcprov-jdk15 Highest Version central version 1.45 Highest Version pom version 1.45 Highest Version Manifest Implementation-Version 1.45.0 High Version file version 1.45 Highest
cpe: cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45
Confidence :Low
suppress
maven: org.bouncycastle:bcprov-jdk15:1.45 ✓
Confidence :Highest
cpe: cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45
Confidence :Low
suppress
Published Vulnerabilities
CVE-2015-7940 suppress
Severity:
Medium
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Vulnerable Software & Versions: (show all )
Description: TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML.
License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/ccil/cowan/tagsoup/tagsoup/1.2.1/tagsoup-1.2.1.jar
MD5: ae73a52cdcbec10cd61d9ef22fab5936
SHA1: 5584627487e984c03456266d3f8802eb85a9ce97
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid ccil.cowan.tagsoup Highest Vendor pom groupid org.ccil.cowan.tagsoup Highest Vendor pom description TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML. Low Vendor central groupid org.ccil.cowan.tagsoup Highest Vendor file name tagsoup High Vendor pom name TagSoup High Vendor pom artifactid tagsoup Low Vendor pom url http://home.ccil.org/~cowan/XML/tagsoup/ Highest Product pom groupid ccil.cowan.tagsoup Low Product central artifactid tagsoup Highest Product pom description TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML. Low Product file name tagsoup High Product pom artifactid tagsoup Highest Product pom name TagSoup High Product pom url http://home.ccil.org/~cowan/XML/tagsoup/ Medium Version central version 1.2.1 Highest Version file version 1.2.1 Highest Version pom version 1.2.1 Highest
File Path: /home/ciagent/.m2/repository/org/ow2/asm/asm-debug-all/4.1/asm-debug-all-4.1.jarMD5: 6c3a8842f484dd3d620002b361e3610eSHA1: dd6ba5c392d4102458494e29f54f70ac534ec2a2
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name ASM Debug All High Vendor Manifest bundle-symbolicname org.objectweb.asm.all.debug Medium Vendor pom artifactid asm-debug-all Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest Implementation-Vendor France Telecom R&D High Vendor central groupid org.ow2.asm Highest Vendor file name asm-debug-all High Vendor pom groupid org.ow2.asm Highest Vendor Manifest bundle-docurl http://asm.objectweb.org Low Vendor pom parent-groupid org.ow2.asm Medium Vendor pom parent-artifactid asm-parent Low Vendor pom groupid ow2.asm Highest Product pom name ASM Debug All High Product Manifest bundle-symbolicname org.objectweb.asm.all.debug Medium Product pom groupid ow2.asm Low Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest Bundle-Name ASM all classes with debug info Medium Product file name asm-debug-all High Product Manifest bundle-docurl http://asm.objectweb.org Low Product pom artifactid asm-debug-all Highest Product pom parent-artifactid asm-parent Medium Product central artifactid asm-debug-all Highest Product Manifest Implementation-Title ASM all classes with debug info High Product pom parent-groupid org.ow2.asm Low Version file version 4.1 Highest Version pom version 4.1 Highest Version central version 4.1 Highest Version Manifest Implementation-Version 4.1 High
Description: The runtime needed to execute a program using AspectJ
License:
Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/ciagent/.m2/repository/org/aspectj/aspectjrt/1.8.8/aspectjrt-1.8.8.jar
MD5: 2e448cd7ae0bdc357cb2b6e892ba9c9d
SHA1: 7c5b26f24375685e34a50c2d765ebc40a96a5280
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid aspectj Highest Vendor pom groupid org.aspectj Highest Vendor manifest: org/aspectj/lang/ Implementation-Vendor aspectj.org Medium Vendor pom description The runtime needed to execute a program using AspectJ Medium Vendor pom artifactid aspectjrt Low Vendor central groupid org.aspectj Highest Vendor file name aspectjrt High Vendor pom url http://www.aspectj.org Highest Vendor pom name AspectJ runtime High Product manifest: org/aspectj/lang/ Implementation-Title org.aspectj.tools Medium Product pom url http://www.aspectj.org Medium Product central artifactid aspectjrt Highest Product pom artifactid aspectjrt Highest Product manifest: org/aspectj/lang/ Specification-Title AspectJ Runtime Classes Medium Product pom description The runtime needed to execute a program using AspectJ Medium Product pom groupid aspectj Low Product file name aspectjrt High Product pom name AspectJ runtime High Version central version 1.8.8 Highest Version pom version 1.8.8 Highest Version file version 1.8.8 Highest
Description: A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)
License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/googlecode/mp4parser/isoparser/1.0-RC-1/isoparser-1.0-RC-1.jar
MD5: b0444fde2290319c9028564c3c3ff1ab
SHA1: 4a5768b1070b9488a433362d736720fd7a7b264f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name isoparser High Vendor pom groupid com.googlecode.mp4parser Highest Vendor pom groupid googlecode.mp4parser Highest Vendor jar package name coremedia Low Vendor pom name ISO Parser High Vendor central groupid com.googlecode.mp4parser Highest Vendor pom description A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)
Medium Vendor jar package name boxes Low Vendor jar package name iso Low Vendor pom url http://code.google.com/p/mp4parser/ Highest Vendor pom artifactid isoparser Low Product file name isoparser High Product pom groupid googlecode.mp4parser Low Product pom url http://code.google.com/p/mp4parser/ Medium Product pom name ISO Parser High Product central artifactid isoparser Highest Product pom description A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)
Medium Product jar package name boxes Low Product pom artifactid isoparser Highest Product jar package name iso Low Version pom version 1.0-RC-1 Highest Version file name isoparser Medium Version central version 1.0-RC-1 Highest Version file version 1.0 Highest
Published Vulnerabilities
CVE-2013-0259 suppress
Severity:
Low
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
Vulnerable Software & Versions: (show all )
Description:
The XMP Library for Java is based on the C++ XMPCore library
and the API is similar.
License:
The BSD License: http://www.adobe.com/devnet/xmp/library/eula-xmp-library-java.html
File Path: /home/ciagent/.m2/repository/com/adobe/xmp/xmpcore/5.1.2/xmpcore-5.1.2.jar
MD5: 0b2cf2a09d32abdedd17de864e93ad25
SHA1: 55615fa2582424e38705487d1d3969af8554f637
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest implementation-micro 1 Low Vendor pom name XMP Library for Java High Vendor pom url http://www.adobe.com/devnet/xmp.html Highest Vendor Manifest implementation-engbuild 003 Low Vendor pom artifactid xmpcore Low Vendor pom groupid com.adobe.xmp Highest Vendor Manifest Implementation-Vendor Copyright 2006-2009 Adobe Systems Incorporated. All rights reserved High Vendor Manifest implementation-minor 1 Low Vendor file name xmpcore High Vendor Manifest implementation-major 5 Low Vendor pom groupid adobe.xmp Highest Vendor Manifest builddate 2012 Jul 03 11:48:46-CEST Low Vendor central groupid com.adobe.xmp Highest Vendor pom description
The XMP Library for Java is based on the C++ XMPCore library
and the API is similar.
Medium Product central artifactid xmpcore Highest Product pom groupid adobe.xmp Low Product Manifest implementation-micro 1 Low Product pom name XMP Library for Java High Product Manifest implementation-engbuild 003 Low Product pom url http://www.adobe.com/devnet/xmp.html Medium Product Manifest implementation-minor 1 Low Product file name xmpcore High Product Manifest Implementation-Title Adobe XMP Core High Product Manifest implementation-major 5 Low Product pom artifactid xmpcore Highest Product Manifest builddate 2012 Jul 03 11:48:46-CEST Low Product pom description
The XMP Library for Java is based on the C++ XMPCore library
and the API is similar.
Medium Version central version 5.1.2 Highest Version file version 5.1.2 Highest Version pom version 5.1.2 Highest
Description:
Xerces2 is the next generation of high performance, fully compliant XML parsers in the
Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI),
a complete framework for building parser components and configurations that is extremely
modular and easy to program.
File Path: /home/ciagent/.m2/repository/xerces/xercesImpl/2.9.1/xercesImpl-2.9.1.jarMD5: f807f86d7d9db25edbfc782aca7ca2a9SHA1: 7bc7e49ddfe4fb5f193ed37ecc96c12292c8ceb6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name xercesImpl High Vendor manifest: javax/xml/transform/ Implementation-Vendor Apache Software Foundation Medium Vendor pom description Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program. Low Vendor pom artifactid xercesImpl Low Vendor pom url http://xerces.apache.org/xerces2-j Highest Vendor manifest: org/apache/xerces/xni/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/datatype/ Implementation-Vendor Apache Software Foundation Medium Vendor central groupid xerces Highest Vendor manifest: org/apache/xerces/impl/Version.class Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/xpath/ Implementation-Vendor Apache Software Foundation Medium Vendor pom groupid xerces Highest Vendor manifest: org/w3c/dom/ Implementation-Vendor World Wide Web Consortium Medium Vendor manifest: org/w3c/dom/ls/ Implementation-Vendor World Wide Web Consortium Medium Vendor pom parent-artifactid apache Low Vendor manifest: javax/xml/validation/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: javax/xml/parsers/ Implementation-Vendor Apache Software Foundation Medium Vendor manifest: org/xml/sax/ Implementation-Vendor David Megginson Medium Vendor pom parent-groupid org.apache Medium Vendor pom name Xerces2 Java Parser High Product manifest: javax/xml/xpath/ Specification-Title Java API for XML Processing Medium Product file name xercesImpl High Product manifest: org/w3c/dom/ls/ Implementation-Title org.w3c.dom.ls Medium Product manifest: javax/xml/transform/ Implementation-Title javax.xml.transform Medium Product manifest: org/apache/xerces/xni/ Implementation-Title org.apache.xerces.xni Medium Product manifest: org/w3c/dom/ Specification-Title Document Object Model, Level 3 Core Medium Product manifest: javax/xml/parsers/ Specification-Title Java API for XML Processing Medium Product manifest: org/apache/xerces/xni/ Specification-Title Xerces Native Interface Medium Product manifest: javax/xml/datatype/ Implementation-Title javax.xml.datatype Medium Product manifest: javax/xml/validation/ Specification-Title Java API for XML Processing Medium Product manifest: org/w3c/dom/ Implementation-Title org.w3c.dom Medium Product pom parent-groupid org.apache Low Product manifest: org/apache/xerces/impl/Version.class Implementation-Title org.apache.xerces.impl.Version Medium Product central artifactid xercesImpl Highest Product pom artifactid xercesImpl Highest Product manifest: javax/xml/validation/ Implementation-Title javax.xml.validation Medium Product manifest: javax/xml/transform/ Specification-Title Java API for XML Processing Medium Product pom url http://xerces.apache.org/xerces2-j Medium Product pom name Xerces2 Java Parser High Product manifest: javax/xml/datatype/ Specification-Title Java API for XML Processing Medium Product pom groupid xerces Low Product pom description Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program. Low Product manifest: org/xml/sax/ Specification-Title Simple API for XML Medium Product manifest: org/xml/sax/ Implementation-Title org.xml.sax Medium Product manifest: javax/xml/parsers/ Implementation-Title javax.xml.parsers Medium Product manifest: javax/xml/xpath/ Implementation-Title javax.xml.xpath Medium Product pom parent-artifactid apache Medium Product manifest: org/w3c/dom/ls/ Specification-Title Document Object Model, Level 3 Load and Save Medium Version file version 2.9.1 Highest Version pom version 2.9.1 Highest Version central version 2.9.1 Highest
Published Vulnerabilities
CVE-2012-0881 suppress
Severity:
High
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Vulnerable Software & Versions:
Description: Java library for reading metadata from image files.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/drewnoakes/metadata-extractor/2.6.2/metadata-extractor-2.6.2.jar
MD5: 8f3acbee87dbd5b0cdfacee3bb3aff8b
SHA1: 13930ff22d3f152bd969a63e88537d2f2adc2cd5
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid metadata-extractor Low Vendor jar package name drew Low Vendor central groupid com.drewnoakes Highest Vendor file name metadata-extractor High Vendor pom description Java library for reading metadata from image files. Medium Vendor pom groupid com.drewnoakes Highest Vendor pom name metadata-extractor High Vendor jar package name metadata Low Vendor pom groupid drewnoakes Highest Vendor pom url http://code.google.com/p/metadata-extractor/ Highest Product pom groupid drewnoakes Low Product file name metadata-extractor High Product pom description Java library for reading metadata from image files. Medium Product central artifactid metadata-extractor Highest Product pom name metadata-extractor High Product jar package name metadata Low Product pom url http://code.google.com/p/metadata-extractor/ Medium Product pom artifactid metadata-extractor Highest Version file version 2.6.2 Highest Version central version 2.6.2 Highest Version pom version 2.6.2 Highest
Description: All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it
easy to work in Java with most syndication formats. Today it accepts all flavors of RSS
(0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes
a set of parsers and generators for the various flavors of feeds, as well as converters
to convert from one format to another. The parsers can give you back Java objects that
are either specific for the format you want to work with, or a generic normalized
SyndFeed object that lets you work on with the data without bothering about the
underlying format.
File Path: /home/ciagent/.m2/repository/rome/rome/1.0/rome-1.0.jarMD5: 53d38c030287b939f4e6d745ba1269a7SHA1: 022b33347f315833e9348cec2751af1a5d5656e4
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid rome Low Vendor Manifest embed-directory META-INF/lib Low Vendor pom groupid rome Highest Vendor Manifest originally-created-by 1.6.0_10 (Sun Microsystems Inc.) Low Vendor file name rome High Vendor Manifest bundle-docurl http://java.sun.com/ Low Vendor manifest Bundle-Description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low Vendor pom organization url http://java.sun.com/ Medium Vendor pom name ROME, RSS and atOM utilitiEs for Java High Vendor central groupid rome Highest Vendor pom organization name Sun Microsystems High Vendor pom description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low Vendor pom url https://rome.dev.java.net/ Highest Vendor Manifest bundle-symbolicname rome.rome Medium Product pom organization url http://java.sun.com/ Low Product Manifest Bundle-Name ROME, RSS and atOM utilitiEs for Java Medium Product pom url https://rome.dev.java.net/ Medium Product Manifest embed-directory META-INF/lib Low Product Manifest originally-created-by 1.6.0_10 (Sun Microsystems Inc.) Low Product file name rome High Product Manifest bundle-docurl http://java.sun.com/ Low Product manifest Bundle-Description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low Product pom name ROME, RSS and atOM utilitiEs for Java High Product pom artifactid rome Highest Product pom groupid rome Low Product pom description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low Product Manifest bundle-symbolicname rome.rome Medium Product pom organization name Sun Microsystems Low Product central artifactid rome Highest Version pom version 1.0 Highest Version file version 1.0 Highest Version central version 1.0 Highest
File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-core/0.1/vorbis-java-core-0.1.jarMD5: b88115be2754cb6883e652ba68ca46c8SHA1: 662a02b94701947e6e66e7793d996043f05fad4a
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.gagravarr Highest Vendor pom url Gagravarr/VorbisJava Highest Vendor jar package name gagravarr Low Vendor pom groupid gagravarr Highest Vendor pom parent-groupid org.gagravarr Medium Vendor pom parent-artifactid vorbis-java-parent Low Vendor pom artifactid vorbis-java-core Low Vendor pom groupid org.gagravarr Highest Vendor file name vorbis-java-core High Vendor pom name Ogg and Vorbis for Java, Core High Product central artifactid vorbis-java-core Highest Product pom parent-groupid org.gagravarr Low Product pom url Gagravarr/VorbisJava High Product pom artifactid vorbis-java-core Highest Product pom groupid gagravarr Low Product pom parent-artifactid vorbis-java-parent Medium Product file name vorbis-java-core High Product pom name Ogg and Vorbis for Java, Core High Version pom version 0.1 Highest Version file version 0.1 Highest Version central version 0.1 Highest
Description: Java port of universalchardet
License:
Mozilla Public License 1.1 (MPL 1.1): http://www.mozilla.org/MPL/MPL-1.1.html
File Path: /home/ciagent/.m2/repository/com/googlecode/juniversalchardet/juniversalchardet/1.0.3/juniversalchardet-1.0.3.jar
MD5: d9ea0a9a275336c175b343f2e4cd8f27
SHA1: cd49678784c46aa8789c060538e0154013bb421b
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name juniversalchardet High Vendor pom artifactid juniversalchardet Low Vendor jar package name universalchardet Low Vendor central groupid com.googlecode.juniversalchardet High Vendor central groupid org.zenframework.z8.dependencies.commons High Vendor pom url http://juniversalchardet.googlecode.com/ Highest Vendor jar package name prober Low Vendor pom groupid googlecode.juniversalchardet Highest Vendor pom description Java port of universalchardet Medium Vendor file name juniversalchardet High Vendor jar package name mozilla Low Vendor pom groupid com.googlecode.juniversalchardet Highest Product pom artifactid juniversalchardet Highest Product pom url http://juniversalchardet.googlecode.com/ Medium Product pom name juniversalchardet High Product central artifactid juniversalchardet-1.0.3 High Product pom description Java port of universalchardet Medium Product pom groupid googlecode.juniversalchardet Low Product jar package name universalchardet Low Product file name juniversalchardet High Product jar package name prober Low Product central artifactid juniversalchardet High Version file version 1.0.3 Highest Version pom version 1.0.3 Highest Version central version 2.0 High Version central version 1.0.3 High
Description:
JHighlight is an embeddable pure Java syntax highlighting
library that supports Java, HTML, XHTML, XML and LZX
languages and outputs to XHTML.
It also supports RIFE templates tags and highlights them
clearly so that you can easily identify the difference
between your RIFE markup and the actual marked up source.
License:
CDDL, v1.0: http://www.opensource.org/licenses/cddl1.php
LGPL, v2.1 or later: http://www.opensource.org/licenses/lgpl-license.php
File Path: /home/ciagent/.m2/repository/com/uwyn/jhighlight/1.0/jhighlight-1.0.jar
MD5: 0ad5cf1bc56657f5e9e327e5e768da0a
SHA1: 0b1774029ee29472df8c25e5ba796431f7689fd6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom organization url http://uwyn.com/ Medium Vendor pom artifactid jhighlight Low Vendor jar package name jhighlight Low Vendor jar package name uwyn Low Vendor pom organization name Uwyn High Vendor file name jhighlight High Vendor pom groupid com.uwyn Highest Vendor central groupid com.uwyn Highest Vendor pom groupid uwyn Highest Vendor pom name JHighlight High Vendor pom description JHighlight is an embeddable pure Java syntax highlighting library that supports Java, HTML, XHTML, XML and LZX languages and outputs to XHTML. It also supports RIFE templates tags and highlights them clearly so that you can easily identify the difference between your RIFE markup and the actual marked up source. Low Vendor pom url https://jhighlight.dev.java.net/ Highest Product jar package name jhighlight Low Product pom groupid uwyn Low Product pom artifactid jhighlight Highest Product pom organization url http://uwyn.com/ Low Product pom url https://jhighlight.dev.java.net/ Medium Product central artifactid jhighlight Highest Product pom name JHighlight High Product file name jhighlight High Product pom organization name Uwyn Low Product pom description JHighlight is an embeddable pure Java syntax highlighting library that supports Java, HTML, XHTML, XML and LZX languages and outputs to XHTML. It also supports RIFE templates tags and highlights them clearly so that you can easily identify the difference between your RIFE markup and the actual marked up source. Low Version pom version 1.0 Highest Version file version 1.0 Highest Version central version 1.0 Highest
Description: XmlBeans main jar
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/xmlbeans/xmlbeans/2.6.0/xmlbeans-2.6.0.jar
MD5: 6591c08682d613194dacb01e95c78c2c
SHA1: 29e80d2dd51f9dcdef8f9ffaee0d4dc1c9bbfc87
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.apache.xmlbeans Highest Vendor pom name XmlBeans High Vendor pom description XmlBeans main jar Medium Vendor pom artifactid xmlbeans Low Vendor pom organization url http://xmlbeans.apache.org/ Medium Vendor pom url http://xmlbeans.apache.org Highest Vendor file name xmlbeans High Vendor pom groupid apache.xmlbeans Highest Vendor manifest: org/apache/xmlbeans/ Implementation-Vendor Apache Software Foundation Medium Vendor pom organization name XmlBeans High Vendor pom groupid org.apache.xmlbeans Highest Product pom artifactid xmlbeans Highest Product pom name XmlBeans High Product pom description XmlBeans main jar Medium Product manifest: org/apache/xmlbeans/ Implementation-Title org.apache.xmlbeans Medium Product pom url http://xmlbeans.apache.org Medium Product file name xmlbeans High Product pom groupid apache.xmlbeans Low Product pom organization name XmlBeans Low Product pom organization url http://xmlbeans.apache.org/ Low Product central artifactid xmlbeans Highest Version pom version 2.6.0 Highest Version central version 2.6.0 Highest Version file version 2.6.0 Highest
Description: Implementation of Document Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.document/5.3.x-SNAPSHOT/exo.core.component.document-5.3.x-SNAPSHOT.jarMD5: 1364b2ed6792028c60be14c6f02c75a3SHA1: e58848ed577e46c5dbe3e8c2c94e6f65ddadfbaa
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name eXo PLF Core :: Component :: Document Service High Vendor file name exo.core.component.document High Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid exoplatform.core Highest Vendor pom groupid org.exoplatform.core Highest Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid core-parent Low Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium Vendor pom description Implementation of Document Service of Exoplatform SAS 'eXo Core' project. Medium Vendor pom parent-groupid org.exoplatform.core Medium Vendor pom artifactid exo.core.component.document Low Product pom name eXo PLF Core :: Component :: Document Service High Product pom parent-groupid org.exoplatform.core Low Product file name exo.core.component.document High Product Manifest specification-title exo-core Medium Product pom groupid exoplatform.core Low Product Manifest Implementation-Title eXo PLF Core :: Component :: Document Service High Product pom parent-artifactid core-parent Medium Product pom description Implementation of Document Service of Exoplatform SAS 'eXo Core' project. Medium Product pom artifactid exo.core.component.document Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.document:5.3.x-SNAPSHOT
Confidence :High
Description: Apache Lucene Java Core
File Path: /home/ciagent/.m2/repository/org/apache/lucene/lucene-core/3.6.2/lucene-core-3.6.2.jarMD5: ee396d04f5a35557b424025f5382c815SHA1: 9ec77e2507f9cc01756964c71d91efd8154a8c47
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest extension-name org.apache.lucene Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid lucene-core Low Vendor central groupid org.apache.lucene Highest Vendor pom groupid apache.lucene Highest Vendor pom description Apache Lucene Java Core Medium Vendor file name lucene-core High Vendor pom groupid org.apache.lucene Highest Vendor pom name Lucene Core High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.lucene Medium Vendor pom parent-artifactid lucene-parent Low Product Manifest extension-name org.apache.lucene Medium Product central artifactid lucene-core Highest Product pom description Apache Lucene Java Core Medium Product file name lucene-core High Product pom groupid apache.lucene Low Product pom parent-groupid org.apache.lucene Low Product Manifest Implementation-Title org.apache.lucene High Product pom name Lucene Core High Product pom artifactid lucene-core Highest Product pom parent-artifactid lucene-parent Medium Product Manifest specification-title Lucene Search Engine: core Medium Version central version 3.6.2 Highest Version file version 3.6.2 Highest Version pom version 3.6.2 Highest
Description: Additional Analyzers
File Path: /home/ciagent/.m2/repository/org/apache/lucene/lucene-analyzers/3.6.2/lucene-analyzers-3.6.2.jarMD5: 13f8241b6991bd1349c05369a7c0f002SHA1: 3a083510dcb0d0fc67f8456cdac6f48aa0da2993
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest extension-name org.apache.lucene Medium Vendor pom description Additional Analyzers Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor central groupid org.apache.lucene Highest Vendor pom groupid apache.lucene Highest Vendor file name lucene-analyzers High Vendor pom name Lucene Common Analyzers High Vendor pom groupid org.apache.lucene Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.lucene Medium Vendor pom artifactid lucene-analyzers Low Vendor pom parent-artifactid lucene-parent Low Product file name lucene-analyzers High Product Manifest extension-name org.apache.lucene Medium Product pom name Lucene Common Analyzers High Product pom description Additional Analyzers Medium Product Manifest specification-title Lucene Search Engine: analyzers Medium Product pom groupid apache.lucene Low Product pom parent-groupid org.apache.lucene Low Product pom artifactid lucene-analyzers Highest Product Manifest Implementation-Title org.apache.lucene High Product pom parent-artifactid lucene-parent Medium Product central artifactid lucene-analyzers Highest Version central version 3.6.2 Highest Version file version 3.6.2 Highest Version pom version 3.6.2 Highest
Description: Spell Checker
File Path: /home/ciagent/.m2/repository/org/apache/lucene/lucene-spellchecker/3.6.2/lucene-spellchecker-3.6.2.jarMD5: a4b684913f93aea76f5dbd7e479f19c5SHA1: 15db0c0cfee44e275f15ad046e46b9a05910ad24
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest extension-name org.apache.lucene Medium Vendor pom description Spell Checker Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor central groupid org.apache.lucene Highest Vendor pom groupid apache.lucene Highest Vendor pom name Lucene Spellchecker High Vendor pom groupid org.apache.lucene Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.lucene Medium Vendor pom artifactid lucene-spellchecker Low Vendor pom parent-artifactid lucene-parent Low Vendor file name lucene-spellchecker High Product pom name Lucene Spellchecker High Product Manifest extension-name org.apache.lucene Medium Product pom description Spell Checker Medium Product pom artifactid lucene-spellchecker Highest Product pom groupid apache.lucene Low Product pom parent-groupid org.apache.lucene Low Product Manifest Implementation-Title org.apache.lucene High Product pom parent-artifactid lucene-parent Medium Product Manifest specification-title Lucene Search Engine: spellchecker Medium Product file name lucene-spellchecker High Product central artifactid lucene-spellchecker Highest Version central version 3.6.2 Highest Version file version 3.6.2 Highest Version pom version 3.6.2 Highest
Description:
The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation.
