Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: google group | github issues

Project: eXo PLF:: Forum

org.exoplatform.forum:forum:5.3.x-SNAPSHOT

Scan Information (show all):

Display: Showing Vulnerable Dependencies (click to show all)

Dependency CPE Coordinates Highest Severity CVE Count CPE Confidence Evidence Count
commons-lang-2.6.jar org.netbeans.external:org-apache-commons-lang:RELEASE90    0 40
jcr-1.0.1.jar cpe:/a:content_project:content:1.0.1 javax.jcr:jcr:1.0.1 Medium 1 Low 25
commons-chain-1.2.jar commons-chain:commons-chain:1.2    0 34
commons-digester-2.1.jar commons-digester:commons-digester:2.1    0 34
exo.kernel.component.command-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.component.command:5.3.x-SNAPSHOT   0 22
commons-pool-1.6.jar commons-pool:commons-pool:1.6    0 36
exo.kernel.component.common-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.component.common:5.3.x-SNAPSHOT   0 22
commons-io-2.4.jar commons-io:commons-io:2.4    0 36
fontbox-1.8.14.jar cpe:/a:apache:pdfbox:1.8.14 org.apache.pdfbox:fontbox:1.8.14  Medium 2 Highest 37
jempbox-1.8.14.jar cpe:/a:apache:pdfbox:1.8.14 org.apache.pdfbox:jempbox:1.8.14  Medium 2 Highest 35
pdfbox-1.8.14.jar cpe:/a:apache:pdfbox:1.8.14 org.apache.pdfbox:pdfbox:1.8.14  Medium 2 Highest 35
htmllexer-2.1.jar org.htmlparser:htmllexer:2.1    0 23
htmlparser-2.1.jar org.htmlparser:htmlparser:2.1    0 23
poi-3.13.jar cpe:/a:apache:poi:3.13 org.apache.poi:poi:3.13  High 2 Highest 28
tika-core-1.5.jar cpe:/a:apache:tika:1.5 org.apache.tika:tika-core:1.5  High 8 Highest 33
vorbis-java-core-0.1