File Path: /home/ciagent/.m2/repository/javax/transaction/jta/1.1/jta-1.1.jarMD5: 82a10ce714f411b28f13850059de09eeSHA1: 2ca09f0b36ca7d71b762e14ea2ff09d5eac57558
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid jta Low Vendor Manifest extension-name javax.transaction Medium Vendor central groupid javax.transaction High Vendor pom url http://java.sun.com/products/jta Highest Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom groupid javax.transaction Highest Vendor pom name Java Transaction API High Vendor pom description The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation. Low Vendor file name jta High Product Manifest extension-name javax.transaction Medium Product pom artifactid jta Highest Product Manifest specification-title Java Transaction API Specification Medium Product pom groupid javax.transaction Low Product pom url http://java.sun.com/products/jta Medium Product pom name Java Transaction API High Product central artifactid transaction-api High Product pom description The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation. Low Product file name jta High Product central artifactid jta High Version pom version 1.1 Highest Version central version 1.1 High Version file version 1.1 Highest
License:
Public domain, Sun Microsoystems: >http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html
File Path: /home/ciagent/.m2/repository/concurrent/concurrent/1.3.4/concurrent-1.3.4.jar
MD5: f29b9d930d3426ebc56919eba10fbd4d
SHA1: 1cf394c2a388199db550cda311174a4c6a7d117c
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid concurrent Highest Vendor file name concurrent High Vendor jar package name cs Low Vendor pom organization url http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html Medium Vendor jar package name oswego Low Vendor jar package name edu Low Vendor pom name Dough Lea's util.concurrent package High Vendor pom groupid concurrent Highest Vendor pom artifactid concurrent Low Vendor pom organization name Dough Lea High Product file name concurrent High Product jar package name cs Low Product jar package name oswego Low Product pom groupid concurrent Low Product pom artifactid concurrent Highest Product jar package name dl Low Product pom name Dough Lea's util.concurrent package High Product pom organization url http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html Low Product central artifactid concurrent Highest Product pom organization name Dough Lea Low Version file version 1.3.4 Highest Version pom version 1.3.4 Highest Version central version 1.3.4 Highest
Description: Types that extend and augment the Java Collections Framework.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor Manifest bundle-symbolicname org.apache.commons.collections Medium Vendor pom artifactid commons-collections Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom url http://commons.apache.org/collections/ Highest Vendor pom groupid commons-collections Highest Vendor central groupid commons-collections Highest Vendor Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom description Types that extend and augment the Java Collections Framework. Medium Vendor Manifest implementation-url http://commons.apache.org/collections/ Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low Vendor file name commons-collections High Vendor Manifest bundle-docurl http://commons.apache.org/collections/ Low Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom name Apache Commons Collections High Vendor manifest Bundle-Description Types that extend and augment the Java Collections Framework. Medium Product Manifest specification-title Apache Commons Collections Medium Product Manifest bundle-symbolicname org.apache.commons.collections Medium Product Manifest Implementation-Title Apache Commons Collections High Product pom url http://commons.apache.org/collections/ Medium Product Manifest Bundle-Name Apache Commons Collections Medium Product pom parent-groupid org.apache.commons Low Product Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low Product pom description Types that extend and augment the Java Collections Framework. Medium Product pom artifactid commons-collections Highest Product Manifest implementation-url http://commons.apache.org/collections/ Low Product pom parent-artifactid commons-parent Medium Product pom groupid commons-collections Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low Product central artifactid commons-collections Highest Product file name commons-collections High Product Manifest bundle-docurl http://commons.apache.org/collections/ Low Product pom name Apache Commons Collections High Product manifest Bundle-Description Types that extend and augment the Java Collections Framework. Medium Version file version 3.2.2 Highest Version central version 3.2.2 Highest Version Manifest Implementation-Version 3.2.2 High Version pom version 3.2.2 Highest
Description:
Reliable cluster communication toolkit
License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/org/jgroups/jgroups/3.6.13.Final/jgroups-3.6.13.Final.jar
MD5: d7a4d1065e9b09e3f48bfa88ab368a0c
SHA1: 1315a8a1aed98dcafc11a850957ced42dc26bf18
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid org.jgroups Highest Vendor file name jgroups High Vendor pom groupid jgroups Highest Vendor central groupid org.jgroups Highest Vendor pom url http://www.jgroups.org Highest Vendor pom artifactid jgroups Low Vendor Manifest bundle-symbolicname org.jgroups Medium Vendor pom description
Reliable cluster communication toolkit
Medium Vendor pom organization name JBoss, a division of Red Hat High Vendor Manifest bundle-docurl http://www.jboss.org Low Vendor pom name JGroups High Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low Vendor pom organization url http://www.jboss.org Medium Vendor manifest Bundle-Description Ant/ivy based build.xml file for JGroups. Needs ant to run Medium Product file name jgroups High Product pom organization name JBoss, a division of Red Hat Low Product central artifactid jgroups Highest Product Manifest Bundle-Name JGroups Medium Product pom artifactid jgroups Highest Product Manifest bundle-symbolicname org.jgroups Medium Product pom description
Reliable cluster communication toolkit
Medium Product pom groupid jgroups Low Product Manifest bundle-docurl http://www.jboss.org Low Product pom name JGroups High Product pom url http://www.jgroups.org Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low Product pom organization url http://www.jboss.org Low Product manifest Bundle-Description Ant/ivy based build.xml file for JGroups. Needs ant to run Medium Version pom version 3.6.13.Final Highest Version central version 3.6.13.Final Highest Version file version 3.6.13 Highest Version Manifest Implementation-Version 3.6.13.Final High
Description: JBossTS - JBoss Transaction Service. JTA, JTS and XTS (WS-AT, WS-BA)
License:
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/jboss/jbossts/jbossjta/4.16.6.Final/jbossjta-4.16.6.Final.jar
MD5: 9e3c8d7d93b92ab97489aeb5816370c8
SHA1: 99e79e03ced180bea4e3307511d350eb2b88c91c
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name JBossTS jbossjta High Vendor file name jbossjta High Vendor pom url http://www.jboss.org/jbosstm/ Highest Vendor central groupid org.jboss.jbossts Highest Vendor Manifest arjuna-properties-file jbossts-properties.xml Low Vendor pom description JBossTS - JBoss Transaction Service. JTA, JTS and XTS (WS-AT, WS-BA) Medium Vendor pom artifactid jbossjta Low Vendor pom groupid jboss.jbossts Highest Vendor pom groupid org.jboss.jbossts Highest Vendor Manifest arjuna-builder JBoss Inc. [tom] Linux 3.4.11-1.fc16.x86_64 2012/Oct/02 15:05 Low Product pom name JBossTS jbossjta High Product file name jbossjta High Product Manifest arjuna-properties-file jbossts-properties.xml Low Product pom description JBossTS - JBoss Transaction Service. JTA, JTS and XTS (WS-AT, WS-BA) Medium Product pom url http://www.jboss.org/jbosstm/ Medium Product pom artifactid jbossjta Highest Product central artifactid jbossjta Highest Product pom groupid jboss.jbossts Low Product Manifest arjuna-builder JBoss Inc. [tom] Linux 3.4.11-1.fc16.x86_64 2012/Oct/02 15:05 Low Version pom version 4.16.6.Final Highest Version central version 4.16.6.Final Highest Version file version 4.16.6 Highest
Description: This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/ws/commons/ws-commons-util/1.0.1/ws-commons-util-1.0.1.jar
MD5: 66919d22287ddab742a135da764c2cd6
SHA1: 126e80ff798fece634bc94e61f8be8a8da00be60
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom url http://ws.apache.org/commons/util Highest Vendor pom groupid apache.ws.commons Highest Vendor Manifest Implementation-Vendor Apache Software Foundation High Vendor pom name Apache WebServices Common Utilities High Vendor central groupid ws-commons-util High Vendor file name ws-commons-util High Vendor pom organization url http://www.apache.org/ Medium Vendor pom artifactid ws-commons-util Low Vendor Manifest extension-name ws-commons-util Medium Vendor pom groupid org.apache.ws.commons Highest Vendor pom description This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced. Low Vendor pom organization name Apache Software Foundation High Vendor Manifest specification-vendor Apache Software Foundation Low Vendor central groupid org.apache.ws.commons High Product Manifest specification-title This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced. Medium Product pom organization name Apache Software Foundation Low Product pom url http://ws.apache.org/commons/util Medium Product pom groupid apache.ws.commons Low Product pom organization url http://www.apache.org/ Low Product pom name Apache WebServices Common Utilities High Product file name ws-commons-util High Product pom artifactid ws-commons-util Highest Product Manifest extension-name ws-commons-util Medium Product central artifactid ws-commons-util High Product pom description This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced. Low Product Manifest Implementation-Title ws-commons-util High Version file version 1.0.1 Highest Version Manifest Implementation-Version 1.0.1 High Version central version 1.0.1 High Version pom version 1.0.1 Highest
Published Vulnerabilities
CVE-2016-10542 suppress
Severity:
Medium
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Vulnerable Software & Versions:
Description: JBoss Common Core Utility classes
File Path: /home/ciagent/.m2/repository/org/jboss/jboss-common-core/2.2.22.GA/jboss-common-core-2.2.22.GA.jarMD5: 8c415e1467075a90045a7b0fd19886a3SHA1: ae1a22412d879c4ac48e35cf00f438bb263d41c3
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.jboss Highest Vendor pom parent-groupid org.jboss Medium Vendor pom description JBoss Common Core Utility classes Medium Vendor Manifest specification-vendor JBoss, a division of Red Hat, Inc. Low Vendor Manifest Implementation-Vendor JBoss, a division of Red Hat, Inc. High Vendor file name jboss-common-core High Vendor Manifest Implementation-Vendor-Id org.jboss Medium Vendor pom url http://www.jboss.org/jboss-common Highest Vendor pom groupid org.jboss Highest Vendor Manifest implementation-url http://www.jboss.org/jboss-common Low Vendor pom artifactid jboss-common-core Low Vendor pom name JBoss Common Classes High Vendor pom parent-artifactid jboss-parent Low Vendor pom groupid jboss Highest Product Manifest Implementation-Title JBoss Common Classes High Product pom description JBoss Common Core Utility classes Medium Product pom url http://www.jboss.org/jboss-common Medium Product file name jboss-common-core High Product pom groupid jboss Low Product pom parent-artifactid jboss-parent Medium Product Manifest specification-title JBoss Common Classes Medium Product Manifest implementation-url http://www.jboss.org/jboss-common Low Product pom parent-groupid org.jboss Low Product pom name JBoss Common Classes High Product central artifactid jboss-common-core Highest Product pom artifactid jboss-common-core Highest Version file version 2.2.22 Highest Version pom version 2.2.22.GA Highest Version Manifest Implementation-Version 2.2.22.GA High Version central version 2.2.22.GA Highest
Description: StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output.
StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization.
It evolved over years of effort developing jGuru.com.
StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic
is that unlike other engines, it strictly enforces model-view separation.
Strict separation makes websites and code generators more flexible
and maintainable; it also provides an excellent defense against malicious
template authors.
There are currently about 600 StringTemplate source downloads a month.
License:
BSD licence: http://antlr.org/license.html
File Path: /home/ciagent/.m2/repository/org/antlr/stringtemplate/3.2.1/stringtemplate-3.2.1.jar
MD5: b58ca53e518a92a1991eb63b61917582
SHA1: 59ec8083721eae215c6f3caee944c410d2be34de
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name stringtemplate Low Vendor pom groupid org.antlr Highest Vendor pom artifactid stringtemplate Low Vendor jar package name language Low Vendor central groupid org.antlr Highest Vendor file name stringtemplate High Vendor pom url http://www.stringtemplate.org Highest Vendor pom description StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output. StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization. It evolved over years of effort developing jGuru.com. StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic is that un... Low Vendor jar package name antlr Low Vendor pom groupid antlr Highest Vendor pom name ANTLR StringTemplate High Product jar package name stringtemplate Low Product jar package name language Low Product file name stringtemplate High Product pom url http://www.stringtemplate.org Medium Product central artifactid stringtemplate Highest Product pom description StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output. StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization. It evolved over years of effort developing jGuru.com. StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic is that un... Low Product pom groupid antlr Low Product pom artifactid stringtemplate Highest Product pom name ANTLR StringTemplate High Version pom version 3.2.1 Highest Version central version 3.2.1 Highest Version file version 3.2.1 Highest
Description: A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
File Path: /home/ciagent/.m2/repository/org/antlr/antlr-runtime/3.5/antlr-runtime-3.5.jarMD5: aa6d7c8b425df59f5f5bc98c58cfd9fcSHA1: 0baa82bff19059401e90e1b90020beb9c96305d7
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-groupid org.antlr Medium Vendor pom groupid org.antlr Highest Vendor central groupid org.antlr Highest Vendor file name antlr-runtime High Vendor pom name ANTLR 3 Runtime High Vendor pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low Vendor pom url http://www.antlr.org Highest Vendor pom artifactid antlr-runtime Low Vendor pom parent-artifactid antlr-master Low Vendor Manifest Implementation-Vendor-Id org.antlr Medium Vendor Manifest Implementation-Vendor ANTLR High Vendor pom groupid antlr Highest Product pom parent-artifactid antlr-master Medium Product file name antlr-runtime High Product pom name ANTLR 3 Runtime High Product pom parent-groupid org.antlr Low Product central artifactid antlr-runtime Highest Product pom groupid antlr Low Product pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low Product pom url http://www.antlr.org Medium Product pom artifactid antlr-runtime Highest Product Manifest Implementation-Title ANTLR 3 Runtime High Version pom version 3.5 Highest Version central version 3.5 Highest Version Manifest Implementation-Version 3.5 High Version file version 3.5 Highest
Description: Implementation of Core Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/jcr/exo.jcr.component.core/5.3.x-SNAPSHOT/exo.jcr.component.core-5.3.x-SNAPSHOT.jarMD5: 60ca201c9b18e1f13c455c67d6f508d9SHA1: 86c9d3b52fbfc2e2c3352c21e31d72ea95c48121
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name exo.jcr.component.core High Vendor pom parent-groupid org.exoplatform.jcr Medium Vendor Manifest Implementation-Vendor-Id org.exoplatform.jcr Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom description Implementation of Core Service of Exoplatform SAS 'eXo Core' project. Medium Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid jcr-parent Low Vendor pom name eXo PLF:: JCR :: Component :: Core Service High Vendor pom groupid exoplatform.jcr Highest Vendor pom groupid org.exoplatform.jcr Highest Vendor pom artifactid exo.jcr.component.core Low Product pom parent-groupid org.exoplatform.jcr Low Product file name exo.jcr.component.core High Product pom description Implementation of Core Service of Exoplatform SAS 'eXo Core' project. Medium Product pom artifactid exo.jcr.component.core Highest Product Manifest specification-title exo-jcr Medium Product pom groupid exoplatform.jcr Low Product pom name eXo PLF:: JCR :: Component :: Core Service High Product Manifest Implementation-Title eXo PLF:: JCR :: Component :: Core Service High Product pom parent-artifactid jcr-parent Medium Version pom version 5.3.x-20190428.133231-15 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.jcr:exo.jcr.component.core:5.3.x-SNAPSHOT
Confidence :High
Description:
JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be
used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the
document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML.
License:
Java HTML Tidy License: http://jtidy.svn.sourceforge.net/viewvc/jtidy/trunk/jtidy/LICENSE.txt?revision=95
File Path: /home/ciagent/.m2/repository/net/sf/jtidy/jtidy/r938/jtidy-r938.jar
MD5: 6a9121561b8f98c0a8fb9b6e57f50e6b
SHA1: ab08d87a225a715a69107732b67f21e1da930349
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom organization url http://sourceforge.net Medium Vendor pom name JTidy High Vendor central groupid net.sf.jtidy Highest Vendor pom organization name sourceforge High Vendor pom description JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML. Low Vendor jar package name w3c Low Vendor jar package name tidy Low Vendor pom url http://jtidy.sourceforge.net Highest Vendor pom artifactid jtidy Low Vendor file name jtidy-r938 High Vendor pom groupid net.sf.jtidy Highest Product pom name JTidy High Product pom organization url http://sourceforge.net Low Product pom artifactid jtidy Highest Product pom description JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML. Low Product central artifactid jtidy Highest Product jar package name tidy Low Product pom groupid net.sf.jtidy Low Product file name jtidy-r938 High Product pom organization name sourceforge Low Product pom url http://jtidy.sourceforge.net Medium Version pom version r938 Highest Version file name jtidy-r938 Medium Version file version 938 Medium Version central version r938 Highest
Description: Implementation of XML Processing Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.xml-processing/5.3.x-SNAPSHOT/exo.core.component.xml-processing-5.3.x-SNAPSHOT.jarMD5: 3da8f81f0f9d15248c08d3ac1cc7255dSHA1: 715b0d98642f93a9de722de2b62d7bda479c1551
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid exo.core.component.xml-processing Low Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid exoplatform.core Highest Vendor pom groupid org.exoplatform.core Highest Vendor file name exo.core.component.xml-processing High Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid core-parent Low Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium Vendor pom name eXo PLF Core :: Component :: XML Processing Service High Vendor pom parent-groupid org.exoplatform.core Medium Vendor pom description Implementation of XML Processing Service of Exoplatform SAS 'eXo Core' project. Medium Product Manifest Implementation-Title eXo PLF Core :: Component :: XML Processing Service High Product pom parent-groupid org.exoplatform.core Low Product pom artifactid exo.core.component.xml-processing Highest Product Manifest specification-title exo-core Medium Product pom groupid exoplatform.core Low Product file name exo.core.component.xml-processing High Product pom parent-artifactid core-parent Medium Product pom name eXo PLF Core :: Component :: XML Processing Service High Product pom description Implementation of XML Processing Service of Exoplatform SAS 'eXo Core' project. Medium Version file version 5.3 Highest Version pom version 5.3.x-20190428.125357-14 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
cpe: cpe:/a:processing:processing:5.3
Confidence :Low
suppress
maven: org.exoplatform.core:exo.core.component.xml-processing:5.3.x-SNAPSHOT
Confidence :High
Description: Groovy: A powerful, dynamic language for the JVM
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/codehaus/groovy/groovy-all/2.4.12/groovy-all-2.4.12.jar
MD5: dddb0b3d3619875fa1c538c743ae8f99
SHA1: 760afc568cbd94c09d78f801ce51aed1326710af
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-symbolicname groovy-all Medium Vendor pom groupid codehaus.groovy Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom name Apache Groovy High Vendor pom url http://groovy-lang.org Highest Vendor central groupid org.codehaus.groovy Highest Vendor manifest Bundle-Description Groovy Runtime Medium Vendor pom groupid org.codehaus.groovy Highest Vendor pom description Groovy: A powerful, dynamic language for the JVM Medium Vendor file name groovy-all High Vendor pom organization name Apache Software Foundation High Vendor pom artifactid groovy-all Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest extension-name groovy Medium Vendor pom organization url http://groovy-lang.org Medium Vendor Manifest originally-created-by 1.8.0_131-b11 (Oracle Corporation) Low Product Manifest bundle-symbolicname groovy-all Medium Product central artifactid groovy-all Highest Product pom organization name Apache Software Foundation Low Product pom name Apache Groovy High Product pom organization url http://groovy-lang.org Low Product manifest Bundle-Description Groovy Runtime Medium Product pom artifactid groovy-all Highest Product Manifest Bundle-Name Groovy Runtime Medium Product pom groupid codehaus.groovy Low Product Manifest Implementation-Title Groovy: a powerful, dynamic language for the JVM High Product pom description Groovy: A powerful, dynamic language for the JVM Medium Product file name groovy-all High Product Manifest specification-title Groovy: a powerful, dynamic language for the JVM Medium Product Manifest extension-name groovy Medium Product pom url http://groovy-lang.org Medium Product Manifest originally-created-by 1.8.0_131-b11 (Oracle Corporation) Low Version central version 2.4.12 Highest Version Manifest Implementation-Version 2.4.12 High Version file version 2.4.12 Highest Version pom version 2.4.12 Highest
Description: Groovy Scripts Instantiator of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.script.groovy/5.3.x-SNAPSHOT/exo.core.component.script.groovy-5.3.x-SNAPSHOT.jarMD5: 759ed4b71d50210942334982fe18449dSHA1: 4aff5d49026b468feec0a891339d251b6624174d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid exo.core.component.script.groovy Low Vendor file name exo.core.component.script.groovy High Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid exoplatform.core Highest Vendor pom groupid org.exoplatform.core Highest Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid core-parent Low Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium Vendor pom parent-groupid org.exoplatform.core Medium Vendor pom name eXo PLF Core :: Component :: Groovy Scripts Instantiator High Vendor pom description Groovy Scripts Instantiator of Exoplatform SAS 'eXo Core' project. Medium Product pom parent-groupid org.exoplatform.core Low Product file name exo.core.component.script.groovy High Product Manifest specification-title exo-core Medium Product pom groupid exoplatform.core Low Product Manifest Implementation-Title eXo PLF Core :: Component :: Groovy Scripts Instantiator High Product pom parent-artifactid core-parent Medium Product pom name eXo PLF Core :: Component :: Groovy Scripts Instantiator High Product pom description Groovy Scripts Instantiator of Exoplatform SAS 'eXo Core' project. Medium Product pom artifactid exo.core.component.script.groovy Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-20190428.125412-14 Highest Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.core:exo.core.component.script.groovy:5.3.x-SNAPSHOT
Confidence :High
Description: Implementation of Commons Utils for Exoplatform SAS 'Web Services' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.commons/5.3.x-SNAPSHOT/exo.ws.commons-5.3.x-SNAPSHOT.jarMD5: 6ac7df0529f74e5544bd292deffdb803SHA1: bc75df0e3384d8ac9d610eaa2b0a6b238ebdd3b5
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.ws Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid org.exoplatform.ws Highest Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom artifactid exo.ws.commons Low Vendor pom groupid exoplatform.ws Highest Vendor pom parent-artifactid ws-parent Low Vendor pom name eXo PLF:: WS :: Commons Utils High Vendor file name exo.ws.commons High Vendor pom parent-groupid org.exoplatform.ws Medium Vendor pom description Implementation of Commons Utils for Exoplatform SAS 'Web Services' project. Medium Product Manifest specification-title exo-ws Medium Product pom parent-groupid org.exoplatform.ws Low Product pom groupid exoplatform.ws Low Product pom artifactid exo.ws.commons Highest Product pom parent-artifactid ws-parent Medium Product pom name eXo PLF:: WS :: Commons Utils High Product Manifest Implementation-Title eXo PLF:: WS :: Commons Utils High Product file name exo.ws.commons High Product pom description Implementation of Commons Utils for Exoplatform SAS 'Web Services' project. Medium Version pom version 5.3.x-20190428.130151-16 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
cpe: cpe:/a:ws_project:ws:5.3.20190428
Confidence :Low
suppress
maven: org.exoplatform.ws:exo.ws.commons:5.3.x-SNAPSHOT
Confidence :High
Description:
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar
MD5: dd77e787b7b5dc56f6a1cb658716d55d
SHA1: 04ff14d809195b711fd6bcc87e6777f886730ca1
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor manifest Bundle-Description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest implementation-build UNKNOWN@r18734e9f77a267ebc82ff2ffce6d96e82a34260f; 2017-06-09 22:59:50+0000 Low Vendor pom artifactid commons-fileupload Low Vendor pom url http://commons.apache.org/proper/commons-fileupload/ Highest Vendor Manifest bundle-symbolicname org.apache.commons.fileupload Medium Vendor pom name Apache Commons FileUpload High Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor central groupid commons-fileupload Highest Vendor Manifest implementation-url http://commons.apache.org/proper/commons-fileupload/ Low Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-fileupload/ Low Vendor pom groupid commons-fileupload Highest Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor file name commons-fileupload High Vendor pom description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Product manifest Bundle-Description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Product Manifest implementation-build UNKNOWN@r18734e9f77a267ebc82ff2ffce6d96e82a34260f; 2017-06-09 22:59:50+0000 Low Product central artifactid commons-fileupload Highest Product Manifest bundle-symbolicname org.apache.commons.fileupload Medium Product Manifest specification-title Apache Commons FileUpload Medium Product pom parent-groupid org.apache.commons Low Product pom name Apache Commons FileUpload High Product pom groupid commons-fileupload Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product pom artifactid commons-fileupload Highest Product pom parent-artifactid commons-parent Medium Product Manifest Bundle-Name Apache Commons FileUpload Medium Product Manifest Implementation-Title Apache Commons FileUpload High Product Manifest implementation-url http://commons.apache.org/proper/commons-fileupload/ Low Product Manifest bundle-docurl http://commons.apache.org/proper/commons-fileupload/ Low Product file name commons-fileupload High Product pom url http://commons.apache.org/proper/commons-fileupload/ Medium Product pom description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low Version file version 1.3.3 Highest Version central version 1.3.3 Highest Version Manifest Implementation-Version 1.3.3 High Version pom version 1.3.3 Highest
Description: Implementation of REST Core for Exoplatform SAS 'Web Services' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.rest.core/5.3.x-SNAPSHOT/exo.ws.rest.core-5.3.x-SNAPSHOT.jarMD5: 19ff04cc66e3fa02c05ce87f410cb36aSHA1: d0402ed1d2aabf4ed5e50c00da5c86fe659f15ae
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name exo.ws.rest.core High Vendor pom description Implementation of REST Core for Exoplatform SAS 'Web Services' project. Medium Vendor Manifest Implementation-Vendor-Id org.exoplatform.ws Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid org.exoplatform.ws Highest Vendor pom name eXo PLF:: WS :: REST :: Core High Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom groupid exoplatform.ws Highest Vendor pom artifactid exo.ws.rest.core Low Vendor pom parent-artifactid ws-parent Low Vendor pom parent-groupid org.exoplatform.ws Medium Product file name exo.ws.rest.core High Product Manifest Implementation-Title eXo PLF:: WS :: REST :: Core High Product pom description Implementation of REST Core for Exoplatform SAS 'Web Services' project. Medium Product Manifest specification-title exo-ws Medium Product pom parent-groupid org.exoplatform.ws Low Product pom groupid exoplatform.ws Low Product pom artifactid exo.ws.rest.core Highest Product pom name eXo PLF:: WS :: REST :: Core High Product pom parent-artifactid ws-parent Medium Version file version 5.3 Highest Version pom version 5.3.x-20190428.130227-16 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
Related Dependencies
exo.ws.rest.ext-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.rest.ext/5.3.x-SNAPSHOT/exo.ws.rest.ext-5.3.x-SNAPSHOT.jar
SHA1: aafeb3c4511f31e6c874f9b344f1396c3652a0bc
MD5: 4835d8450f2e9deea7924289d5760e86
exo.ws.frameworks.json-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.frameworks.json/5.3.x-SNAPSHOT/exo.ws.frameworks.json-5.3.x-SNAPSHOT.jar
SHA1: a61ebceb583ac271b06502f7ff0cb7c1f764ae07
MD5: bba07b832bcc38d78c8bda9c93a988c3
maven: org.exoplatform.ws:exo.ws.rest.core:5.3.x-SNAPSHOT
Confidence :High
cpe: cpe:/a:ws_project:ws:5.3
Confidence :Low
suppress
Description: JSR-250 Reference Implementation by Glassfish
License:
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html
File Path: /home/ciagent/.m2/repository/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar
MD5: 4cd56b2e4977e541186de69f5126b4a6
SHA1: 5025422767732a1ab45d93abfea846513d742dcf
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid jsr250-api Low Vendor pom url http://jcp.org/aboutJava/communityprocess/final/jsr250/index.html Highest Vendor pom name JSR-250 Common Annotations for the JavaTM Platform High Vendor central groupid javax.annotation Highest Vendor jar package name annotation Low Vendor file name jsr250-api High Vendor jar package name javax Low Vendor pom description JSR-250 Reference Implementation by Glassfish Medium Vendor pom groupid javax.annotation Highest Product pom artifactid jsr250-api Highest Product pom name JSR-250 Common Annotations for the JavaTM Platform High Product pom url http://jcp.org/aboutJava/communityprocess/final/jsr250/index.html Medium Product jar package name annotation Low Product central artifactid jsr250-api Highest Product file name jsr250-api High Product pom groupid javax.annotation Low Product pom description JSR-250 Reference Implementation by Glassfish Medium Version pom version 1.0 Highest Version file version 1.0 Highest Version central version 1.0 Highest
Description: Implementation of Extension Service of Exoplatform SAS 'eXo JCR' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/jcr/exo.jcr.component.ext/5.3.x-SNAPSHOT/exo.jcr.component.ext-5.3.x-SNAPSHOT.jarMD5: 0c22381107a418022e18f5abf228b919SHA1: dd2454ee974c64a83237206a52a356417ce4aa48
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-groupid org.exoplatform.jcr Medium Vendor Manifest Implementation-Vendor-Id org.exoplatform.jcr Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom artifactid exo.jcr.component.ext Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid jcr-parent Low Vendor pom name eXo PLF:: JCR :: Component :: Extension Service High Vendor file name exo.jcr.component.ext High Vendor pom groupid exoplatform.jcr Highest Vendor pom groupid org.exoplatform.jcr Highest Vendor pom description Implementation of Extension Service of Exoplatform SAS 'eXo JCR' project. Medium Product pom parent-groupid org.exoplatform.jcr Low Product pom artifactid exo.jcr.component.ext Highest Product Manifest Implementation-Title eXo PLF:: JCR :: Component :: Extension Service High Product pom name eXo PLF:: JCR :: Component :: Extension Service High Product Manifest specification-title exo-jcr Medium Product pom groupid exoplatform.jcr Low Product file name exo.jcr.component.ext High Product pom description Implementation of Extension Service of Exoplatform SAS 'eXo JCR' project. Medium Product pom parent-artifactid jcr-parent Medium Version file version 5.3 Highest Version pom version 5.3.x-20190428.133752-14 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.jcr:exo.jcr.component.ext:5.3.x-SNAPSHOT
Confidence :High
Description: The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group.
File Path: /home/ciagent/.m2/repository/javax/portlet/portlet-api/2.0/portlet-api-2.0.jarMD5: 0ec08593cda1df33985391919996c740SHA1: 1cd72f2a37fcf8ab9893a9468d7ba71c85fe2653
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-symbolicname javax.portlet Medium Vendor pom groupid javax.portlet Highest Vendor Manifest bundle-docurl http://www.jcp.org/en/jsr/detail?id=286 Low Vendor pom description The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group. Medium Vendor file name portlet-api High Vendor pom name Java Portlet Specification V2.0 High Vendor pom artifactid portlet-api Low Vendor central groupid javax.portlet Highest Vendor pom url http://www.jcp.org/en/jsr/detail?id=286 Highest Product Manifest bundle-symbolicname javax.portlet Medium Product Manifest bundle-docurl http://www.jcp.org/en/jsr/detail?id=286 Low Product pom description The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group. Medium Product central artifactid portlet-api Highest Product file name portlet-api High Product pom groupid javax.portlet Low Product pom name Java Portlet Specification V2.0 High Product pom url http://www.jcp.org/en/jsr/detail?id=286 Medium Product Manifest Bundle-Name JSR 286 Medium Product pom artifactid portlet-api Highest Version pom version 2.0 Highest Version central version 2.0 Highest Version file version 2.0 Highest
File Path: /home/ciagent/.m2/repository/org/gatein/common/common-common/2.2.2.Final/common-common-2.2.2.Final.jarMD5: 8ce16b5e3991285cd27e553740d09d1fSHA1: 44522d899e31a5a10dbd70f7b0ca2fe5a614f740
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low Vendor file name common-common High Vendor central groupid org.gatein.common Highest Vendor Manifest Implementation-Vendor-Id org.gatein.common Medium Vendor pom parent-groupid org.gatein.common Medium Vendor pom parent-artifactid common-parent Low Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom artifactid common-common Low Vendor pom groupid gatein.common Highest Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest implementation-url www.gatein.org/common-parent/common-common/ Low Vendor pom groupid org.gatein.common Highest Vendor pom name GateIn - Common component (common) High Product Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low Product Manifest Implementation-Title GateIn - Common component (common) High Product file name common-common High Product Manifest specification-title GateIn - Common component (common) Medium Product pom parent-artifactid common-parent Medium Product Manifest os-name Linux Medium Product pom groupid gatein.common Low Product central artifactid common-common Highest Product pom parent-groupid org.gatein.common Low Product Manifest implementation-url www.gatein.org/common-parent/common-common/ Low Product pom artifactid common-common Highest Product pom name GateIn - Common component (common) High Version central version 2.2.2.Final Highest Version Manifest Implementation-Version 2.2.2.Final High Version pom version 2.2.2.Final Highest Version file version 2.2.2 Highest
Description: Implementation of Cache Service of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.cache/5.3.x-SNAPSHOT/exo.kernel.component.cache-5.3.x-SNAPSHOT.jarMD5: cacc6b24bf3596fe96df5151283af370SHA1: 3dba9dab09968092cf424ff358fe730fb2c57d39
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium Vendor pom name eXo PLF:: Kernel :: Component :: Cache Service High Vendor file name exo.kernel.component.cache High Vendor pom parent-groupid org.exoplatform.kernel Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid kernel-parent Low Vendor pom groupid exoplatform.kernel Highest Vendor pom groupid org.exoplatform.kernel Highest Vendor pom artifactid exo.kernel.component.cache Low Vendor pom description Implementation of Cache Service of Exoplatform SAS 'eXo Kernel' project. Medium Product pom name eXo PLF:: Kernel :: Component :: Cache Service High Product file name exo.kernel.component.cache High Product Manifest specification-title exo-kernel Medium Product pom parent-groupid org.exoplatform.kernel Low Product pom parent-artifactid kernel-parent Medium Product Manifest Implementation-Title eXo PLF:: Kernel :: Component :: Cache Service High Product pom artifactid exo.kernel.component.cache Highest Product pom description Implementation of Cache Service of Exoplatform SAS 'eXo Kernel' project. Medium Product pom groupid exoplatform.kernel Low Version pom version 5.3.x-20190428.124337-14 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.kernel:exo.kernel.component.cache:5.3.x-SNAPSHOT
Confidence :High
Description: The JBoss Logging Framework
License:
Apache License, version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/jboss/logging/jboss-logging/3.3.0.Final/jboss-logging-3.3.0.Final.jar
MD5: bc11af4b8ce7138cdc79b7ba8561638c
SHA1: 3616bb87707910296e2c195dc016287080bba5af
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest build-timestamp Thu, 28 May 2015 09:49:28 -0700 Low Vendor Manifest implementation-url http://www.jboss.org Low Vendor pom groupid org.jboss.logging Highest Vendor pom parent-groupid org.jboss Medium Vendor manifest Bundle-Description The JBoss Logging Framework Medium Vendor pom groupid jboss.logging Highest Vendor pom url http://www.jboss.org Highest Vendor central groupid org.jboss.logging Highest Vendor Manifest java-vendor Oracle Corporation Medium Vendor pom artifactid jboss-logging Low Vendor Manifest os-name Linux Medium Vendor file name jboss-logging High Vendor Manifest Implementation-Vendor-Id org.jboss.logging Medium Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest originally-created-by Apache Maven Bundle Plugin Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor pom parent-artifactid jboss-parent Low Vendor pom description The JBoss Logging Framework Medium Vendor Manifest bundle-docurl http://www.jboss.org Low Vendor pom name JBoss Logging 3 High Vendor Manifest bundle-symbolicname org.jboss.logging.jboss-logging Medium Product Manifest build-timestamp Thu, 28 May 2015 09:49:28 -0700 Low Product Manifest implementation-url http://www.jboss.org Low Product manifest Bundle-Description The JBoss Logging Framework Medium Product Manifest specification-title JBoss Logging 3 Medium Product pom parent-artifactid jboss-parent Medium Product Manifest Bundle-Name JBoss Logging 3 Medium Product Manifest os-name Linux Medium Product pom parent-groupid org.jboss Low Product pom url http://www.jboss.org Medium Product file name jboss-logging High Product Manifest originally-created-by Apache Maven Bundle Plugin Low Product pom description The JBoss Logging Framework Medium Product Manifest bundle-docurl http://www.jboss.org Low Product pom groupid jboss.logging Low Product Manifest Implementation-Title JBoss Logging 3 High Product central artifactid jboss-logging Highest Product pom artifactid jboss-logging Highest Product pom name JBoss Logging 3 High Product Manifest bundle-symbolicname org.jboss.logging.jboss-logging Medium Version Manifest Implementation-Version 3.3.0.Final High Version central version 3.3.0.Final Highest Version pom version 3.3.0.Final Highest Version file version 3.3.0 Highest
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor pom name Commons Lang High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor file name commons-lang High Vendor Manifest bundle-symbolicname org.apache.commons.lang Medium Vendor manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Vendor pom parent-groupid org.apache.commons Medium Vendor central groupid org.netbeans.external High Vendor pom artifactid commons-lang Low Vendor pom groupid commons-lang Highest Vendor pom url http://commons.apache.org/lang/ Highest Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Vendor Manifest bundle-docurl http://commons.apache.org/lang/ Low Vendor central groupid commons-lang High Product pom name Commons Lang High Product pom url http://commons.apache.org/lang/ Medium Product pom groupid commons-lang Low Product file name commons-lang High Product Manifest bundle-symbolicname org.apache.commons.lang Medium Product central artifactid org-apache-commons-lang High Product pom parent-groupid org.apache.commons Low Product manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Product pom artifactid commons-lang Highest Product Manifest Implementation-Title Commons Lang High Product Manifest Bundle-Name Commons Lang Medium Product pom parent-artifactid commons-parent Medium Product central artifactid commons-lang High Product Manifest specification-title Commons Lang Medium Product pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Product Manifest bundle-docurl http://commons.apache.org/lang/ Low Version central version RELEASE110 High Version pom version 2.6 Highest Version central version RELEASE100 High Version central version RELEASE90 High Version file version 2.6 Highest Version Manifest Implementation-Version 2.6 High Version central version 2.6 High
Description: Infinispan Implementation of Cache Service for Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.ext.cache.impl.infinispan.v8/5.3.x-SNAPSHOT/exo.kernel.component.ext.cache.impl.infinispan.v8-5.3.x-SNAPSHOT.jarMD5: 8270a07392ed69165aa55f8fa576575dSHA1: 7bf935a7e119aff6ca4083f92b5944ca954b05d9
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium Vendor pom artifactid exo.kernel.component.ext.cache.impl.infinispan.v8 Low Vendor pom parent-groupid org.exoplatform.kernel Medium Vendor pom description Infinispan Implementation of Cache Service for Exoplatform SAS 'eXo Kernel' project. Medium Vendor file name exo.kernel.component.ext.cache.impl.infinispan.v8 High Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom name eXo PLF:: Kernel :: Cache Extension :: Infinispan Implementation High Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid kernel-parent Low Vendor pom groupid exoplatform.kernel Highest Vendor pom groupid org.exoplatform.kernel Highest Product Manifest specification-title exo-kernel Medium Product pom parent-groupid org.exoplatform.kernel Low Product pom description Infinispan Implementation of Cache Service for Exoplatform SAS 'eXo Kernel' project. Medium Product file name exo.kernel.component.ext.cache.impl.infinispan.v8 High Product pom parent-artifactid kernel-parent Medium Product pom name eXo PLF:: Kernel :: Cache Extension :: Infinispan Implementation High Product Manifest Implementation-Title eXo PLF:: Kernel :: Cache Extension :: Infinispan Implementation High Product pom artifactid exo.kernel.component.ext.cache.impl.infinispan.v8 Highest Product pom groupid exoplatform.kernel Low Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-20190428.124437-14 Highest Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.kernel:exo.kernel.component.ext.cache.impl.infinispan.v8:5.3.x-SNAPSHOT
Confidence :High
cpe: cpe:/a:infinispan:infinispan:5.3.0
Confidence :Highest
suppress
Published Vulnerabilities
CVE-2016-0750 suppress
Severity:
Medium
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-15089 suppress
Severity:
Medium
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-2638 suppress
Severity:
Medium
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Vulnerable Software & Versions: (show all )
Description: mime-util is a simple to use, small, light weight and fast open source java utility library that can detect
MIME types from files, input streams, URL's and byte arrays.
Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/eu/medsea/mimeutil/mime-util/2.1.3/mime-util-2.1.3.jar
MD5: 3d4f3e1a96eb79683197f1c8b182f4a6
SHA1: 0c9cfae15c74f62491d4f28def0dff1dabe52a47
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name Mime Detection Utility High Vendor pom description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low Vendor pom groupid eu.medsea.mimeutil Highest Vendor pom organization url http://www.medsea.eu Medium Vendor file name mime-util High Vendor manifest Bundle-Description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low Vendor Manifest bundle-docurl http://www.medsea.eu Low Vendor pom artifactid mime-util Low Vendor Manifest bundle-symbolicname eu.medsea.mimeutil.mime-util Medium Vendor pom url http://www.medsea.eu/mime-util/ Highest Vendor pom organization name Medsea Business Solutions S.L. High Vendor central groupid eu.medsea.mimeutil Highest Vendor Manifest url http://www.medsea.eu/mime-util/ Low Product pom url http://www.medsea.eu/mime-util/ Medium Product pom artifactid mime-util Highest Product pom name Mime Detection Utility High Product pom description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low Product file name mime-util High Product pom organization url http://www.medsea.eu Low Product manifest Bundle-Description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low Product Manifest bundle-docurl http://www.medsea.eu Low Product Manifest bundle-symbolicname eu.medsea.mimeutil.mime-util Medium Product Manifest Bundle-Name Mime Detection Utility Medium Product pom groupid eu.medsea.mimeutil Low Product pom organization name Medsea Business Solutions S.L. Low Product central artifactid mime-util Highest Product Manifest url http://www.medsea.eu/mime-util/ Low Version pom version 2.1.3 Highest Version file version 2.1.3 Highest Version central version 2.1.3 Highest
Description: JCL 1.1.1 implemented over SLF4J
File Path: /home/ciagent/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.18/jcl-over-slf4j-1.7.18.jarMD5: 86c8f80da62e4640564effb9dff7e003SHA1: eca71be00af2579564e9f3a23ce0b245ca79ee5d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor manifest Bundle-Description JCL 1.1.1 implemented over SLF4J Medium Vendor Manifest bundle-symbolicname jcl.over.slf4j Medium Vendor pom artifactid jcl-over-slf4j Low Vendor file name jcl-over-slf4j High Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor pom groupid org.slf4j Highest Vendor pom name JCL 1.1.1 implemented over SLF4J High Vendor central groupid org.slf4j Highest Vendor pom parent-groupid org.slf4j Medium Vendor pom description JCL 1.1.1 implemented over SLF4J Medium Vendor pom groupid slf4j Highest Vendor pom url http://www.slf4j.org Highest Vendor pom parent-artifactid slf4j-parent Low Product manifest Bundle-Description JCL 1.1.1 implemented over SLF4J Medium Product Manifest bundle-symbolicname jcl.over.slf4j Medium Product pom groupid slf4j Low Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Product file name jcl-over-slf4j High Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product pom name JCL 1.1.1 implemented over SLF4J High Product pom parent-groupid org.slf4j Low Product pom artifactid jcl-over-slf4j Highest Product Manifest Bundle-Name jcl-over-slf4j Medium Product pom description JCL 1.1.1 implemented over SLF4J Medium Product Manifest Implementation-Title jcl-over-slf4j High Product central artifactid jcl-over-slf4j Highest Version pom version 1.7.18 Highest Version file version 1.7.18 Highest Version Manifest Implementation-Version 1.7.18 High Version central version 1.7.18 Highest
Description: Implementation of Commons Utils of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.commons/5.3.x-SNAPSHOT/exo.kernel.commons-5.3.x-SNAPSHOT.jarMD5: d10d86e8fb1548e76b755f5065efee73SHA1: 724fc5cd1eff73e2c571fccf477f85b25a960093
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium Vendor file name exo.kernel.commons High Vendor pom parent-groupid org.exoplatform.kernel Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom artifactid exo.kernel.commons Low Vendor pom parent-artifactid kernel-parent Low Vendor pom groupid exoplatform.kernel Highest Vendor pom name eXo PLF:: Kernel :: Commons Utils High Vendor pom groupid org.exoplatform.kernel Highest Vendor pom description Implementation of Commons Utils of Exoplatform SAS 'eXo Kernel' project. Medium Product file name exo.kernel.commons High Product Manifest specification-title exo-kernel Medium Product pom parent-groupid org.exoplatform.kernel Low Product pom parent-artifactid kernel-parent Medium Product pom artifactid exo.kernel.commons Highest Product Manifest Implementation-Title eXo PLF:: Kernel :: Commons Utils High Product pom name eXo PLF:: Kernel :: Commons Utils High Product pom groupid exoplatform.kernel Low Product pom description Implementation of Commons Utils of Exoplatform SAS 'eXo Kernel' project. Medium Version pom version 5.3.x-20190428.123637-16 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.kernel:exo.kernel.commons:5.3.x-SNAPSHOT
Confidence :High
Description:
A framework for constructing recognizers, compilers,
and translators from grammatical descriptions containing
Java, C#, C++, or Python actions.
License:
BSD License: http://www.antlr.org/license.html
File Path: /home/ciagent/.m2/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar
MD5: f8f1352c52a4c6a500b597596501fc64
SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid antlr Highest Vendor pom artifactid antlr Low Vendor pom url http://www.antlr.org/ Highest Vendor pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low Vendor pom name AntLR Parser Generator High Vendor file name antlr High Vendor jar package name antlr Low Vendor pom groupid antlr Highest Product pom url http://www.antlr.org/ Medium Product pom artifactid antlr Highest Product pom groupid antlr Low Product pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low Product pom name AntLR Parser Generator High Product central artifactid antlr Highest Product file name antlr High Version file version 2.7.7 Highest Version central version 2.7.7 Highest Version pom version 2.7.7 Highest
Description: dom4j: the flexible XML framework for Java
File Path: /home/ciagent/.m2/repository/dom4j/dom4j/1.6.1/dom4j-1.6.1.jarMD5: 4d8f51d3fe3900efc6e395be48030d6dSHA1: 5d3ccc056b6f056dbf0dddfdf43894b9065a8f94
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid dom4j Low Vendor pom organization url http://sourceforge.net/projects/dom4j Medium Vendor pom groupid dom4j Highest Vendor central groupid org.zenframework.z8.dependencies.commons High Vendor Manifest specification-vendor MetaStuff Ltd. Low Vendor pom name dom4j High Vendor pom description dom4j: the flexible XML framework for Java Medium Vendor central groupid dom4j High Vendor file name dom4j High Vendor Manifest extension-name dom4j Medium Vendor Manifest Implementation-Vendor MetaStuff Ltd. High Vendor pom url http://dom4j.org Highest Vendor pom organization name MetaStuff Ltd. High Product pom organization name MetaStuff Ltd. Low Product pom name dom4j High Product pom description dom4j: the flexible XML framework for Java Medium Product pom organization url http://sourceforge.net/projects/dom4j Low Product central artifactid dom4j-1.6.1 High Product pom url http://dom4j.org Medium Product Manifest Implementation-Title org.dom4j High Product pom groupid dom4j Low Product file name dom4j High Product Manifest extension-name dom4j Medium Product central artifactid dom4j High Product Manifest specification-title dom4j : XML framework for Java Medium Product pom artifactid dom4j Highest Version pom version 1.6.1 Highest Version file version 1.6.1 Highest Version central version 2.0 High Version Manifest Implementation-Version 1.6.1 High Version central version 1.6.1 High
Published Vulnerabilities
CVE-2018-1000632 suppress
Severity:
Medium
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Vulnerable Software & Versions: (show all )
Description:
Hibernate definition of the Java Persistence 2.0 (JSR 317) API.
License:
license.txt
File Path: /home/ciagent/.m2/repository/org/hibernate/javax/persistence/hibernate-jpa-2.0-api/1.0.1.Final/hibernate-jpa-2.0-api-1.0.1.Final.jar
MD5: d7e7d8f60fc44a127ba702d43e71abec
SHA1: 3306a165afa81938fc3d8a0948e891de9f6b192b
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.hibernate.javax.persistence Highest Vendor pom groupid org.hibernate.javax.persistence Highest Vendor pom organization name Hibernate.org High Vendor Manifest Implementation-Vendor hibernate.org High Vendor pom url http://hibernate.org Highest Vendor pom artifactid hibernate-jpa-2.0-api Low Vendor pom name JPA 2.0 API High Vendor pom groupid hibernate.javax.persistence Highest Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor file name hibernate-jpa-2.0-api-1.0.1.Final High Vendor pom organization url http://hibernate.org Medium Vendor pom description
Hibernate definition of the Java Persistence 2.0 (JSR 317) API.
Medium Product pom url http://hibernate.org Medium Product pom groupid hibernate.javax.persistence Low Product central artifactid hibernate-jpa-2.0-api Highest Product pom organization url http://hibernate.org Low Product pom artifactid hibernate-jpa-2.0-api Highest Product Manifest specification-title Java Persistence API, Version 2.0 Medium Product pom organization name Hibernate.org Low Product file name hibernate-jpa-2.0-api-1.0.1.Final High Product Manifest Implementation-Title JPA API High Product pom description
Hibernate definition of the Java Persistence 2.0 (JSR 317) API.
Medium Product pom name JPA 2.0 API High Version central version 1.0.1.Final Highest Version Manifest Implementation-Version 1.0.1.Final High Version pom version 1.0.1.Final Highest
File Path: /home/ciagent/.m2/repository/org/jboss/logging/jboss-logging-annotations/1.2.0.Beta1/jboss-logging-annotations-1.2.0.Beta1.jarMD5: 938e552e319015a8863dd91284aada54SHA1: 2f437f37bb265d9f8f1392823dbca12d2bec06d6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-groupid org.jboss.logging Medium Vendor pom artifactid jboss-logging-annotations Low Vendor pom groupid org.jboss.logging Highest Vendor pom groupid jboss.logging Highest Vendor central groupid org.jboss.logging Highest Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor Manifest implementation-url http://www.jboss.org/jboss-logging-tools-parent/jboss-logging-annotations Low Vendor Manifest Implementation-Vendor-Id org.jboss.logging Medium Vendor file name jboss-logging-annotations High Vendor Manifest build-timestamp Tue, 18 Jun 2013 18:41:43 -0500 Low Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor pom name JBoss Logging I18n Annotations High Vendor pom parent-artifactid jboss-logging-tools-parent Low Product Manifest specification-title JBoss Logging I18n Annotations Medium Product pom artifactid jboss-logging-annotations Highest Product Manifest os-name Linux Medium Product Manifest implementation-url http://www.jboss.org/jboss-logging-tools-parent/jboss-logging-annotations Low Product pom parent-groupid org.jboss.logging Low Product pom parent-artifactid jboss-logging-tools-parent Medium Product file name jboss-logging-annotations High Product Manifest build-timestamp Tue, 18 Jun 2013 18:41:43 -0500 Low Product central artifactid jboss-logging-annotations Highest Product Manifest Implementation-Title JBoss Logging I18n Annotations High Product pom groupid jboss.logging Low Product pom name JBoss Logging I18n Annotations High Version pom version 1.2.0.Beta1 Highest Version central version 1.2.0.Beta1 Highest Version Manifest Implementation-Version 1.2.0.Beta1 High
Description: Common reflection code used in support of annotation processing
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/hibernate/common/hibernate-commons-annotations/4.0.5.Final/hibernate-commons-annotations-4.0.5.Final.jar
MD5: 5dadbafd7c7bc1168c10a2ba87e927a2
SHA1: 2a581b9edb8168e45060d8bad8b7f46712d2c52c
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom organization name Hibernate.org High Vendor Manifest Implementation-Vendor Hibernate.org High Vendor pom name Hibernate Commons Annotations High Vendor pom artifactid hibernate-commons-annotations Low Vendor pom url http://hibernate.org Highest Vendor central groupid org.hibernate.common Highest Vendor pom groupid org.hibernate.common Highest Vendor Manifest bundle-symbolicname org.hibernate.common.hibernate-commons-annotations Medium Vendor Manifest implementation-url http://hibernate.org Low Vendor pom groupid hibernate.common Highest Vendor file name hibernate-commons-annotations High Vendor pom description Common reflection code used in support of annotation processing Medium Vendor pom organization url http://hibernate.org Medium Vendor Manifest Implementation-Vendor-Id org.hibernate Medium Product pom url http://hibernate.org Medium Product pom groupid hibernate.common Low Product pom name Hibernate Commons Annotations High Product central artifactid hibernate-commons-annotations Highest Product pom organization name Hibernate.org Low Product Manifest bundle-symbolicname org.hibernate.common.hibernate-commons-annotations Medium Product Manifest implementation-url http://hibernate.org Low Product pom organization url http://hibernate.org Low Product file name hibernate-commons-annotations High Product pom description Common reflection code used in support of annotation processing Medium Product Manifest Bundle-Name hibernate-commons-annotations Medium Product pom artifactid hibernate-commons-annotations Highest Version central version 4.0.5.Final Highest Version file version 4.0.5 Highest Version pom version 4.0.5.Final Highest Version Manifest Implementation-Version 4.0.5.Final High
Description: A module of the Hibernate O/RM project
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/hibernate/hibernate-core/4.2.21.Final/hibernate-core-4.2.21.Final.jar
MD5: 492567c1f36fb3a5968ca2d3c452edaf
SHA1: bb587d00287c13d9e4324bc76c13abbd493efa81
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor manifest Bundle-Description Hibernate ORM Core Medium Vendor pom groupid hibernate Highest Vendor pom organization name Hibernate.org High Vendor Manifest Implementation-Vendor Hibernate.org High Vendor central groupid org.hibernate Highest Vendor pom artifactid hibernate-core Low Vendor pom url http://hibernate.org Highest Vendor pom groupid org.hibernate Highest Vendor Manifest implementation-url http://hibernate.org Low Vendor file name hibernate-core High Vendor Manifest bundle-symbolicname org.hibernate.core Medium Vendor pom organization url http://hibernate.org Medium Vendor pom description A module of the Hibernate O/RM project Medium Vendor pom name A Hibernate O/RM Module High Vendor Manifest Implementation-Vendor-Id org.hibernate Medium Product Manifest Bundle-Name hibernate-core Medium Product pom url http://hibernate.org Medium Product manifest Bundle-Description Hibernate ORM Core Medium Product central artifactid hibernate-core Highest Product pom organization name Hibernate.org Low Product pom groupid hibernate Low Product Manifest implementation-url http://hibernate.org Low Product pom organization url http://hibernate.org Low Product file name hibernate-core High Product Manifest bundle-symbolicname org.hibernate.core Medium Product pom description A module of the Hibernate O/RM project Medium Product pom name A Hibernate O/RM Module High Product pom artifactid hibernate-core Highest Version file version 4.2.21 Highest Version Manifest Implementation-Version 4.2.21.Final High Version pom version 4.2.21.Final Highest Version central version 4.2.21.Final Highest
Description: Commons Database Connection Pooling
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-dbcp/commons-dbcp/1.4/commons-dbcp-1.4.jar
MD5: b004158fab904f37f5831860898b3cd9
SHA1: 30be73c965cc990b153a100aaaaafcf239f82d39
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor pom groupid commons-dbcp Highest Vendor pom url http://commons.apache.org/dbcp/ Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor manifest Bundle-Description Commons Database Connection Pooling Medium Vendor pom name Commons DBCP High Vendor central groupid commons-dbcp Highest Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest bundle-symbolicname org.apache.commons.dbcp Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor pom artifactid commons-dbcp Low Vendor pom description Commons Database Connection Pooling Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor file name commons-dbcp High Vendor Manifest bundle-docurl http://commons.apache.org/dbcp/ Low Product Manifest Implementation-Title Commons DBCP High Product Manifest specification-title Commons DBCP Medium Product pom url http://commons.apache.org/dbcp/ Medium Product manifest Bundle-Description Commons Database Connection Pooling Medium Product pom name Commons DBCP High Product pom parent-groupid org.apache.commons Low Product Manifest bundle-symbolicname org.apache.commons.dbcp Medium Product pom groupid commons-dbcp Low Product central artifactid commons-dbcp Highest Product pom parent-artifactid commons-parent Medium Product pom artifactid commons-dbcp Highest Product pom description Commons Database Connection Pooling Medium Product file name commons-dbcp High Product Manifest Bundle-Name Commons DBCP Medium Product Manifest bundle-docurl http://commons.apache.org/dbcp/ Low Version file version 1.4 Highest Version Manifest Implementation-Version 1.4 High Version central version 1.4 Highest Version pom version 1.4 Highest
Description: Commons Object Pooling Library
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-pool/commons-pool/1.6/commons-pool-1.6.jar
MD5: 5ca02245c829422176d23fa530e919cc
SHA1: 4572d589699f09d866a226a14b7f4323c6d8f040
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid commons-parent Low Vendor central groupid commons-pool Highest Vendor Manifest implementation-build UNKNOWN_BRANCH@r??????; 2012-01-04 10:31:47-0500 Low Vendor pom name Commons Pool High Vendor file name commons-pool High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom groupid commons-pool Highest Vendor pom description Commons Object Pooling Library Medium Vendor pom parent-groupid org.apache.commons Medium Vendor pom artifactid commons-pool Low Vendor pom url http://commons.apache.org/pool/ Highest Vendor Manifest bundle-docurl http://commons.apache.org/pool/ Low Vendor Manifest bundle-symbolicname org.apache.commons.pool Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor manifest Bundle-Description Commons Object Pooling Library Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Product Manifest implementation-build UNKNOWN_BRANCH@r??????; 2012-01-04 10:31:47-0500 Low Product pom name Commons Pool High Product file name commons-pool High Product pom groupid commons-pool Low Product pom description Commons Object Pooling Library Medium Product Manifest specification-title Commons Pool Medium Product pom parent-groupid org.apache.commons Low Product pom url http://commons.apache.org/pool/ Medium Product Manifest Bundle-Name Commons Pool Medium Product pom parent-artifactid commons-parent Medium Product Manifest bundle-docurl http://commons.apache.org/pool/ Low Product Manifest bundle-symbolicname org.apache.commons.pool Medium Product Manifest Implementation-Title Commons Pool High Product manifest Bundle-Description Commons Object Pooling Library Medium Product central artifactid commons-pool Highest Product pom artifactid commons-pool Highest Version pom version 1.6 Highest Version Manifest Implementation-Version 1.6 High Version central version 1.6 Highest Version file version 1.6 Highest
Description: Implementation of Database Service of Exoplatform SAS eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.database/5.3.x-SNAPSHOT/exo.core.component.database-5.3.x-SNAPSHOT.jarMD5: f545011470e0b99ea1a04b9e95715bbfSHA1: ca13a8a94124463b7610c707047e12b3bbf3eaa6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid exo.core.component.database Low Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid exoplatform.core Highest Vendor file name exo.core.component.database High Vendor pom groupid org.exoplatform.core Highest Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid core-parent Low Vendor pom name eXo PLF Core :: Component :: Database Service High Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium Vendor pom parent-groupid org.exoplatform.core Medium Vendor pom description Implementation of Database Service of Exoplatform SAS eXo Core' project. Medium Product pom artifactid exo.core.component.database Highest Product Manifest Implementation-Title eXo PLF Core :: Component :: Database Service High Product pom parent-groupid org.exoplatform.core Low Product file name exo.core.component.database High Product Manifest specification-title exo-core Medium Product pom groupid exoplatform.core Low Product pom name eXo PLF Core :: Component :: Database Service High Product pom parent-artifactid core-parent Medium Product pom description Implementation of Database Service of Exoplatform SAS eXo Core' project. Medium Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.database:5.3.x-SNAPSHOT
Confidence :High
Description: Chromattic Framework API
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.api/1.3.0/chromattic.api-1.3.0.jarMD5: 11f2df6e3a3b4451719710c0f4c08103SHA1: 4f60a9585bd6e68833eaaea1f1a615c682adbe27
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name api Low Vendor pom description Chromattic Framework API Medium Vendor pom artifactid chromattic.api Low Vendor pom parent-artifactid chromattic.parent Low Vendor jar package name chromattic Low Vendor pom groupid chromattic Highest Vendor pom parent-groupid org.chromattic Medium Vendor pom groupid org.chromattic Highest Vendor pom name Chromattic Framework API High Vendor central groupid org.chromattic Highest Vendor file name chromattic.api High Product jar package name api Low Product pom description Chromattic Framework API Medium Product pom groupid chromattic Low Product pom artifactid chromattic.api Highest Product pom parent-groupid org.chromattic Low Product pom name Chromattic Framework API High Product file name chromattic.api High Product pom parent-artifactid chromattic.parent Medium Product central artifactid chromattic.api Highest Version file version 1.3.0 Highest Version central version 1.3.0 Highest Version pom version 1.3.0 Highest
Description: Chromattic Framework SPI
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.spi/1.3.0/chromattic.spi-1.3.0.jarMD5: e440e3f5a8e5ad38720975546ab7f06dSHA1: 64c36f826b832acab48fea793b7c70b019a46181
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description Chromattic Framework SPI Medium Vendor pom artifactid chromattic.spi Low Vendor jar package name chromattic Low Vendor pom groupid chromattic Highest Vendor pom groupid org.chromattic Highest Vendor central groupid org.chromattic Highest Vendor jar package name type Low Vendor pom parent-artifactid chromattic.parent Low Vendor file name chromattic.spi High Vendor jar package name spi Low Vendor pom parent-groupid org.chromattic Medium Vendor pom name Chromattic Framework SPI High Product pom description Chromattic Framework SPI Medium Product jar package name type Low Product pom groupid chromattic Low Product file name chromattic.spi High Product pom parent-groupid org.chromattic Low Product jar package name spi Low Product central artifactid chromattic.spi Highest Product pom name Chromattic Framework SPI High Product pom artifactid chromattic.spi Highest Product pom parent-artifactid chromattic.parent Medium Version file version 1.3.0 Highest Version central version 1.3.0 Highest Version pom version 1.3.0 Highest
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.common/5.3.x-SNAPSHOT/exo.portal.component.common-5.3.x-SNAPSHOT.jarMD5: f4671cd7a2820ee9f63b65f00a76a071SHA1: 2e65637713f78d142964754eaa1e972af33aa190
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-groupid org.exoplatform.gatein.portal Medium Vendor Manifest implementation-url www.gatein.org/exo.portal.parent/exo.portal.component/exo.portal.component.common/ Low Vendor pom groupid org.exoplatform.gatein.portal Highest Vendor file name exo.portal.component.common High Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.portal Medium Vendor pom name GateIn Portal Component Common High Vendor Manifest java-vendor Oracle Corporation Medium Vendor pom parent-artifactid exo.portal.component Low Vendor Manifest os-name Linux Medium Vendor pom artifactid exo.portal.component.common Low Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor pom groupid exoplatform.gatein.portal Highest Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest build-timestamp Sun, 28 Apr 2019 13:56:02 +0000 Low Product pom artifactid exo.portal.component.common Highest Product pom parent-groupid org.exoplatform.gatein.portal Low Product Manifest specification-title GateIn Portal Component Common Medium Product Manifest implementation-url www.gatein.org/exo.portal.parent/exo.portal.component/exo.portal.component.common/ Low Product file name exo.portal.component.common High Product pom parent-artifactid exo.portal.component Medium Product Manifest build-timestamp Sun, 28 Apr 2019 13:56:02 +0000 Low Product pom groupid exoplatform.gatein.portal Low Product pom name GateIn Portal Component Common High Product Manifest Implementation-Title GateIn Portal Component Common High Product Manifest os-name Linux Medium Version pom version 5.3.x-20190428.135702-15 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
Related Dependencies
exo.portal.component.identity-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.identity/5.3.x-SNAPSHOT/exo.portal.component.identity-5.3.x-SNAPSHOT.jar
SHA1: a15e3a8621fd37cc05af37c8428ce46cea4bcad9
MD5: 5b216cfa8a5fa02a284fe3bf59008c28
exo.portal.component.web.controller-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.controller/5.3.x-SNAPSHOT/exo.portal.component.web.controller-5.3.x-SNAPSHOT.jar
SHA1: 85bd868092d8c41f7e501fd844e24c6f3e9a4b45
MD5: ef489ee6f4fd648c74d1acb89a572403
exo.portal.component.web.resources-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.resources/5.3.x-SNAPSHOT/exo.portal.component.web.resources-5.3.x-SNAPSHOT.jar
SHA1: ed453af61a2d5d6fe0c86ce97389aeb6281d0856
MD5: 9604032fc37cb040e7ce2788fb04fb95
maven: org.exoplatform.gatein.portal:exo.portal.component.common:5.3.x-SNAPSHOT
Confidence :High
cpe: cpe:/a:in-portal:in-portal:5.3.20190428
Confidence :Low
suppress
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-api/5.3.x-SNAPSHOT/pc-api-5.3.x-SNAPSHOT.jarMD5: 8c90f92aabf2b9ff0e59314bed407c5fSHA1: a8497db83109a8cc0bae6bef76718d0979073112
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium Vendor Manifest Implementation-Vendor GateIn High Vendor pom parent-artifactid pc-parent Low Vendor pom name GateIn - Portlet Container (api) High Vendor Manifest specification-vendor GateIn Low Vendor Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Vendor pom groupid exoplatform.gatein.pc Highest Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom groupid org.exoplatform.gatein.pc Highest Vendor pom parent-groupid org.exoplatform.gatein.pc Medium Vendor file name pc-api High Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-api Low Vendor pom artifactid pc-api Low Product pom artifactid pc-api Highest Product pom parent-artifactid pc-parent Medium Product Manifest specification-title GateIn - Portlet Container (api) Medium Product pom name GateIn - Portlet Container (api) High Product Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Product pom groupid exoplatform.gatein.pc Low Product file name pc-api High Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-api Low Product Manifest Implementation-Title GateIn - Portlet Container (api) High Product pom parent-groupid org.exoplatform.gatein.pc Low Product Manifest os-name Linux Medium Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-20190428.134541-19 Highest Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.gatein.pc:pc-api:5.3.x-SNAPSHOT
Confidence :High
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-portlet/5.3.x-SNAPSHOT/pc-portlet-5.3.x-SNAPSHOT.jarMD5: a8a0e88a0651a2e695a6da1e6aaa0656SHA1: 4249d059bdc17e3e066447aa22ee77afc8819660
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium Vendor pom artifactid pc-portlet Low Vendor Manifest Implementation-Vendor GateIn High Vendor pom parent-artifactid pc-parent Low Vendor Manifest specification-vendor GateIn Low Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-portlet Low Vendor Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Vendor pom groupid exoplatform.gatein.pc Highest Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom groupid org.exoplatform.gatein.pc Highest Vendor pom parent-groupid org.exoplatform.gatein.pc Medium Vendor file name pc-portlet High Vendor pom name GateIn - Portlet Container (pc) High Product pom parent-artifactid pc-parent Medium Product Manifest specification-title GateIn - Portlet Container (pc) Medium Product Manifest Implementation-Title GateIn - Portlet Container (pc) High Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-portlet Low Product file name pc-portlet High Product Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Product pom groupid exoplatform.gatein.pc Low Product pom name GateIn - Portlet Container (pc) High Product pom parent-groupid org.exoplatform.gatein.pc Low Product pom artifactid pc-portlet Highest Product Manifest os-name Linux Medium Version pom version 5.3.x-20190428.134618-19 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.gatein.pc:pc-portlet:5.3.x-SNAPSHOT
Confidence :High
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-federation/5.3.x-SNAPSHOT/pc-federation-5.3.x-SNAPSHOT.jarMD5: 9a28c9bd0bad210b7325fbf85d4e6692SHA1: 1345baa91863a0ef53322d3ca077198dd0748b35
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium Vendor Manifest Implementation-Vendor GateIn High Vendor pom parent-artifactid pc-parent Low Vendor Manifest specification-vendor GateIn Low Vendor pom name GateIn - Portlet Container (federation) High Vendor file name pc-federation High Vendor Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Vendor pom groupid exoplatform.gatein.pc Highest Vendor pom artifactid pc-federation Low Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom groupid org.exoplatform.gatein.pc Highest Vendor pom parent-groupid org.exoplatform.gatein.pc Medium Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-federation Low Product pom parent-artifactid pc-parent Medium Product pom name GateIn - Portlet Container (federation) High Product file name pc-federation High Product Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Product pom groupid exoplatform.gatein.pc Low Product Manifest Implementation-Title GateIn - Portlet Container (federation) High Product Manifest specification-title GateIn - Portlet Container (federation) Medium Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-federation Low Product pom parent-groupid org.exoplatform.gatein.pc Low Product pom artifactid pc-federation Highest Product Manifest os-name Linux Medium Version file version 5.3 Highest Version pom version 5.3.x-20190428.134811-14 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.gatein.pc:pc-federation:5.3.x-SNAPSHOT
Confidence :High
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-bridge/5.3.x-SNAPSHOT/pc-bridge-5.3.x-SNAPSHOT.jarMD5: 224d9984f8072d853fe6a050e78254f9SHA1: 3bd39f0856ba02f7a2a084bcee1bd54afdabecd4
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium Vendor pom artifactid pc-bridge Low Vendor Manifest Implementation-Vendor GateIn High Vendor pom parent-artifactid pc-parent Low Vendor pom name GateIn - Portlet Container (bridge) High Vendor Manifest specification-vendor GateIn Low Vendor Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Vendor pom groupid exoplatform.gatein.pc Highest Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom groupid org.exoplatform.gatein.pc Highest Vendor pom parent-groupid org.exoplatform.gatein.pc Medium Vendor file name pc-bridge High Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-bridge Low Product pom parent-artifactid pc-parent Medium Product pom name GateIn - Portlet Container (bridge) High Product file name pc-bridge High Product Manifest build-timestamp Sun, 28 Apr 2019 13:45:22 +0000 Low Product pom groupid exoplatform.gatein.pc Low Product Manifest Implementation-Title GateIn - Portlet Container (bridge) High Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-bridge Low Product Manifest specification-title GateIn - Portlet Container (bridge) Medium Product pom artifactid pc-bridge Highest Product pom parent-groupid org.exoplatform.gatein.pc Low Product Manifest os-name Linux Medium Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.gatein.pc:pc-bridge:5.3.x-SNAPSHOT
Confidence :High
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/wci/wci-wci/5.3.x-SNAPSHOT/wci-wci-5.3.x-SNAPSHOT.jarMD5: 5e7d70af531cdea5f35c1f1732bcef07SHA1: b7483b77f8c149599d10b17b1ece20c711385e3b
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid exoplatform.gatein.wci Highest Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.wci Medium Vendor pom name GateIn - Web Container Integration component (wci) High Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom parent-artifactid wci-parent Low Vendor Manifest implementation-url www.gatein.org/wci-parent/wci-wci/ Low Vendor file name wci-wci High Vendor pom parent-groupid org.exoplatform.gatein.wci Medium Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest build-timestamp Sun, 28 Apr 2019 12:09:59 +0000 Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor pom artifactid wci-wci Low Vendor pom groupid org.exoplatform.gatein.wci Highest Product Manifest implementation-url www.gatein.org/wci-parent/wci-wci/ Low Product pom parent-groupid org.exoplatform.gatein.wci Low Product pom parent-artifactid wci-parent Medium Product file name wci-wci High Product Manifest Implementation-Title GateIn - Web Container Integration component (wci) High Product Manifest build-timestamp Sun, 28 Apr 2019 12:09:59 +0000 Low Product Manifest specification-title GateIn - Web Container Integration component (wci) Medium Product pom artifactid wci-wci Highest Product pom groupid exoplatform.gatein.wci Low Product pom name GateIn - Web Container Integration component (wci) High Product Manifest os-name Linux Medium Version pom version 5.3.x-20190428.121006-14 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.gatein.wci:wci-wci:5.3.x-SNAPSHOT
Confidence :High
Description: Java.net - The Source for Java Technology Collaboration
License:
CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: /home/ciagent/.m2/repository/javax/servlet/javax.servlet-api/3.0.1/javax.servlet-api-3.0.1.jar
MD5: 3ef236ac4c24850cd54abff60be25f35
SHA1: 6bf0ebb7efd993e222fc1112377b5e92a13b38dd
Referenced In Project/Scope:
eXo PLF:: WCM Resources:provided
Evidence
Type Source Name Value Confidence Vendor pom groupid javax.servlet Highest Vendor Manifest Implementation-Vendor-Id org.glassfish Medium Vendor pom parent-artifactid jvnet-parent Low Vendor central groupid javax.servlet Highest Vendor Manifest extension-name javax.servlet Medium Vendor Manifest specification-vendor Oracle Low Vendor Manifest bundle-symbolicname javax.servlet-api Medium Vendor pom artifactid javax.servlet-api Low Vendor file name javax.servlet-api High Vendor Manifest (hint) specification-vendor sun Low Vendor pom url http://servlet-spec.java.net Highest Vendor pom parent-groupid net.java Medium Vendor pom organization name GlassFish Community High Vendor pom organization url https://glassfish.dev.java.net Medium Vendor manifest Bundle-Description Java.net - The Source for Java Technology Collaboration Medium Vendor Manifest Implementation-Vendor GlassFish Community High Vendor pom name Java Servlet API High Vendor Manifest bundle-docurl https://glassfish.dev.java.net Low Product Manifest specification-title Java(TM) Servlet API Design Specification Medium Product pom organization name GlassFish Community Low Product pom url http://servlet-spec.java.net Medium Product Manifest Bundle-Name Java Servlet API Medium Product Manifest extension-name javax.servlet Medium Product pom parent-artifactid jvnet-parent Medium Product Manifest bundle-symbolicname javax.servlet-api Medium Product file name javax.servlet-api High Product pom groupid javax.servlet Low Product pom artifactid javax.servlet-api Highest Product pom parent-groupid net.java Low Product manifest Bundle-Description Java.net - The Source for Java Technology Collaboration Medium Product pom name Java Servlet API High Product Manifest bundle-docurl https://glassfish.dev.java.net Low Product central artifactid javax.servlet-api Highest Product pom organization url https://glassfish.dev.java.net Low Version file version 3.0.1 Highest Version pom version 3.0.1 Highest Version central version 3.0.1 Highest Version Manifest Implementation-Version 3.0.1 High
Description: BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/commons-beanutils/commons-beanutils/1.8.3/commons-beanutils-1.8.3.jar
MD5: b45be74134796c89db7126083129532f
SHA1: 686ef3410bcf4ab8ce7fd0b899e832aaba5facf7
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-docurl http://commons.apache.org/beanutils/ Low Vendor pom parent-artifactid commons-parent Low Vendor manifest Bundle-Description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium Vendor Manifest bundle-symbolicname org.apache.commons.beanutils Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom url http://commons.apache.org/beanutils/ Highest Vendor pom name Commons BeanUtils High Vendor pom groupid commons-beanutils Highest Vendor file name commons-beanutils High Vendor pom artifactid commons-beanutils Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor central groupid commons-beanutils Highest Product Manifest bundle-docurl http://commons.apache.org/beanutils/ Low Product manifest Bundle-Description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium Product Manifest bundle-symbolicname org.apache.commons.beanutils Medium Product pom name Commons BeanUtils High Product file name commons-beanutils High Product pom url http://commons.apache.org/beanutils/ Medium Product pom parent-groupid org.apache.commons Low Product Manifest specification-title Commons BeanUtils Medium Product pom parent-artifactid commons-parent Medium Product pom description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium Product pom groupid commons-beanutils Low Product Manifest Bundle-Name Commons BeanUtils Medium Product central artifactid commons-beanutils Highest Product Manifest Implementation-Title Commons BeanUtils High Product pom artifactid commons-beanutils Highest Version pom version 1.8.3 Highest Version file version 1.8.3 Highest Version Manifest Implementation-Version 1.8.3 High Version central version 1.8.3 Highest
Published Vulnerabilities
CVE-2014-0114 suppress
Severity:
High
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Vulnerable Software & Versions: (show all )
Description: JiBX runtime code
License:
http://jibx.sourceforge.net/jibx-license.html File Path: /home/ciagent/.m2/repository/org/jibx/jibx-run/1.2.6/jibx-run-1.2.6.jar
MD5: 4ef53e4279c8440aff2d16c0af024231
SHA1: 544f3ac7887d7eed20ca0420ee1963df6c7ecebb
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid org.jibx Highest Vendor Manifest bundle-docurl http://www.jibx.org Low Vendor pom name jibx-run - JiBX runtime High Vendor manifest Bundle-Description JiBX runtime code Medium Vendor pom groupid jibx Highest Vendor pom parent-groupid org.jibx.config Medium Vendor pom artifactid jibx-run Low Vendor file name jibx-run High Vendor pom parent-artifactid main-reactor Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Vendor Manifest bundle-symbolicname jibx-run Medium Vendor pom description JiBX runtime code Medium Vendor pom groupid org.jibx Highest Product Manifest bundle-docurl http://www.jibx.org Low Product pom name jibx-run - JiBX runtime High Product manifest Bundle-Description JiBX runtime code Medium Product file name jibx-run High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low Product pom parent-artifactid main-reactor Medium Product Manifest bundle-symbolicname jibx-run Medium Product Manifest Bundle-Name jibx-run - JiBX runtime Medium Product pom description JiBX runtime code Medium Product pom artifactid jibx-run Highest Product pom parent-groupid org.jibx.config Low Product pom groupid jibx Low Product central artifactid jibx-run Highest Version file version 1.2.6 Highest Version pom version 1.2.6 Highest Version central version 1.2.6 Highest
Description: The javax.inject API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom url http://code.google.com/p/atinject/ Highest Vendor pom description The javax.inject API Medium Vendor pom artifactid javax.inject Low Vendor central groupid javax.inject Highest Vendor pom name javax.inject High Vendor jar package name inject Low Vendor pom groupid javax.inject Highest Vendor file name javax.inject-1 High Vendor jar package name javax Low Product pom artifactid javax.inject Highest Product pom description The javax.inject API Medium Product pom groupid javax.inject Low Product pom name javax.inject High Product jar package name inject Low Product file name javax.inject-1 High Product pom url http://code.google.com/p/atinject/ Medium Product central artifactid javax.inject Highest Version central version 1 Highest Version file version 1 Medium Version pom version 1 Highest
Description: APIs for JSR-299: Contexts and Dependency Injection for Java EE
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/javax/enterprise/cdi-api/1.0-SP4/cdi-api-1.0-SP4.jar
MD5: 6c1e2b4036d64b6ba1a1136a00c7cdaa
SHA1: 6e38490033eb8b36c4cf1f7605163424a574dcf0
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid cdi-api Low Vendor pom url http://www.seamframework.org/Weld Highest Vendor central groupid javax.enterprise Highest Vendor file name cdi-api High Vendor pom name CDI APIs High Vendor pom parent-artifactid weld-parent Low Vendor Manifest specification-vendor Seam Framework Low Vendor Manifest Implementation-Vendor Seam Framework High Vendor pom organization name Seam Framework High Vendor pom parent-groupid org.jboss.weld Medium Vendor Manifest implementation-url http://www.seamframework.org/Weld Low Vendor pom groupid javax.enterprise Highest Vendor pom organization url http://seamframework.org Medium Vendor pom description APIs for JSR-299: Contexts and Dependency Injection for Java EE Medium Product pom parent-groupid org.jboss.weld Low Product pom url http://www.seamframework.org/Weld Medium Product pom parent-artifactid weld-parent Medium Product pom groupid javax.enterprise Low Product pom organization name Seam Framework Low Product file name cdi-api High Product pom name CDI APIs High Product pom artifactid cdi-api Highest Product Manifest Implementation-Title CDI APIs High Product Manifest specification-title CDI APIs Medium Product central artifactid cdi-api Highest Product Manifest implementation-url http://www.seamframework.org/Weld Low Product pom organization url http://seamframework.org Low Product pom description APIs for JSR-299: Contexts and Dependency Injection for Java EE Medium Version file version 1.0.sp4 Highest Version central version 1.0-SP4 Highest Version pom version 1.0-SP4 Highest
Description: Implementation of Container for Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.container/5.3.x-SNAPSHOT/exo.kernel.container-5.3.x-SNAPSHOT.jarMD5: cea20487f9c6f325a0e66dc53b5a9873SHA1: e17d3d2abee819790905ee1ae39c7818ca37f96d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium Vendor pom artifactid exo.kernel.container Low Vendor pom description Implementation of Container for Exoplatform SAS 'eXo Kernel' project. Medium Vendor pom parent-groupid org.exoplatform.kernel Medium Vendor pom name eXo PLF:: Kernel :: Container High Vendor Manifest specification-vendor eXo Platform SAS Low Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid kernel-parent Low Vendor pom groupid exoplatform.kernel Highest Vendor file name exo.kernel.container High Vendor pom groupid org.exoplatform.kernel Highest Product pom description Implementation of Container for Exoplatform SAS 'eXo Kernel' project. Medium Product Manifest Implementation-Title eXo PLF:: Kernel :: Container High Product Manifest specification-title exo-kernel Medium Product pom artifactid exo.kernel.container Highest Product pom parent-groupid org.exoplatform.kernel Low Product pom name eXo PLF:: Kernel :: Container High Product pom parent-artifactid kernel-parent Medium Product file name exo.kernel.container High Product pom groupid exoplatform.kernel Low Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-20190428.123806-15 Highest Version pom version 5.3.x-SNAPSHOT Highest
maven: org.exoplatform.kernel:exo.kernel.container:5.3.x-SNAPSHOT
Confidence :High
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.pc/5.3.x-SNAPSHOT/exo.portal.component.pc-5.3.x-SNAPSHOT.jarMD5: 3862df38973725dbba29be17d5b5d788SHA1: afcc2b265dbd09df6b6462abb7569717b6b74a18
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-groupid org.exoplatform.gatein.portal Medium Vendor pom name GateIn Portal Component PC integration High Vendor pom groupid org.exoplatform.gatein.portal Highest Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.portal Medium Vendor pom artifactid exo.portal.component.pc Low Vendor Manifest java-vendor Oracle Corporation Medium Vendor pom parent-artifactid exo.portal.component Low Vendor Manifest os-name Linux Medium Vendor file name exo.portal.component.pc High Vendor Manifest implementation-url www.gatein.org/exo.portal.parent/exo.portal.component/exo.portal.component.pc/ Low Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor pom groupid exoplatform.gatein.portal Highest Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest build-timestamp Sun, 28 Apr 2019 13:56:02 +0000 Low Product pom parent-groupid org.exoplatform.gatein.portal Low Product file name exo.portal.component.pc High Product Manifest implementation-url www.gatein.org/exo.portal.parent/exo.portal.component/exo.portal.component.pc/ Low Product pom name GateIn Portal Component PC integration High Product pom artifactid exo.portal.component.pc Highest Product pom parent-artifactid exo.portal.component Medium Product Manifest Implementation-Title GateIn Portal Component PC integration High Product Manifest build-timestamp Sun, 28 Apr 2019 13:56:02 +0000 Low Product pom groupid exoplatform.gatein.portal Low Product Manifest specification-title GateIn Portal Component PC integration Medium Product Manifest os-name Linux Medium Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-20190428.135718-15 Highest Version pom version 5.3.x-SNAPSHOT Highest
Related Dependencies
exo.portal.component.resources-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.resources/5.3.x-SNAPSHOT/exo.portal.component.resources-5.3.x-SNAPSHOT.jar
SHA1: 16860a31ae983a17cee48e0df9cd35c330ea3948
MD5: a34499c2b95dd14aaa34a495ae495e3e
exo.portal.component.portal-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.portal/5.3.x-SNAPSHOT/exo.portal.component.portal-5.3.x-SNAPSHOT.jar
SHA1: 4f24945eb77ab38b2bc88f863ed35c8df3ad1e3f
MD5: bda15581eec91d2338e2a57114ecf07f
cpe: cpe:/a:in-portal:in-portal:5.3
Confidence :Low
suppress
maven: org.exoplatform.gatein.portal:exo.portal.component.pc:5.3.x-SNAPSHOT
Confidence :High
Description: Implementation of 'eXo Security' component of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.security.core/5.3.x-SNAPSHOT/exo.core.component.security.core-5.3.x-SNAPSHOT.jarMD5: 1591141b97e8e1519d9f41a3b948a4d5SHA1: 345752ff1b964b62766df857b6f452c3b88e7eb3
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid exo.core.component.security.core Low Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid exoplatform.core Highest Vendor pom groupid org.exoplatform.core Highest Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid core-parent Low Vendor pom name eXo PLF Core :: Component :: Security Service High Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium Vendor file name exo.core.component.security.core High Vendor pom description Implementation of 'eXo Security' component of Exoplatform SAS 'eXo Core' project. Medium Vendor pom parent-groupid org.exoplatform.core Medium Product pom artifactid exo.core.component.security.core Highest Product pom parent-groupid org.exoplatform.core Low Product Manifest Implementation-Title eXo PLF Core :: Component :: Security Service High Product Manifest specification-title exo-core Medium Product pom groupid exoplatform.core Low Product pom name eXo PLF Core :: Component :: Security Service High Product file name exo.core.component.security.core High Product pom parent-artifactid core-parent Medium Product pom description Implementation of 'eXo Security' component of Exoplatform SAS 'eXo Core' project. Medium Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.security.core:5.3.x-SNAPSHOT
Confidence :High
Description: XStream is a serialization library from Java objects to XML and back.
License:
http://x-stream.github.io/license.html File Path: /home/ciagent/.m2/repository/com/thoughtworks/xstream/xstream/1.4.10/xstream-1.4.10.jar
MD5: d00eec778910f95b26201395ac64cca0
SHA1: dfecae23647abc9d9fd0416629a4213a3882b101
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest x-compile-source 1.5 Low Vendor pom groupid com.thoughtworks.xstream Highest Vendor central groupid com.thoughtworks.xstream Highest Vendor Manifest java_1_6_home /opt/sun-jdk-1.6.0.45 Low Vendor Manifest java_1_9_home /opt/oracle-jdk-bin-1.9.0.0_beta167 Low Vendor pom groupid thoughtworks.xstream Highest Vendor Manifest Implementation-Vendor-Id com.thoughtworks.xstream Medium Vendor Manifest java_1_5_home /opt/sun-jdk-1.5.0.22 Low Vendor Manifest Implementation-Vendor XStream High Vendor pom parent-artifactid xstream-parent Low Vendor Manifest x-build-time 2017-05-23T14:28:02Z Low Vendor pom name XStream Core High Vendor pom artifactid xstream Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor file name xstream High Vendor manifest Bundle-Description XStream is a serialization library from Java objects to XML and back. Medium Vendor Manifest x-builder Maven 3.3.9 Low Vendor Manifest bundle-symbolicname xstream Medium Vendor Manifest bundle-docurl http://x-stream.github.io Low Vendor Manifest java_1_7_home /opt/oracle-jdk-bin-1.7.0.80 Low Vendor Manifest java_1_8_home /opt/oracle-jdk-bin-1.8.0.131 Low Vendor pom parent-groupid com.thoughtworks.xstream Medium Vendor Manifest x-compile-target 1.5 Low Vendor Manifest specification-vendor XStream Low Vendor Manifest java_1_4_home /opt/blackdown-jdk-1.4.2.03 Low Product Manifest x-compile-source 1.5 Low Product Manifest Bundle-Name XStream Core Medium Product Manifest java_1_6_home /opt/sun-jdk-1.6.0.45 Low Product Manifest java_1_9_home /opt/oracle-jdk-bin-1.9.0.0_beta167 Low Product Manifest java_1_5_home /opt/sun-jdk-1.5.0.22 Low Product pom groupid thoughtworks.xstream Low Product Manifest x-build-time 2017-05-23T14:28:02Z Low Product pom name XStream Core High Product pom parent-artifactid xstream-parent Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom parent-groupid com.thoughtworks.xstream Low Product file name xstream High Product manifest Bundle-Description XStream is a serialization library from Java objects to XML and back. Medium Product Manifest x-builder Maven 3.3.9 Low Product Manifest bundle-symbolicname xstream Medium Product Manifest Implementation-Title XStream Core High Product Manifest bundle-docurl http://x-stream.github.io Low Product Manifest java_1_7_home /opt/oracle-jdk-bin-1.7.0.80 Low Product pom artifactid xstream Highest Product Manifest java_1_8_home /opt/oracle-jdk-bin-1.8.0.131 Low Product Manifest x-compile-target 1.5 Low Product central artifactid xstream Highest Product Manifest java_1_4_home /opt/blackdown-jdk-1.4.2.03 Low Product Manifest specification-title XStream Core Medium Version central version 1.4.10 Highest Version Manifest Implementation-Version 1.4.10 High Version pom version 1.4.10 Highest Version file version 1.4.10 Highest
File Path: /home/ciagent/.m2/repository/jakarta-regexp/jakarta-regexp/1.4/jakarta-regexp-1.4.jarMD5: 5d8b8c601c21b37aa6142d38f45c0297SHA1: 0ea514a179ac1dd7e81c7e6594468b9b9910d298
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid jakarta-regexp Low Vendor jar package name regexp Low Vendor central groupid jakarta-regexp Highest Vendor jar package name apache Low Vendor pom groupid jakarta-regexp Highest Vendor file name jakarta-regexp High Product pom artifactid jakarta-regexp Highest Product jar package name regexp Low Product pom groupid jakarta-regexp Low Product file name jakarta-regexp High Product central artifactid jakarta-regexp Highest Version file version 1.4 Highest Version central version 1.4 Highest Version pom version 1.4 Highest
Description: XML Pull parser library developed by Extreme Computing Lab, Indiana University
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/ogce/xpp3/1.1.6/xpp3-1.1.6.jar
MD5: 626a429318310e92e3466151e050bdc5
SHA1: dc87e00ddb69341b46a3eb1c331c6fcebf6c8546
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid ogce Highest Vendor pom artifactid xpp3 Low Vendor pom url http://www.extreme.indiana.edu/xpp/ Highest Vendor jar package name v1 Low Vendor pom description XML Pull parser library developed by Extreme Computing Lab, Indiana University Medium Vendor file name xpp3 High Vendor jar package name builder Low Vendor central groupid org.ogce Highest Vendor pom groupid org.ogce Highest Vendor pom name XPP3 High Vendor jar package name xmlpull Low Product jar package name v1 Low Product pom description XML Pull parser library developed by Extreme Computing Lab, Indiana University Medium Product pom url http://www.extreme.indiana.edu/xpp/ Medium Product file name xpp3 High Product pom groupid ogce Low Product jar package name builder Low Product central artifactid xpp3 Highest Product pom name XPP3 High Product jar package name xpath Low Product pom artifactid xpp3 Highest Version central version 1.1.6 Highest Version file version 1.1.6 Highest Version pom version 1.1.6 Highest
Description: API of Organization Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.organization.api/5.3.x-SNAPSHOT/exo.core.component.organization.api-5.3.x-SNAPSHOT.jarMD5: c5277d0154e869ae438da893706e6aefSHA1: a251533250c87727ef31fa544b10bc3997f8ccf5
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid exo.core.component.organization.api Low Vendor pom name eXo PLF Core :: Component :: Organization Service API High Vendor pom description API of Organization Service of Exoplatform SAS 'eXo Core' project. Medium Vendor Manifest specification-vendor eXo Platform SAS Low Vendor pom groupid exoplatform.core Highest Vendor pom groupid org.exoplatform.core Highest Vendor file name exo.core.component.organization.api High Vendor Manifest Implementation-Vendor eXo Platform SAS High Vendor pom parent-artifactid core-parent Low Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium Vendor pom parent-groupid org.exoplatform.core Medium Product pom artifactid exo.core.component.organization.api Highest Product pom parent-groupid org.exoplatform.core Low Product pom name eXo PLF Core :: Component :: Organization Service API High Product pom description API of Organization Service of Exoplatform SAS 'eXo Core' project. Medium Product Manifest specification-title exo-core Medium Product pom groupid exoplatform.core Low Product file name exo.core.component.organization.api High Product Manifest Implementation-Title eXo PLF Core :: Component :: Organization Service API High Product pom parent-artifactid core-parent Medium Version pom version 5.3.x-20190428.125219-14 Highest Version file version 5.3 Highest Version Manifest Implementation-Version 5.3.x-SNAPSHOT High Version pom version 5.3.x-SNAPSHOT Highest
cpe: cpe:/a:api-platform:core:5.3.20190428
Confidence :Low
suppress
maven: org.exoplatform.core:exo.core.component.organization.api:5.3.x-SNAPSHOT
Confidence :High
Description: Apache Log4j 1.2
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar
MD5: 04a41f0a068986f0f73485cf507c0f40
SHA1: 5af35056b4d257e4b64b9e8069c0746e8b08629f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-symbolicname log4j Medium Vendor manifest Bundle-Description Apache Log4j 1.2 Medium Vendor Manifest bundle-docurl http://logging.apache.org/log4j/1.2 Low Vendor pom url http://logging.apache.org/log4j/1.2/ Highest Vendor pom name Apache Log4j High Vendor central groupid log4j High Vendor pom artifactid log4j Low Vendor central groupid org.zenframework.z8.dependencies.commons High Vendor file name log4j High Vendor pom groupid log4j Highest Vendor pom description Apache Log4j 1.2 Medium Vendor pom organization name Apache Software Foundation High Vendor pom organization url http://www.apache.org Medium Vendor manifest: org.apache.log4j Implementation-Vendor "Apache Software Foundation" Medium Product Manifest bundle-symbolicname log4j Medium Product pom groupid log4j Low Product pom organization name Apache Software Foundation Low Product manifest Bundle-Description Apache Log4j 1.2 Medium Product Manifest bundle-docurl http://logging.apache.org/log4j/1.2 Low Product central artifactid log4j High Product pom name Apache Log4j High Product manifest: org.apache.log4j Implementation-Title log4j Medium Product file name log4j High Product pom description Apache Log4j 1.2 Medium Product central artifactid log4j-1.2.17 High Product Manifest Bundle-Name Apache Log4j Medium Product pom organization url http://www.apache.org Low Product pom url http://logging.apache.org/log4j/1.2/ Medium Product pom artifactid log4j Highest Version pom version 1.2.17 Highest Version central version 2.0 High Version file version 1.2.17 Highest Version central version 1.2.17 High
Published Vulnerabilities
CVE-2017-5645 suppress
Severity:
High
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Vulnerable Software & Versions: (show all )
Description:
StAX is a standard XML processing API that allows you to stream XML data from and to your application.
License:
GNU General Public Library: http://www.gnu.org/licenses/gpl.txt
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: http://www.sun.com/cddl/cddl.html
File Path: /home/ciagent/.m2/repository/javax/xml/stream/stax-api/1.0-2/stax-api-1.0-2.jar
MD5: 7d18b63063580284c3f5734081fdc99f
SHA1: d6337b0de8b25e53e81b922352fbea9f9f57ba0b
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid stax-api Low Vendor pom name Streaming API for XML High Vendor jar package name xml Low Vendor jar package name stream Low Vendor central groupid javax.xml.stream Highest Vendor pom groupid javax.xml.stream Highest Vendor jar package name javax Low Vendor file name stax-api High Vendor pom description StAX is a standard XML processing API that allows you to stream XML data from and to your application. Low Product pom name Streaming API for XML High Product jar package name xml Low Product pom artifactid stax-api Highest Product jar package name stream Low Product central artifactid stax-api Highest Product file name stax-api High Product pom groupid javax.xml.stream Low Product pom description StAX is a standard XML processing API that allows you to stream XML data from and to your application. Low Version file version 1.0.2 Highest Version pom version 1.0-2 Highest Version central version 1.0-2 Highest
Description: The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data
License:
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html
File Path: /home/ciagent/.m2/repository/javax/activation/activation/1.1.1/activation-1.1.1.jar
MD5: 46a37512971d8eca81c3fcf245bf07d2
SHA1: 485de3a253e23f645037828c07f1d7f1af40763a
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom url http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp Highest Vendor central groupid javax.activation Highest Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High Vendor pom description The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data Medium Vendor Manifest extension-name javax.activation Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom groupid javax.activation Highest Vendor pom artifactid activation Low Vendor file name activation High Vendor pom name JavaBeans(TM) Activation Framework High Product central artifactid activation Highest Product pom description The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data Medium Product pom artifactid activation Highest Product Manifest extension-name javax.activation Medium Product pom groupid javax.activation Low Product Manifest specification-title JavaBeans(TM) Activation Framework Specification Medium Product pom url http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp Medium Product file name activation High Product pom name JavaBeans(TM) Activation Framework High Version Manifest Implementation-Version 1.1.1 High Version file version 1.1.1 Highest Version central version 1.1.1 Highest Version pom version 1.1.1 Highest
File Path: /home/ciagent/.m2/repository/javax/xml/bind/jaxb-api/2.1/jaxb-api-2.1.jarMD5: 9534ce6506dc96bac3944423d804be30SHA1: d68570e722cffe2000358ce9c661a0b0bf1ebe11
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name jaxb-api High Vendor pom artifactid jaxb-api Low Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom groupid javax.xml.bind Highest Vendor Manifest extension-name javax.xml.bind Medium Vendor central groupid javax.xml.bind Highest Product file name jaxb-api High Product Manifest specification-title Java Architecture for XML Binding Medium Product pom groupid javax.xml.bind Low Product central artifactid jaxb-api Highest Product Manifest extension-name javax.xml.bind Medium Product pom artifactid jaxb-api Highest Version central version 2.1 Highest Version file version 2.1 Highest Version pom version 2.1 Highest
File Path: /home/ciagent/.m2/repository/com/sun/xml/bind/jaxb-impl/2.1.8/jaxb-impl-2.1.8.jarMD5: 1340264c75ea00b3d4d83e1ba57b606aSHA1: 41b915446cb6962f9b403d1a5da3817a95ee579e
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid jaxb-impl Low Vendor Manifest Implementation-Vendor-Id com.sun Medium Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor central groupid com.sun.xml.bind Highest Vendor file name jaxb-impl High Vendor pom groupid sun.xml.bind Highest Vendor Manifest extension-name com.sun.xml.bind Medium Vendor pom groupid com.sun.xml.bind Highest Product Manifest specification-title Java Architecture for XML Binding Medium Product pom groupid sun.xml.bind Low Product pom artifactid jaxb-impl Highest Product Manifest Implementation-Title JAXB Reference Implementation High Product central artifactid jaxb-impl Highest Product file name jaxb-impl High Product Manifest extension-name com.sun.xml.bind Medium Version pom version 2.1.8 Highest Version file version 2.1.8 Highest Version Manifest Implementation-Version 2.1.8 High Version central version 2.1.8 Highest
Description: PicketLink IDM IMPL contains the implementation of the API and the Identity Model.
License:
lgpl: http://repository.jboss.com/licenses/lgpl.txt
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-core/1.4.6.Final/picketlink-idm-core-1.4.6.Final.jar
MD5: a5c21c2186c186bc296d9909bcb11616
SHA1: 30d4385012393e4c50a82f8b84153eb6ee301a7d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description PicketLink IDM IMPL contains the implementation of the API and the Identity Model. Medium Vendor pom parent-groupid org.picketlink.idm Medium Vendor central groupid org.picketlink.idm Highest Vendor pom groupid picketlink.idm Highest Vendor pom parent-artifactid picketlink-idm-parent Low Vendor pom organization name JBoss Inc. High Vendor pom groupid org.picketlink.idm Highest Vendor Manifest build-timestamp Fri, 27 Feb 2015 09:44:09 +0100 Low Vendor pom name PicketLink IDM Implementation High Vendor Manifest os-name Linux Medium Vendor Manifest Implementation-Vendor JBoss Inc. High Vendor file name picketlink-idm-core High Vendor Manifest specification-vendor JBoss Inc. Low Vendor Manifest Implementation-Vendor-Id org.picketlink.idm Medium Vendor Manifest java-vendor Sun Microsystems Inc. Medium Vendor pom artifactid picketlink-idm-core Low Vendor pom organization url http://www.jboss.org Medium Vendor Manifest implementation-url http://www.jboss.org/picketlink-idm-parent/picketlink-idm-core Low Product pom description PicketLink IDM IMPL contains the implementation of the API and the Identity Model. Medium Product pom artifactid picketlink-idm-core Highest Product pom organization name JBoss Inc. Low Product Manifest build-timestamp Fri, 27 Feb 2015 09:44:09 +0100 Low Product pom name PicketLink IDM Implementation High Product central artifactid picketlink-idm-core Highest Product Manifest os-name Linux Medium Product file name picketlink-idm-core High Product pom parent-groupid org.picketlink.idm Low Product Manifest Implementation-Title PicketLink IDM Implementation High Product Manifest specification-title PicketLink IDM Implementation Medium Product pom groupid picketlink.idm Low Product pom parent-artifactid picketlink-idm-parent Medium Product pom organization url http://www.jboss.org Low Product Manifest implementation-url http://www.jboss.org/picketlink-idm-parent/picketlink-idm-core Low Version central version 1.4.6.Final Highest Version Manifest Implementation-Version 1.4.6.Final High Version file version 1.4.6 Highest Version pom version 1.4.6.Final Highest
Related Dependencies
picketlink-idm-common-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-common/1.4.6.Final/picketlink-idm-common-1.4.6.Final.jar
SHA1: 37c1309fd376db4f4ff969fb0df4f8c388e2022c
MD5: 1ad4f8384e856abf4696895d7647dabf
maven: org.picketlink.idm:picketlink-idm-common:1.4.6.Final ✓
picketlink-idm-spi-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-spi/1.4.6.Final/picketlink-idm-spi-1.4.6.Final.jar
SHA1: 0804a3a34b7d031cc8daab4f4a8cbac1c00e98dd
MD5: 7289815e139890cb98b0f5a80e7b7a59
maven: org.picketlink.idm:picketlink-idm-spi:1.4.6.Final ✓
picketlink-idm-ldap-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-ldap/1.4.6.Final/picketlink-idm-ldap-1.4.6.Final.jar
SHA1: b52fefb76b4f2d047422f4ff5caff9c7a18001f3
MD5: 7da4240664f237384cd33b35939ff153
maven: org.picketlink.idm:picketlink-idm-ldap:1.4.6.Final ✓
picketlink-idm-api-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-api/1.4.6.Final/picketlink-idm-api-1.4.6.Final.jar
SHA1: 6af0f6f08add632a442a6a415907460f9e8a9913
MD5: b85343ae7bcc7162b42ed3aaac08322a
maven: org.picketlink.idm:picketlink-idm-api:1.4.6.Final ✓
picketlink-idm-hibernate-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-hibernate/1.4.6.Final/picketlink-idm-hibernate-1.4.6.Final.jar
SHA1: 4cd6d4e7bc818d5d89e06d268302908903cd3447
MD5: 4e80873b893295bab629a5764c40b345
maven: org.picketlink.idm:picketlink-idm-hibernate:1.4.6.Final ✓
Published Vulnerabilities
CVE-2015-0277 suppress
Severity:
Medium
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
Vulnerable Software & Versions:
CVE-2015-3158 suppress
Severity:
Medium
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
Vulnerable Software & Versions:
CVE-2015-6254 suppress
Severity:
Medium
The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
Vulnerable Software & Versions:
Description: JBoss Marshalling OSGi Bundle with API and implementations
License:
http://repository.jboss.org/licenses/cc0-1.0.txt File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar
MD5: 7652392087f6e70312cf0309ab563a4f
SHA1: a55fe6527a2d50dc48ad3f8b9093bd0cb01302b0
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor manifest Bundle-Description JBoss Marshalling OSGi Bundle with API and implementations Medium Vendor central groupid org.jboss.marshalling Highest Vendor jar package name jboss Low Vendor pom groupid org.jboss.marshalling Highest Vendor file name jboss-marshalling-osgi High Vendor jar package name marshalling Low Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor Manifest bundle-symbolicname org.jboss.marshalling.jboss-marshalling-osgi Medium Vendor Manifest implementation-url http://www.jboss.org/jboss-marshalling-parent/jboss-marshalling-osgi Low Vendor Manifest bundle-docurl http://jboss.org/jbossmarshalling Low Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest Implementation-Vendor-Id org.jboss.marshalling Medium Product manifest Bundle-Description JBoss Marshalling OSGi Bundle with API and implementations Medium Product Manifest specification-title JBoss Marshalling OSGi Bundle Medium Product file name jboss-marshalling-osgi High Product jar package name marshalling Low Product Manifest Implementation-Title JBoss Marshalling OSGi Bundle High Product Manifest os-name Linux Medium Product pom artifactid jboss-marshalling-osgi Highest Product Manifest bundle-symbolicname org.jboss.marshalling.jboss-marshalling-osgi Medium Product Manifest implementation-url http://www.jboss.org/jboss-marshalling-parent/jboss-marshalling-osgi Low Product Manifest bundle-docurl http://jboss.org/jbossmarshalling Low Product central artifactid jboss-marshalling-osgi Highest Product Manifest Bundle-Name JBoss Marshalling OSGi Bundle Medium Version pom version 2.0.0.Beta3 Highest Version central version 2.0.0.Beta3 Highest Version Manifest Implementation-Version 2.0.0.Beta3 High
Description: Infinispan core module
License:
http://www.apache.org/licenses/LICENSE-2.0 File Path: /home/ciagent/.m2/repository/org/infinispan/infinispan-core/8.2.6.Final/infinispan-core-8.2.6.Final.jar
MD5: 06371c22b39aef4faf1da8d21b2102cb
SHA1: 84937a866a56760b9c50bfbca10442fa14be6375
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-blueprint OSGI-INF/blueprint/blueprint.xml Low Vendor manifest Bundle-Description Infinispan core module Medium Vendor pom artifactid infinispan-core Low Vendor pom parent-groupid org.infinispan Medium Vendor central groupid org.infinispan Highest Vendor Manifest Implementation-Vendor-Id org.infinispan Medium Vendor pom groupid infinispan Highest Vendor file name infinispan-core High Vendor Manifest specification-vendor JBoss, a division of Red Hat Low Vendor pom groupid org.infinispan Highest Vendor Manifest bundle-docurl http://www.infinispan.org/ Low Vendor Manifest Implementation-Vendor JBoss, a division of Red Hat High Vendor Manifest bundle-symbolicname org.infinispan.core Medium Vendor pom parent-artifactid infinispan-parent Low Vendor pom description Infinispan core module Medium Vendor pom name Infinispan Core High Product Manifest bundle-blueprint OSGI-INF/blueprint/blueprint.xml Low Product manifest Bundle-Description Infinispan core module Medium Product pom parent-artifactid infinispan-parent Medium Product file name infinispan-core High Product Manifest Bundle-Name Infinispan Core Medium Product Manifest bundle-docurl http://www.infinispan.org/ Low Product pom parent-groupid org.infinispan Low Product Manifest specification-title Infinispan Core Medium Product pom artifactid infinispan-core Highest Product Manifest bundle-symbolicname org.infinispan.core Medium Product Manifest Implementation-Title Infinispan Core High Product pom description Infinispan core module Medium Product pom name Infinispan Core High Product central artifactid infinispan-core Highest Product pom groupid infinispan Low Version pom version 8.2.6.Final Highest Version Manifest Implementation-Version 8.2.6.Final High Version central version 8.2.6.Final Highest Version file version 8.2.6 Highest
Related Dependencies
infinispan-cachestore-jdbc-8.2.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/infinispan/infinispan-cachestore-jdbc/8.2.6.Final/infinispan-cachestore-jdbc-8.2.6.Final.jar
SHA1: 1703f2cae7b2cb483158dca831d68ee711f301ab
MD5: 3ca2e9d4e5ed44fc984fe94c2d943bf2
cpe: cpe:/a:infinispan:infinispan:8.2.6
maven: org.infinispan:infinispan-cachestore-jdbc:8.2.6.Final ✓
infinispan-commons-8.2.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/infinispan/infinispan-commons/8.2.6.Final/infinispan-commons-8.2.6.Final.jar
SHA1: 846b3a39de5f793fb11e70fc70662e4374ffc3c2
MD5: 9da9ef6cf978bf024d377180806414db
cpe: cpe:/a:infinispan:infinispan:8.2.6
maven: org.infinispan:infinispan-commons:8.2.6.Final ✓
Published Vulnerabilities
CVE-2016-0750 suppress
Severity:
Medium
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-15089 suppress
Severity:
Medium
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-2638 suppress
Severity:
Medium
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Vulnerable Software & Versions: (show all )
Description: Core Jackson abstractions, basic JSON streaming API implementation
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.4.2/jackson-core-2.4.2.jar
MD5: 1800d8b5c3324eaa7cff549bad28a98b
SHA1: ceb72830d95c512b4b300a38f29febc85bdf6e4b
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor pom name Jackson-core High Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium Vendor pom artifactid jackson-core Low Vendor manifest Bundle-Description Core Jackson abstractions, basic JSON streaming API implementation Medium Vendor Manifest specification-vendor FasterXML Low Vendor file name jackson-core High Vendor pom parent-artifactid jackson-parent Low Vendor central groupid com.fasterxml.jackson.core Highest Vendor pom description Core Jackson abstractions, basic JSON streaming API implementation
Medium Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor Manifest implementation-build-date 2014-08-13 20:54:03-0700 Low Vendor pom groupid fasterxml.jackson.core Highest Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor Manifest Implementation-Vendor FasterXML High Product pom parent-groupid com.fasterxml.jackson Low Product pom name Jackson-core High Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium Product pom groupid fasterxml.jackson.core Low Product manifest Bundle-Description Core Jackson abstractions, basic JSON streaming API implementation Medium Product Manifest specification-title Jackson-core Medium Product file name jackson-core High Product pom description Core Jackson abstractions, basic JSON streaming API implementation
Medium Product Manifest Bundle-Name Jackson-core Medium Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low Product Manifest implementation-build-date 2014-08-13 20:54:03-0700 Low Product pom parent-artifactid jackson-parent Medium Product pom artifactid jackson-core Highest Product Manifest Implementation-Title Jackson-core High Product pom url http://wiki.fasterxml.com/JacksonHome Medium Product central artifactid jackson-core Highest Version pom version 2.4.2 Highest Version file version 2.4.2 Highest Version Manifest Implementation-Version 2.4.2 High Version central version 2.4.2 Highest
Related Dependencies
jackson-jaxrs-json-provider-2.4.2.jar
jackson-module-jaxb-annotations-2.4.2.jar
jackson-dataformat-yaml-2.4.2.jar
jackson-datatype-joda-2.4.2.jar
jackson-jaxrs-base-2.4.2.jar
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/jaxrs/jackson-jaxrs-base/2.4.2/jackson-jaxrs-base-2.4.2.jar
SHA1: 304e6e60d495095bdae65f80462afc26d76dded4
MD5: 2764d307011e399f6cfde3d931325366
maven: com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:2.4.2 ✓
Description: Core annotations used for value types, used by Jackson data binding package.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.4.0/jackson-annotations-2.4.0.jar
MD5: 6df1b79ec2e57d62106eb47129e4f7a3
SHA1: d6a66c7a5f01cf500377bd669507a08cfeba882a
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor file name jackson-annotations High Vendor pom name Jackson-annotations High Vendor pom description Core annotations used for value types, used by Jackson data binding package.
Medium Vendor Manifest specification-vendor FasterXML Low Vendor pom parent-artifactid jackson-parent Low Vendor central groupid com.fasterxml.jackson.core Highest Vendor Manifest implementation-build-date 2014-05-29 09:46:52-0700 Low Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom groupid fasterxml.jackson.core Highest Vendor manifest Bundle-Description Core annotations used for value types, used by Jackson data binding package. Medium Vendor pom artifactid jackson-annotations Low Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-annotations Medium Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor Manifest Implementation-Vendor FasterXML High Product pom parent-groupid com.fasterxml.jackson Low Product file name jackson-annotations High Product pom groupid fasterxml.jackson.core Low Product pom name Jackson-annotations High Product pom artifactid jackson-annotations Highest Product pom description Core annotations used for value types, used by Jackson data binding package.
Medium Product central artifactid jackson-annotations Highest Product Manifest Implementation-Title Jackson-annotations High Product Manifest implementation-build-date 2014-05-29 09:46:52-0700 Low Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low Product pom parent-artifactid jackson-parent Medium Product manifest Bundle-Description Core annotations used for value types, used by Jackson data binding package. Medium Product Manifest Bundle-Name Jackson-annotations Medium Product pom url http://wiki.fasterxml.com/JacksonHome Medium Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-annotations Medium Product Manifest specification-title Jackson-annotations Medium Version central version 2.4.0 Highest Version file version 2.4.0 Highest Version Manifest Implementation-Version 2.4.0 High Version pom version 2.4.0 Highest
Description: General data-binding functionality for Jackson: works on core streaming API
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.4.2/jackson-databind-2.4.2.jar
MD5: afa5c05ef915babdc720cbe26cc91dca
SHA1: 8e31266a272ad25ac4c089734d93e8d811652c1f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium Vendor file name jackson-databind High Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium Vendor Manifest implementation-build-date 2014-08-13 21:22:55-0700 Low Vendor pom artifactid jackson-databind Low Vendor pom name jackson-databind High Vendor Manifest specification-vendor FasterXML Low Vendor manifest Bundle-Description General data-binding functionality for Jackson: works on core streaming API Medium Vendor pom parent-artifactid jackson-parent Low Vendor central groupid com.fasterxml.jackson.core Highest Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low Vendor pom groupid com.fasterxml.jackson.core Highest Vendor pom groupid fasterxml.jackson.core Highest Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor Manifest Implementation-Vendor FasterXML High Vendor pom description General data-binding functionality for Jackson: works on core streaming API Medium Product pom parent-groupid com.fasterxml.jackson Low Product file name jackson-databind High Product pom groupid fasterxml.jackson.core Low Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium Product Manifest implementation-build-date 2014-08-13 21:22:55-0700 Low Product pom name jackson-databind High Product manifest Bundle-Description General data-binding functionality for Jackson: works on core streaming API Medium Product central artifactid jackson-databind Highest Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low Product Manifest Implementation-Title jackson-databind High Product pom parent-artifactid jackson-parent Medium Product Manifest specification-title jackson-databind Medium Product pom artifactid jackson-databind Highest Product pom url http://wiki.fasterxml.com/JacksonHome Medium Product Manifest Bundle-Name jackson-databind Medium Product pom description General data-binding functionality for Jackson: works on core streaming API Medium Version pom version 2.4.2 Highest Version file version 2.4.2 Highest Version Manifest Implementation-Version 2.4.2 High Version central version 2.4.2 Highest
Published Vulnerabilities
CVE-2017-15095 suppress
Severity:
High
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Vulnerable Software & Versions: (show all )
CVE-2017-17485 suppress
Severity:
High
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
CVE-2017-7525 suppress
Severity:
High
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
BID - 99623
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1462702
CONFIRM - https://cwiki.apache.org/confluence/display/WW/S2-055
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1599
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1723
CONFIRM - https://security.netapp.com/advisory/ntap-20171214-0002/
CONFIRM - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
CONFIRM - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
DEBIAN - DSA-4004
MISC - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
MLIST - [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
REDHAT - RHSA-2017:1834
REDHAT - RHSA-2017:1835
REDHAT - RHSA-2017:1836
REDHAT - RHSA-2017:1837
REDHAT - RHSA-2017:1839
REDHAT - RHSA-2017:1840
REDHAT - RHSA-2017:2477
REDHAT - RHSA-2017:2546
REDHAT - RHSA-2017:2547
REDHAT - RHSA-2017:2633
REDHAT - RHSA-2017:2635
REDHAT - RHSA-2017:2636
REDHAT - RHSA-2017:2637
REDHAT - RHSA-2017:2638
REDHAT - RHSA-2017:3141
REDHAT - RHSA-2017:3454
REDHAT - RHSA-2017:3455
REDHAT - RHSA-2017:3456
REDHAT - RHSA-2017:3458
REDHAT - RHSA-2018:0294
REDHAT - RHSA-2018:0342
REDHAT - RHSA-2018:1449
REDHAT - RHSA-2018:1450
REDHAT - RHSA-2019:0910
SECTRACK - 1039744
SECTRACK - 1039947
SECTRACK - 1040360
Vulnerable Software & Versions: (show all )
CVE-2018-1000873 suppress
Severity:
Medium
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Vulnerable Software & Versions: (show all )
CVE-2018-14719 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14720 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14721 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19360 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19361 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19362 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-5968 suppress
Severity:
Medium
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Vulnerable Software & Versions: (show all )
CVE-2018-7489 suppress
Severity:
High
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
Description: tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API.
License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php
File Path: /home/ciagent/.m2/repository/org/codehaus/woodstox/stax2-api/3.1.4/stax2-api-3.1.4.jar
MD5: c08e89de601b0a78f941b2c29db565c3
SHA1: ac19014b1e6a7c08aad07fe114af792676b685b7
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid org.codehaus.woodstox Highest Vendor pom organization url http://fasterxml.com Medium Vendor Manifest bundle-symbolicname stax2-api Medium Vendor pom name Stax2 API High Vendor pom url http://wiki.fasterxml.com/WoodstoxStax2 Highest Vendor file name stax2-api High Vendor pom organization name fasterxml.com High Vendor Manifest bundle-docurl http://fasterxml.com Low Vendor manifest Bundle-Description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low Vendor pom artifactid stax2-api Low Vendor pom description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low Vendor pom groupid codehaus.woodstox Highest Vendor central groupid org.codehaus.woodstox Highest Product pom artifactid stax2-api Highest Product Manifest bundle-symbolicname stax2-api Medium Product pom name Stax2 API High Product pom organization url http://fasterxml.com Low Product file name stax2-api High Product pom organization name fasterxml.com Low Product Manifest bundle-docurl http://fasterxml.com Low Product manifest Bundle-Description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low Product pom description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low Product Manifest Bundle-Name Stax2 API Medium Product pom groupid codehaus.woodstox Low Product central artifactid stax2-api Highest Product pom url http://wiki.fasterxml.com/WoodstoxStax2 Medium Version central version 3.1.4 Highest Version file version 3.1.4 Highest Version pom version 3.1.4 Highest
Description: Data format extension for Jackson (http://jackson.codehaus.org) to offer
alternative support for serializing POJOs as XML and deserializing XML as pojos.
Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types like JsonGenerator, JsonParser and JsonFactory.
Some data-binding types overridden as well (ObjectMapper sub-classed as XmlMapper).
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-xml/2.4.2/jackson-dataformat-xml-2.4.2.jar
MD5: 1fa55358af6a1364e72e24d9ca4d58e7
SHA1: 02f2d96f68b2d3475452d95dde7a3fbee225f6ae
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid com.fasterxml.jackson.dataformat Highest Vendor manifest Bundle-Description Data format extension for Jackson (http://jackson.codehaus.org) to offeralternative support for serializing POJOs as XML and deserializing XML as pojos.Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low Vendor pom name Jackson-dataformat-XML High Vendor file name jackson-dataformat-xml High Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Low Vendor Manifest implementation-build-date 2014-08-15 18:38:26-0700 Low Vendor central groupid com.fasterxml.jackson.dataformat Highest Vendor Manifest specification-vendor FasterXML Low Vendor pom parent-artifactid jackson-parent Low Vendor Manifest bundle-symbolicname com.fasterxml.jackson.dataformat.jackson-dataformat-xml Medium Vendor pom description Data format extension for Jackson (http://jackson.codehaus.org) to offer
alternative support for serializing POJOs as XML and deserializing XML as pojos.
Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.dataformat Medium Vendor pom groupid fasterxml.jackson.dataformat Highest Vendor pom url http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Highest Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom artifactid jackson-dataformat-xml Low Vendor Manifest Implementation-Vendor FasterXML High Product pom parent-groupid com.fasterxml.jackson Low Product pom url http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Medium Product manifest Bundle-Description Data format extension for Jackson (http://jackson.codehaus.org) to offeralternative support for serializing POJOs as XML and deserializing XML as pojos.Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low Product pom name Jackson-dataformat-XML High Product file name jackson-dataformat-xml High Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Low Product Manifest implementation-build-date 2014-08-15 18:38:26-0700 Low Product Manifest Implementation-Title Jackson-dataformat-XML High Product pom groupid fasterxml.jackson.dataformat Low Product pom artifactid jackson-dataformat-xml Highest Product Manifest Bundle-Name Jackson-dataformat-XML Medium Product central artifactid jackson-dataformat-xml Highest Product Manifest bundle-symbolicname com.fasterxml.jackson.dataformat.jackson-dataformat-xml Medium Product pom description Data format extension for Jackson (http://jackson.codehaus.org) to offer
alternative support for serializing POJOs as XML and deserializing XML as pojos.
Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low Product pom parent-artifactid jackson-parent Medium Product Manifest specification-title Jackson-dataformat-XML Medium Version pom version 2.4.2 Highest Version file version 2.4.2 Highest Version Manifest Implementation-Version 2.4.2 High Version central version 2.4.2 Highest
Published Vulnerabilities
CVE-2016-3720 suppress
Severity:
High
XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
Vulnerable Software & Versions:
CVE-2016-7051 suppress
Severity:
Medium
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
Vulnerable Software & Versions: (show all )
CVE-2017-15095 suppress
Severity:
High
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Vulnerable Software & Versions: (show all )
CVE-2017-17485 suppress
Severity:
High
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
CVE-2017-7525 suppress
Severity:
High
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
BID - 99623
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1462702
CONFIRM - https://cwiki.apache.org/confluence/display/WW/S2-055
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1599
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1723
CONFIRM - https://security.netapp.com/advisory/ntap-20171214-0002/
CONFIRM - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
CONFIRM - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
DEBIAN - DSA-4004
MISC - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
MLIST - [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
REDHAT - RHSA-2017:1834
REDHAT - RHSA-2017:1835
REDHAT - RHSA-2017:1836
REDHAT - RHSA-2017:1837
REDHAT - RHSA-2017:1839
REDHAT - RHSA-2017:1840
REDHAT - RHSA-2017:2477
REDHAT - RHSA-2017:2546
REDHAT - RHSA-2017:2547
REDHAT - RHSA-2017:2633
REDHAT - RHSA-2017:2635
REDHAT - RHSA-2017:2636
REDHAT - RHSA-2017:2637
REDHAT - RHSA-2017:2638
REDHAT - RHSA-2017:3141
REDHAT - RHSA-2017:3454
REDHAT - RHSA-2017:3455
REDHAT - RHSA-2017:3456
REDHAT - RHSA-2017:3458
REDHAT - RHSA-2018:0294
REDHAT - RHSA-2018:0342
REDHAT - RHSA-2018:1449
REDHAT - RHSA-2018:1450
REDHAT - RHSA-2019:0910
SECTRACK - 1039744
SECTRACK - 1039947
SECTRACK - 1040360
Vulnerable Software & Versions: (show all )
CVE-2018-1000873 suppress
Severity:
Medium
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Vulnerable Software & Versions: (show all )
CVE-2018-14719 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14720 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14721 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19360 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19361 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19362 suppress
Severity:
High
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
Description: Date and time library to replace JDK date handling
License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/joda-time/joda-time/2.2/joda-time-2.2.jar
MD5: 226f5207543c490f10f234e82108b998
SHA1: a5f29a7acaddea3f4af307e8cf2d0cc82645fd7d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom organization name Joda.org High Vendor Manifest Implementation-Vendor Joda.org High Vendor pom description Date and time library to replace JDK date handling Medium Vendor pom name Joda time High Vendor file name joda-time High Vendor Manifest specification-vendor Joda.org Low Vendor Manifest extension-name joda-time Medium Vendor central groupid joda-time Highest Vendor Manifest Implementation-Vendor-Id org.joda Medium Vendor pom artifactid joda-time Low Vendor pom url http://joda-time.sourceforge.net Highest Vendor pom groupid joda-time Highest Vendor Manifest bundle-docurl http://joda-time.sourceforge.net/ Low Vendor Manifest bundle-symbolicname joda-time Medium Vendor pom organization url http://www.joda.org Medium Product pom description Date and time library to replace JDK date handling Medium Product pom groupid joda-time Low Product pom name Joda time High Product central artifactid joda-time Highest Product file name joda-time High Product Manifest extension-name joda-time Medium Product pom organization url http://www.joda.org Low Product Manifest Bundle-Name Joda-Time Medium Product pom organization name Joda.org Low Product pom artifactid joda-time Highest Product Manifest Implementation-Title org.joda.time High Product pom url http://joda-time.sourceforge.net Medium Product Manifest specification-title Joda-Time Medium Product Manifest bundle-docurl http://joda-time.sourceforge.net/ Low Product Manifest bundle-symbolicname joda-time Medium Version file version 2.2 Highest Version Manifest Implementation-Version 2.2 High Version central version 2.2 Highest Version pom version 2.2 Highest
Description: Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /home/ciagent/.m2/repository/io/swagger/swagger-annotations/1.5.0/swagger-annotations-1.5.0.jar
MD5: c16eb2bdd9f90e97849950178c4c543d
SHA1: f7497f7887e65277c0dab1da1148cf211083f3d4
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid swagger-annotations Low Vendor manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium Vendor Manifest bundle-symbolicname io.swagger.annotations Medium Vendor pom name swagger-annotations High Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-annotations Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor file name swagger-annotations High Vendor pom groupid io.swagger Highest Vendor central groupid io.swagger Highest Vendor pom parent-artifactid swagger-project Low Product pom artifactid swagger-annotations Highest Product manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium Product pom parent-artifactid swagger-project Medium Product Manifest bundle-symbolicname io.swagger.annotations Medium Product pom name swagger-annotations High Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-annotations Low Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest Bundle-Name swagger-annotations Medium Product central artifactid swagger-annotations Highest Product file name swagger-annotations High Product pom groupid io.swagger Low Version file version 1.5.0 Highest Version central version 1.5.0 Highest Version pom version 1.5.0 Highest
Description: Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/
License:
http://www.apache.org/licenses/LICENSE-2.0.html File Path: /home/ciagent/.m2/repository/io/swagger/swagger-models/1.5.0/swagger-models-1.5.0.jar
MD5: 5c3d553535fddea14a4e7e87c5fc59fa
SHA1: d2566bfc270073a559b342089f54086ee64ca5b1
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium Vendor Manifest bundle-symbolicname io.swagger.models Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom artifactid swagger-models Low Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-models Low Vendor pom name swagger-models High Vendor pom groupid io.swagger Highest Vendor file name swagger-models High Vendor central groupid io.swagger Highest Vendor pom parent-artifactid swagger-project Low Product manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium Product Manifest bundle-symbolicname io.swagger.models Medium Product pom parent-artifactid swagger-project Medium Product pom artifactid swagger-models Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest Bundle-Name swagger-models Medium Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-models Low Product pom name swagger-models High Product central artifactid swagger-models Highest Product file name swagger-models High Product pom groupid io.swagger Low Version file version 1.5.0 Highest Version central version 1.5.0 Highest Version pom version 1.5.0 Highest
Description:
Bean Validation API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/javax/validation/validation-api/1.1.0.Final/validation-api-1.1.0.Final.jar
MD5: 4c257f52462860b62ab3cdab45f53082
SHA1: 8613ae82954779d518631e05daa73a6a954817d5
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor central groupid javax.validation Highest Vendor Manifest bundle-symbolicname javax.validation.api Medium Vendor pom url http://beanvalidation.org Highest Vendor pom groupid javax.validation Highest Vendor pom description
Bean Validation API
Medium Vendor pom name Bean Validation API High Vendor file name validation-api High Vendor manifest Bundle-Description Bean Validation API Medium Vendor pom artifactid validation-api Low Product pom artifactid validation-api Highest Product Manifest Bundle-Name Bean Validation API Medium Product Manifest bundle-symbolicname javax.validation.api Medium Product pom description
Bean Validation API
Medium Product pom url http://beanvalidation.org Medium Product pom name Bean Validation API High Product file name validation-api High Product pom groupid javax.validation Low Product manifest Bundle-Description Bean Validation API Medium Product central artifactid validation-api Highest Version file version 1.1.0 Highest Version central version 1.1.0.Final Highest Version pom version 1.1.0.Final Highest
File Path: /home/ciagent/.m2/repository/io/swagger/swagger-core/1.5.0/swagger-core-1.5.0.jarMD5: abc2015d9e823cb96abfa7e2937b43fbSHA1: 09d5cfb8188ac316bad3a7b38c46bac0568c60e4
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name swagger-core High Vendor file name swagger-core High Vendor pom groupid io.swagger Highest Vendor pom artifactid swagger-core Low Vendor central groupid io.swagger Highest Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-core Low Vendor pom parent-artifactid swagger-project Low Product pom name swagger-core High Product pom parent-artifactid swagger-project Medium Product file name swagger-core High Product central artifactid swagger-core Highest Product pom groupid io.swagger Low Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-core Low Product pom artifactid swagger-core Highest Version file version 1.5.0 Highest Version central version 1.5.0 Highest Version pom version 1.5.0 Highest
License:
CDDL License
: http://www.opensource.org/licenses/cddl1.php
File Path: /home/ciagent/.m2/repository/javax/ws/rs/jsr311-api/1.1.1/jsr311-api-1.1.1.jar
MD5: c9803468299ec255c047a280ddec510f
SHA1: 59033da2a1afd56af1ac576750a8d0b1830d59e6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest bundle-docurl http://www.sun.com/ Low Vendor pom artifactid jsr311-api Low Vendor pom url https://jsr311.dev.java.net Highest Vendor Manifest bundle-symbolicname javax.ws.rs.jsr311-api Medium Vendor pom organization name Sun Microsystems, Inc High Vendor pom organization url http://www.sun.com/ Medium Vendor pom name jsr311-api High Vendor central groupid javax.ws.rs Highest Vendor Manifest extension-name javax.ws.rs Medium Vendor Manifest specification-vendor Sun Microsystems, Inc. Low Vendor pom groupid javax.ws.rs Highest Vendor file name jsr311-api High Product Manifest bundle-docurl http://www.sun.com/ Low Product Manifest bundle-symbolicname javax.ws.rs.jsr311-api Medium Product pom name jsr311-api High Product pom url https://jsr311.dev.java.net Medium Product pom organization url http://www.sun.com/ Low Product central artifactid jsr311-api Highest Product Manifest extension-name javax.ws.rs Medium Product pom groupid javax.ws.rs Low Product pom artifactid jsr311-api Highest Product pom organization name Sun Microsystems, Inc Low Product Manifest specification-title JAX-RS: Java API for RESTful Web Services Medium Product Manifest Bundle-Name jsr311-api Medium Product file name jsr311-api High Version file version 1.1.1 Highest Version central version 1.1.1 Highest Version pom version 1.1.1 Highest
Description:
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation
simple. It is a class library for editing bytecodes in Java.
License:
MPL 1.1: http://www.mozilla.org/MPL/MPL-1.1.html
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Apache License 2.0: http://www.apache.org/licenses/
File Path: /home/ciagent/.m2/repository/org/javassist/javassist/3.20.0-GA/javassist-3.20.0-GA.jar
MD5: a89dd7907d76e061ec2c07e762a74256
SHA1: a9cbcdfb7e9f86fbc74d3afae65f2248bfbf82a0
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom url http://www.javassist.org/ Highest Vendor pom description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low Vendor pom groupid org.javassist Highest Vendor manifest Bundle-Description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low Vendor Manifest bundle-symbolicname javassist Medium Vendor pom artifactid javassist Low Vendor pom organization name Shigeru Chiba, www.javassist.org High Vendor pom name Javassist High Vendor central groupid org.javassist Highest Vendor file name javassist High Vendor Manifest specification-vendor Shigeru Chiba, www.javassist.org Low Vendor pom groupid javassist Highest Product pom description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low Product manifest Bundle-Description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low Product pom organization name Shigeru Chiba, www.javassist.org Low Product pom url http://www.javassist.org/ Medium Product Manifest bundle-symbolicname javassist Medium Product pom name Javassist High Product pom groupid javassist Low Product central artifactid javassist Highest Product file name javassist High Product pom artifactid javassist Highest Product Manifest Bundle-Name Javassist Medium Product Manifest specification-title Javassist Medium Version pom version 3.20.0-GA Highest Version central version 3.20.0-GA Highest Version file version 3.20.0 Highest
Description: Annotation supports the FindBugs tool
License:
GNU Lesser Public License: http://www.gnu.org/licenses/lgpl.html
File Path: /home/ciagent/.m2/repository/com/google/code/findbugs/annotations/2.0.1/annotations-2.0.1.jar
MD5: 35ef911c85603829ded63f211feb2d68
SHA1: 9ef6656259841cebfb9fb0697bb122ada4485498
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description Annotation supports the FindBugs tool Medium Vendor pom artifactid annotations Low Vendor Manifest bundle-symbolicname findbugsAnnotations Medium Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor central groupid com.google.code.findbugs Highest Vendor file name annotations High Vendor pom name FindBugs-Annotations High Vendor pom url http://findbugs.sourceforge.net/ Highest Vendor pom groupid com.google.code.findbugs Highest Vendor pom groupid google.code.findbugs Highest Product pom artifactid annotations Highest Product pom description Annotation supports the FindBugs tool Medium Product central artifactid annotations Highest Product pom url http://findbugs.sourceforge.net/ Medium Product Manifest Bundle-Name FindbugsAnnotations Medium Product Manifest bundle-symbolicname findbugsAnnotations Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product file name annotations High Product pom name FindBugs-Annotations High Product pom groupid google.code.findbugs Low Version file version 2.0.1 Highest Version central version 2.0.1 Highest Version pom version 2.0.1 Highest
Description: Reflections - a Java runtime metadata analysis
License:
WTFPL: http://www.wtfpl.net/
The New BSD License: http://www.opensource.org/licenses/bsd-license.html
File Path: /home/ciagent/.m2/repository/org/reflections/reflections/0.9.9/reflections-0.9.9.jar
MD5: 5f13944b355f927f956b6298136ad959
SHA1: 0296d8adb2f22a38025f44b45cac89835ff0bbaf
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid org.reflections Highest Vendor pom description Reflections - a Java runtime metadata analysis Medium Vendor pom artifactid reflections Low Vendor file name reflections High Vendor jar package name reflections Low Vendor pom groupid reflections Highest Vendor central groupid org.reflections Highest Vendor pom name Reflections High Vendor pom url http://github.com/ronmamo/reflections Highest Product pom description Reflections - a Java runtime metadata analysis Medium Product pom url http://github.com/ronmamo/reflections Medium Product file name reflections High Product central artifactid reflections Highest Product pom groupid reflections Low Product pom name Reflections High Product pom artifactid reflections Highest Version pom version 0.9.9 Highest Version central version 0.9.9 Highest Version file version 0.9.9 Highest
File Path: /home/ciagent/.m2/repository/io/swagger/swagger-jaxrs/1.5.0/swagger-jaxrs-1.5.0.jarMD5: a09d96c899411ac57a479c6635829600SHA1: 04a77f3f95bfec3073d9d20660c16f54886dfc9f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-jaxrs Low Vendor pom name swagger-jaxrs High Vendor pom artifactid swagger-jaxrs Low Vendor file name swagger-jaxrs High Vendor pom groupid io.swagger Highest Vendor central groupid io.swagger Highest Vendor pom parent-artifactid swagger-project Low Product pom artifactid swagger-jaxrs Highest Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-jaxrs Low Product pom name swagger-jaxrs High Product pom parent-artifactid swagger-project Medium Product file name swagger-jaxrs High Product central artifactid swagger-jaxrs Highest Product pom groupid io.swagger Low Version file version 1.5.0 Highest Version central version 1.5.0 Highest Version pom version 1.5.0 Highest
File Path: /home/ciagent/.m2/repository/org/gatein/common/common-logging/2.2.2.Final/common-logging-2.2.2.Final.jarMD5: 28b7108ee63899bca08636d360e7df11SHA1: aee18008518671fb10982c0fe5f7383e98f71c47
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low Vendor Manifest implementation-url www.gatein.org/common-parent/common-logging/ Low Vendor pom name GateIn - Common component (logging) High Vendor central groupid org.gatein.common Highest Vendor Manifest Implementation-Vendor-Id org.gatein.common Medium Vendor pom parent-groupid org.gatein.common Medium Vendor pom parent-artifactid common-parent Low Vendor file name common-logging High Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom groupid gatein.common Highest Vendor pom artifactid common-logging Low Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor pom groupid org.gatein.common Highest Product Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low Product Manifest implementation-url www.gatein.org/common-parent/common-logging/ Low Product pom name GateIn - Common component (logging) High Product pom artifactid common-logging Highest Product Manifest specification-title GateIn - Common component (logging) Medium Product pom parent-artifactid common-parent Medium Product file name common-logging High Product Manifest os-name Linux Medium Product pom groupid gatein.common Low Product pom parent-groupid org.gatein.common Low Product Manifest Implementation-Title GateIn - Common component (logging) High Product central artifactid common-logging Highest Version central version 2.2.2.Final Highest Version Manifest Implementation-Version 2.2.2.Final High Version pom version 2.2.2.Final Highest Version file version 2.2.2 Highest
Description: API of the Object Model for Portal
File Path: /home/ciagent/.m2/repository/org/gatein/mop/mop-api/1.3.2.Final/mop-api-1.3.2.Final.jarMD5: 4f2c10678f3c5850bb85c25514469e2eSHA1: 78f9c03a23ec1c3564e827d3927ce53eca6d919d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom parent-artifactid mop-parent Low Vendor Manifest implementation-url www.gatein.org/mop-parent/mop-api/ Low Vendor pom description API of the Object Model for Portal Medium Vendor file name mop-api High Vendor pom artifactid mop-api Low Vendor pom name MOP API High Vendor Manifest Implementation-Vendor-Id org.gatein.mop Medium Vendor Manifest java-vendor Oracle Corporation Medium Vendor pom groupid gatein.mop Highest Vendor pom groupid org.gatein.mop Highest Vendor Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low Vendor pom parent-groupid org.gatein.mop Medium Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest os-name Mac OS X Medium Product pom artifactid mop-api Highest Product pom groupid gatein.mop Low Product Manifest Implementation-Title MOP API High Product Manifest specification-title MOP API Medium Product Manifest implementation-url www.gatein.org/mop-parent/mop-api/ Low Product pom description API of the Object Model for Portal Medium Product file name mop-api High Product pom parent-groupid org.gatein.mop Low Product pom name MOP API High Product Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low Product pom parent-artifactid mop-parent Medium Product Manifest os-name Mac OS X Medium Version Manifest Implementation-Version 1.3.2.Final High Version file version 1.3.2 Highest Version pom version 1.3.2.Final Highest
maven: org.gatein.mop:mop-api:1.3.2.Final
Confidence :High
Description: SPI of the Object Model for Portal
File Path: /home/ciagent/.m2/repository/org/gatein/mop/mop-spi/1.3.2.Final/mop-spi-1.3.2.Final.jarMD5: 6ef18d761e625d923ec01c6e5283026eSHA1: 4fe3a673d58c85d2f6c9ad4446b90229f46c8987
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description SPI of the Object Model for Portal Medium Vendor pom parent-artifactid mop-parent Low Vendor file name mop-spi High Vendor Manifest Implementation-Vendor-Id org.gatein.mop Medium Vendor Manifest java-vendor Oracle Corporation Medium Vendor pom groupid gatein.mop Highest Vendor pom artifactid mop-spi Low Vendor pom groupid org.gatein.mop Highest Vendor Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low Vendor Manifest implementation-url www.gatein.org/mop-parent/mop-spi/ Low Vendor pom parent-groupid org.gatein.mop Medium Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor pom name MOP SPI High Vendor Manifest os-name Mac OS X Medium Product Manifest Implementation-Title MOP SPI High Product pom description SPI of the Object Model for Portal Medium Product pom artifactid mop-spi Highest Product pom groupid gatein.mop Low Product file name mop-spi High Product pom parent-groupid org.gatein.mop Low Product Manifest specification-title MOP SPI Medium Product Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low Product Manifest implementation-url www.gatein.org/mop-parent/mop-spi/ Low Product pom parent-artifactid mop-parent Medium Product pom name MOP SPI High Product Manifest os-name Mac OS X Medium Version Manifest Implementation-Version 1.3.2.Final High Version file version 1.3.2 Highest Version pom version 1.3.2.Final Highest
maven: org.gatein.mop:mop-spi:1.3.2.Final
Confidence :High
Description: Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.
License:
Day License: http://www.day.com/maven/jsr170/licenses/day-spec-license.htm
File Path: /home/ciagent/.m2/repository/javax/jcr/jcr/1.0.1/jcr-1.0.1.jar
MD5: 4639c7b994528948dab1a4feb1f68d6f
SHA1: 567ee103cf7592e3cf036e1bf4e2e06b9f08e1a1
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor file name jcr High Vendor pom name Content Repository for Java Technology API High Vendor pom groupid javax.jcr Highest Vendor Manifest extension-name jcr Medium Vendor pom artifactid jcr Low Vendor pom organization name Day Software Management AG High Vendor Manifest Implementation-Vendor Day Software Management AG High Vendor pom description Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation. Low Vendor pom url http://www.jcp.org/en/jsr/detail?id=170 Highest Vendor Manifest specification-vendor Day Software Management AG Low Vendor pom organization url http://www.day.com/ Medium Product file name jcr High Product pom name Content Repository for Java Technology API High Product pom organization url http://www.day.com/ Low Product Manifest Implementation-Title javax.jcr High Product pom artifactid jcr Highest Product Manifest specification-title Content Repository for Java Technology API Medium Product Manifest extension-name jcr Medium Product pom organization name Day Software Management AG Low Product pom url http://www.jcp.org/en/jsr/detail?id=170 Medium Product pom groupid javax.jcr Low Product pom description Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation. Low Version file version 1.0.1 Highest Version Manifest Implementation-Version 1.0.1 High Version pom version 1.0.1 Highest
cpe: cpe:/a:content_project:content:1.0.1
Confidence :Low
suppress
maven: javax.jcr:jcr:1.0.1
Confidence :High
Published Vulnerabilities
CVE-2017-16111 suppress
Severity:
Medium
The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.
Vulnerable Software & Versions:
Description: Chromattic Framework Extensions
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.ext/1.3.0/chromattic.ext-1.3.0.jarMD5: a8482bb9fe7572e77a58627251740ee1SHA1: ea3bd25892c827d9b830aea768de69e200a93165
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name ext Low Vendor jar package name chromattic Low Vendor file name chromattic.ext High Vendor pom groupid chromattic Highest Vendor pom groupid org.chromattic Highest Vendor pom name Chromattic Framework Extensions High Vendor central groupid org.chromattic Highest Vendor jar package name ntdef Low Vendor pom artifactid chromattic.ext Low Vendor pom parent-artifactid chromattic.parent Low Vendor pom parent-groupid org.chromattic Medium Vendor pom description Chromattic Framework Extensions Medium Product jar package name ext Low Product pom groupid chromattic Low Product file name chromattic.ext High Product pom parent-groupid org.chromattic Low Product pom description Chromattic Framework Extensions Medium Product central artifactid chromattic.ext Highest Product pom name Chromattic Framework Extensions High Product pom parent-artifactid chromattic.parent Medium Product pom artifactid chromattic.ext Highest Product jar package name ntdef Low Version file version 1.3.0 Highest Version central version 1.3.0 Highest Version pom version 1.3.0 Highest
Description: The Reflext Framework Java Lang Reflect Plugin
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.jlr/1.1.0/reflext.jlr-1.1.0.jarMD5: 1103f3b1ed3762e0bd100cbee6e7f345SHA1: 79ad1a5053213cbb350d37ff12d5f767243c8c46
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid reflext Highest Vendor pom name Reflext Framework Java Lang Reflect Plugin High Vendor central groupid org.reflext Highest Vendor pom artifactid reflext.jlr Low Vendor pom groupid org.reflext Highest Vendor file name reflext.jlr High Vendor pom parent-artifactid reflext.parent Low Vendor pom parent-groupid org.reflext Medium Vendor jar package name reflext Low Vendor jar package name jlr Low Vendor pom description The Reflext Framework Java Lang Reflect Plugin Medium Product pom artifactid reflext.jlr Highest Product pom groupid reflext Low Product pom name Reflext Framework Java Lang Reflect Plugin High Product central artifactid reflext.jlr Highest Product file name reflext.jlr High Product pom parent-artifactid reflext.parent Medium Product jar package name jlr Low Product pom description The Reflext Framework Java Lang Reflect Plugin Medium Product pom parent-groupid org.reflext Low Version file version 1.1.0 Highest Version central version 1.1.0 Highest Version pom version 1.1.0 Highest
Description: Chromattic Framework Metamodel
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.metamodel/1.3.0/chromattic.metamodel-1.3.0.jarMD5: 0d534975c688ebabbc232601c6bc13daSHA1: fbaa10037faf34a2d4d8eeb4e6b5ce28c95a9455
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description Chromattic Framework Metamodel Medium Vendor pom parent-artifactid chromattic.parent Low Vendor jar package name chromattic Low Vendor pom groupid chromattic Highest Vendor jar package name metamodel Low Vendor pom parent-groupid org.chromattic Medium Vendor pom artifactid chromattic.metamodel Low Vendor pom groupid org.chromattic Highest Vendor file name chromattic.metamodel High Vendor central groupid org.chromattic Highest Vendor pom name Chromattic Framework Metamodel High Product central artifactid chromattic.metamodel Highest Product pom artifactid chromattic.metamodel Highest Product pom description Chromattic Framework Metamodel Medium Product pom groupid chromattic Low Product pom parent-groupid org.chromattic Low Product jar package name metamodel Low Product file name chromattic.metamodel High Product pom parent-artifactid chromattic.parent Medium Product pom name Chromattic Framework Metamodel High Version file version 1.3.0 Highest Version central version 1.3.0 Highest Version pom version 1.3.0 Highest
Description: The Reflext Framework API
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.api/1.1.0/reflext.api-1.1.0.jarMD5: fe732172fa2fb5ae4b63866ef15da41fSHA1: 28374c509099736aeedc52fef3d7b8e78238c2a0
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name api Low Vendor file name reflext.api High Vendor pom groupid reflext Highest Vendor central groupid org.reflext Highest Vendor pom groupid org.reflext Highest Vendor pom parent-artifactid reflext.parent Low Vendor pom parent-groupid org.reflext Medium Vendor jar package name reflext Low Vendor pom artifactid reflext.api Low Vendor pom description The Reflext Framework API Medium Vendor pom name Reflext Framework API High Product jar package name api Low Product file name reflext.api High Product pom groupid reflext Low Product pom artifactid reflext.api Highest Product pom parent-artifactid reflext.parent Medium Product central artifactid reflext.api Highest Product pom description The Reflext Framework API Medium Product pom name Reflext Framework API High Product pom parent-groupid org.reflext Low Version file version 1.1.0 Highest Version central version 1.1.0 Highest Version pom version 1.1.0 Highest
Description: The Reflect Framework Core
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.core/1.1.0/reflext.core-1.1.0.jarMD5: cc65231f60a70dec43a57ccba5adce81SHA1: 56316a714b99d7ac85d23d0f1a4680149c3273d6
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid reflext Highest Vendor pom artifactid reflext.core Low Vendor central groupid org.reflext Highest Vendor pom name Reflext Framework Core High Vendor pom groupid org.reflext Highest Vendor pom parent-artifactid reflext.parent Low Vendor pom parent-groupid org.reflext Medium Vendor jar package name reflext Low Vendor jar package name core Low Vendor pom description The Reflect Framework Core Medium Vendor file name reflext.core High Product pom groupid reflext Low Product pom name Reflext Framework Core High Product pom artifactid reflext.core Highest Product pom parent-artifactid reflext.parent Medium Product jar package name core Low Product pom description The Reflect Framework Core Medium Product central artifactid reflext.core Highest Product file name reflext.core High Product pom parent-groupid org.reflext Low Version file version 1.1.0 Highest Version central version 1.1.0 Highest Version pom version 1.1.0 Highest
Description: The Reflext Framework SPI
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.spi/1.1.0/reflext.spi-1.1.0.jarMD5: 2c967ae0c3078d23b615f8825377f304SHA1: 4df0428c39922079c53955602bce66735f9d20a8
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid reflext Highest Vendor jar package name model Low Vendor pom name Reflext Framework SPI High Vendor pom groupid org.reflext Highest Vendor pom parent-groupid org.reflext Medium Vendor jar package name reflext Low Vendor pom description The Reflext Framework SPI Medium Vendor central groupid org.reflext Highest Vendor jar package name spi Low Vendor pom artifactid reflext.spi Low Vendor pom parent-artifactid reflext.parent Low Vendor file name reflext.spi High Product pom description The Reflext Framework SPI Medium Product central artifactid reflext.spi Highest Product pom groupid reflext Low Product pom artifactid reflext.spi Highest Product jar package name model Low Product pom name Reflext Framework SPI High Product jar package name spi Low Product pom parent-artifactid reflext.parent Medium Product file name reflext.spi High Product pom parent-groupid org.reflext Low Version file version 1.1.0 Highest Version central version 1.1.0 Highest Version pom version 1.1.0 Highest
Description: The Reflext Framework Annotation Processing Tool Plugin
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.apt/1.1.0/reflext.apt-1.1.0.jarMD5: e6bb0195d6cdd15b618939c78999ea4eSHA1: 093ab21e03197c1c7a2d2d20da4d3dd34a60ac24
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description The Reflext Framework Annotation Processing Tool Plugin Medium Vendor jar package name apt Low Vendor pom groupid reflext Highest Vendor file name reflext.apt High Vendor central groupid org.reflext Highest Vendor pom groupid org.reflext Highest Vendor pom parent-artifactid reflext.parent Low Vendor pom parent-groupid org.reflext Medium Vendor jar package name reflext Low Vendor pom name Reflext Framework Annotation Processing Tool Plugin High Vendor pom artifactid reflext.apt Low Product pom description The Reflext Framework Annotation Processing Tool Plugin Medium Product pom groupid reflext Low Product jar package name apt Low Product file name reflext.apt High Product pom artifactid reflext.apt Highest Product pom parent-artifactid reflext.parent Medium Product pom name Reflext Framework Annotation Processing Tool Plugin High Product central artifactid reflext.apt Highest Product pom parent-groupid org.reflext Low Version file version 1.1.0 Highest Version central version 1.1.0 Highest Version pom version 1.1.0 Highest
Published Vulnerabilities
CVE-2018-1000840 suppress
Severity:
Medium
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
Vulnerable Software & Versions:
Description: Chromattic Framework APT Plugin
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.apt/1.3.0/chromattic.apt-1.3.0.jarMD5: 5f51682435a2e2014a9bd9c5936a5cc5SHA1: f2e219c2b8e13983a26b4c3f4e8eb54d71730b4d
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid chromattic.apt Low Vendor pom name Chromattic Framework APT Plugin High Vendor jar package name apt Low Vendor pom parent-artifactid chromattic.parent Low Vendor jar package name chromattic Low Vendor pom groupid chromattic Highest Vendor pom parent-groupid org.chromattic Medium Vendor pom groupid org.chromattic Highest Vendor central groupid org.chromattic Highest Vendor pom description Chromattic Framework APT Plugin Medium Vendor file name chromattic.apt High Product pom name Chromattic Framework APT Plugin High Product jar package name apt Low Product pom groupid chromattic Low Product pom parent-groupid org.chromattic Low Product pom artifactid chromattic.apt Highest Product central artifactid chromattic.apt Highest Product pom parent-artifactid chromattic.parent Medium Product pom description Chromattic Framework APT Plugin Medium Product file name chromattic.apt High Version file version 1.3.0 Highest Version central version 1.3.0 Highest Version pom version 1.3.0 Highest
Description: The slf4j API
File Path: /home/ciagent/.m2/repository/org/slf4j/slf4j-api/1.7.18/slf4j-api-1.7.18.jarMD5: 1b1d1af21206ac5ae44cd79a6c04dd92SHA1: b631d286463ced7cc42ee2171fe3beaed2836823
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom name SLF4J API Module High Vendor file name slf4j-api High Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor pom groupid org.slf4j Highest Vendor manifest Bundle-Description The slf4j API Medium Vendor central groupid org.slf4j Highest Vendor pom parent-groupid org.slf4j Medium Vendor pom artifactid slf4j-api Low Vendor pom groupid slf4j Highest Vendor pom url http://www.slf4j.org Highest Vendor Manifest bundle-symbolicname slf4j.api Medium Vendor pom parent-artifactid slf4j-parent Low Vendor pom description The slf4j API Medium Product pom name SLF4J API Module High Product file name slf4j-api High Product pom groupid slf4j Low Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product central artifactid slf4j-api Highest Product manifest Bundle-Description The slf4j API Medium Product pom parent-groupid org.slf4j Low Product Manifest Implementation-Title slf4j-api High Product Manifest Bundle-Name slf4j-api Medium Product pom artifactid slf4j-api Highest Product Manifest bundle-symbolicname slf4j.api Medium Product pom description The slf4j API Medium Version pom version 1.7.18 Highest Version file version 1.7.18 Highest Version Manifest Implementation-Version 1.7.18 High Version central version 1.7.18 Highest
Description: Chromattic Framework Common
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.common/1.3.0/chromattic.common-1.3.0.jarMD5: 15bfb4cc0312aefffb25952cdf18b2cdSHA1: 55470175c1ba46a917504acf97018e6ef2932659
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor jar package name chromattic Low Vendor file name chromattic.common High Vendor pom groupid chromattic Highest Vendor jar package name common Low Vendor pom groupid org.chromattic Highest Vendor central groupid org.chromattic Highest Vendor pom description Chromattic Framework Common Medium Vendor pom parent-artifactid chromattic.parent Low Vendor jar package name collection Low Vendor pom parent-groupid org.chromattic Medium Vendor pom name Chromattic Framework Common High Vendor pom artifactid chromattic.common Low Product pom description Chromattic Framework Common Medium Product pom groupid chromattic Low Product jar package name collection Low Product central artifactid chromattic.common Highest Product file name chromattic.common High Product pom parent-groupid org.chromattic Low Product jar package name common Low Product pom name Chromattic Framework Common High Product pom artifactid chromattic.common Highest Product pom parent-artifactid chromattic.parent Medium Version file version 1.3.0 Highest Version central version 1.3.0 Highest Version pom version 1.3.0 Highest
Description: Model Object for Portal Core
File Path: /home/ciagent/.m2/repository/org/gatein/mop/mop-core/1.3.2.Final/mop-core-1.3.2.Final.jarMD5: 7d5eb7a5c2ed2d88362f9d8a9413a475SHA1: d27e4c960aefd919f7c25049b72a9bc225cd6548
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom description Model Object for Portal Core Medium Vendor file name mop-core High Vendor pom parent-artifactid mop-parent Low Vendor Manifest Implementation-Vendor-Id org.gatein.mop Medium Vendor Manifest java-vendor Oracle Corporation Medium Vendor pom groupid gatein.mop Highest Vendor pom groupid org.gatein.mop Highest Vendor Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low Vendor pom parent-groupid org.gatein.mop Medium Vendor Manifest implementation-url www.gatein.org/mop-parent/mop-core/ Low Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor pom artifactid mop-core Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest os-name Mac OS X Medium Vendor pom name MOP Core High Product Manifest specification-title MOP Core Medium Product Manifest Implementation-Title MOP Core High Product pom description Model Object for Portal Core Medium Product file name mop-core High Product pom groupid gatein.mop Low Product pom artifactid mop-core Highest Product pom parent-groupid org.gatein.mop Low Product Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low Product Manifest implementation-url www.gatein.org/mop-parent/mop-core/ Low Product pom parent-artifactid mop-parent Medium Product Manifest os-name Mac OS X Medium Product pom name MOP Core High Version Manifest Implementation-Version 1.3.2.Final High Version file version 1.3.2 Highest Version pom version 1.3.2.Final Highest
maven: org.gatein.mop:mop-core:1.3.2.Final
Confidence :High
File Path: /home/ciagent/.m2/repository/org/gatein/management/gatein-management-api/2.1.0.Final/gatein-management-api-2.1.0.Final.jarMD5: dde253e45fefd580cab7a4ee75c6d92eSHA1: 5c73b152fe9497eb37386052f86bfa7ee7d33b87
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom artifactid gatein-management-api Low Vendor pom groupid gatein.management Highest Vendor pom parent-artifactid gatein-management-parent Low Vendor pom name GateIn Management - API High Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom parent-groupid org.gatein.management Medium Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-api/ Low Vendor Manifest Implementation-Vendor-Id org.gatein.management Medium Vendor pom groupid org.gatein.management Highest Vendor file name gatein-management-api High Vendor Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low Product pom parent-groupid org.gatein.management Low Product pom groupid gatein.management Low Product Manifest specification-title GateIn Management - API Medium Product pom artifactid gatein-management-api Highest Product pom parent-artifactid gatein-management-parent Medium Product Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-api/ Low Product Manifest Implementation-Title GateIn Management - API High Product pom name GateIn Management - API High Product file name gatein-management-api High Product Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low Product Manifest os-name Linux Medium Version file version 2.1.0 Highest Version Manifest Implementation-Version 2.1.0.Final High Version pom version 2.1.0.Final Highest
maven: org.gatein.management:gatein-management-api:2.1.0.Final
Confidence :High
File Path: /home/ciagent/.m2/repository/org/gatein/management/gatein-management-spi/2.1.0.Final/gatein-management-spi-2.1.0.Final.jarMD5: 4e10565858662ec9eea75cfbd3544ba1SHA1: 79670b2dd849b49e145b7122cbff4ef83116157f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-spi/ Low Vendor pom artifactid gatein-management-spi Low Vendor pom name GateIn Management - SPI High Vendor pom groupid gatein.management Highest Vendor pom parent-artifactid gatein-management-parent Low Vendor Manifest java-vendor Oracle Corporation Medium Vendor Manifest os-name Linux Medium Vendor pom parent-groupid org.gatein.management Medium Vendor Manifest specification-vendor JBoss by Red Hat Low Vendor file name gatein-management-spi High Vendor Manifest Implementation-Vendor JBoss by Red Hat High Vendor Manifest Implementation-Vendor-Id org.gatein.management Medium Vendor pom groupid org.gatein.management Highest Vendor Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low Product Manifest Implementation-Title GateIn Management - SPI High Product Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-spi/ Low Product Manifest specification-title GateIn Management - SPI Medium Product pom parent-groupid org.gatein.management Low Product pom groupid gatein.management Low Product file name gatein-management-spi High Product pom name GateIn Management - SPI High Product pom parent-artifactid gatein-management-parent Medium Product pom artifactid gatein-management-spi Highest Product Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low Product Manifest os-name Linux Medium Version file version 2.1.0 Highest Version Manifest Implementation-Version 2.1.0.Final High Version pom version 2.1.0.Final Highest
maven: org.gatein.management:gatein-management-spi:2.1.0.Final
Confidence :High
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/ciagent/.m2/repository/org/apache/commons/commons-lang3/3.3.2/commons-lang3-3.3.2.jar
MD5: 3128bf75a2549ebe38663401191bacab
SHA1: 90a3822c38ec8c996e84c16a3477ef632cbc87a3
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid apache.commons Highest Vendor pom parent-artifactid commons-parent Low Vendor pom groupid org.apache.commons Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor manifest Bundle-Description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Vendor pom url http://commons.apache.org/proper/commons-lang/ Highest Vendor pom artifactid commons-lang3 Low Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Vendor pom description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest implementation-build tags/LANG_3_3_2_RC1@r1585295; 2014-04-06 14:18:52+0200 Low Vendor file name commons-lang3 High Vendor central groupid org.apache.commons Highest Vendor Manifest bundle-symbolicname org.apache.commons.lang3 Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom name Apache Commons Lang High Product pom url http://commons.apache.org/proper/commons-lang/ Medium Product manifest Bundle-Description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low Product Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Product pom description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low Product pom artifactid commons-lang3 Highest Product pom parent-groupid org.apache.commons Low Product Manifest Bundle-Name Apache Commons Lang Medium Product Manifest implementation-build tags/LANG_3_3_2_RC1@r1585295; 2014-04-06 14:18:52+0200 Low Product file name commons-lang3 High Product pom parent-artifactid commons-parent Medium Product pom groupid apache.commons Low Product Manifest Implementation-Title Apache Commons Lang High Product Manifest specification-title Apache Commons Lang Medium Product Manifest bundle-symbolicname org.apache.commons.lang3 Medium Product central artifactid commons-lang3 Highest Product pom name Apache Commons Lang High Version file version 3.3.2 Highest Version pom version 3.3.2 Highest Version Manifest Implementation-Version 3.3.2 High Version central version 3.3.2 Highest
File Path: /home/ciagent/.m2/repository/org/staxnav/staxnav.core/0.9.8/staxnav.core-0.9.8.jarMD5: 0f786e5be21df9fbe8753175564564c7SHA1: 27bd12d4d74b0851e38de79f8299462d93ba3d7f
Referenced In Project/Scope:
eXo PLF:: WCM Resources:runtime
Evidence
Type Source Name Value Confidence Vendor pom groupid staxnav Highest Vendor pom parent-artifactid staxnav.parent Low Vendor pom artifactid staxnav.core Low Vendor central groupid org.staxnav Highest Vendor pom name Staxnav - Core High Vendor file name staxnav.core High Vendor pom parent-groupid org.staxnav Medium Vendor pom groupid org.staxnav Highest Vendor jar package name staxnav Low Product pom artifactid staxnav.core Highest Product pom parent-groupid org.staxnav Low Product pom name Staxnav - Core High Product central artifactid staxnav.core Highest Product file name staxnav.core High Product pom parent-artifactid staxnav.parent Medium Product pom groupid staxnav Low Version central version 0.9.8 Highest Version file version 0.9.8 Highest Version pom version 0.9.8 Highest
Description: JBoss Marshalling API
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling/pom.xmlMD5: 2b0e9541ec4a0f19e378eaabc5e85ea0SHA1: da91abf3554dceed9454faa89acafc48c0649df5
Evidence
Type Source Name Value Confidence Vendor pom name JBoss Marshalling API High Vendor pom artifactid jboss-marshalling Low Vendor pom parent-artifactid jboss-marshalling-parent Low Vendor pom groupid jboss.marshalling Highest Vendor pom description JBoss Marshalling API Medium Vendor pom parent-groupid org.jboss.marshalling Medium Product pom name JBoss Marshalling API High Product pom parent-groupid org.jboss.marshalling Low Product pom parent-artifactid jboss-marshalling-parent Medium Product pom description JBoss Marshalling API Medium Product pom artifactid jboss-marshalling Highest Product pom groupid jboss.marshalling Low Version pom version 2.0.0.Beta3 Highest
maven: org.jboss.marshalling:jboss-marshalling:2.0.0.Beta3
Confidence :High
Description: JBoss Marshalling River Implementation
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-river/pom.xmlMD5: 1dda062cdd15bd160a4ee6cf1be9f93dSHA1: 366411529f00ec1eb4451b9b45012bfc09bde34b
Evidence
Type Source Name Value Confidence Vendor pom description JBoss Marshalling River Implementation Medium Vendor pom artifactid jboss-marshalling-river Low Vendor pom name JBoss Marshalling River High Vendor pom parent-artifactid jboss-marshalling-parent Low Vendor pom groupid jboss.marshalling Highest Vendor pom parent-groupid org.jboss.marshalling Medium Product pom artifactid jboss-marshalling-river Highest Product pom description JBoss Marshalling River Implementation Medium Product pom parent-groupid org.jboss.marshalling Low Product pom name JBoss Marshalling River High Product pom parent-artifactid jboss-marshalling-parent Medium Product pom groupid jboss.marshalling Low Version pom version 2.0.0.Beta3 Highest
maven: org.jboss.marshalling:jboss-marshalling-river:2.0.0.Beta3
Confidence :High
Description: JBoss Marshalling Serial Implementation
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-serial/pom.xmlMD5: 16b74097e7ec70db37b74205776ad0a7SHA1: cf519c8805a14e6ce20933b7a89bfe0d5a7dbf0f
Evidence
Type Source Name Value Confidence Vendor pom name JBoss Marshalling Serial High Vendor pom parent-artifactid jboss-marshalling-parent Low Vendor pom artifactid jboss-marshalling-serial Low Vendor pom groupid jboss.marshalling Highest Vendor pom description JBoss Marshalling Serial Implementation Medium Vendor pom parent-groupid org.jboss.marshalling Medium Product pom parent-groupid org.jboss.marshalling Low Product pom name JBoss Marshalling Serial High Product pom artifactid jboss-marshalling-serial Highest Product pom parent-artifactid jboss-marshalling-parent Medium Product pom description JBoss Marshalling Serial Implementation Medium Product pom groupid jboss.marshalling Low Version pom version 2.0.0.Beta3 Highest
maven: org.jboss.marshalling:jboss-marshalling-serial:2.0.0.Beta3
Confidence :High
Description: Support for reading and writing YAML-encoded data via Jackson abstractions.
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.4.2/jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/pom.xmlMD5: 287aac9a700de46369cc0e327e3577bcSHA1: da124b77ecdec56e2af7ef65828ec493590ab214
Evidence
Type Source Name Value Confidence Vendor pom description Support for reading and writing YAML-encoded data via Jackson abstractions.
Medium Vendor pom url http://wiki.fasterxml.com/JacksonExtensionYAML Highest Vendor pom groupid fasterxml.jackson.dataformat Highest Vendor pom artifactid jackson-dataformat-yaml Low Vendor pom parent-groupid com.fasterxml.jackson Medium Vendor pom parent-artifactid jackson-parent Low Vendor pom name Jackson-dataformat-YAML High Product pom parent-groupid com.fasterxml.jackson Low Product pom url http://wiki.fasterxml.com/JacksonExtensionYAML Medium Product pom description Support for reading and writing YAML-encoded data via Jackson abstractions.
Medium Product pom parent-artifactid jackson-parent Medium Product pom groupid fasterxml.jackson.dataformat Low Product pom artifactid jackson-dataformat-yaml Highest Product pom name Jackson-dataformat-YAML High Version pom version 2.4.2 Highest Version pom parent-version 2.4.2 Low
maven: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.4.2
Confidence :High
cpe: cpe:/a:fasterxml:jackson:2.4.2
Confidence :Low
suppress
Description: YAML 1.1 parser and emitter for Java
License:
Apache License Version 2.0: LICENSE.txt
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.4.2/jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/org.yaml/snakeyaml/pom.xml
MD5: d103ace8c756cc13661469b53cff1794
SHA1: c9dbe57a55450ef61cdb139c01a8edea9206949d
Evidence
Type Source Name Value Confidence Vendor pom description YAML 1.1 parser and emitter for Java Medium Vendor pom groupid yaml Highest Vendor pom url http://www.snakeyaml.org Highest Vendor pom name SnakeYAML High Vendor pom artifactid snakeyaml Low Product pom description YAML 1.1 parser and emitter for Java Medium Product pom groupid yaml Low Product pom artifactid snakeyaml Highest Product pom url http://www.snakeyaml.org Medium Product pom name SnakeYAML High Version pom version 1.12 Highest
maven: org.yaml:snakeyaml:1.12
Confidence :High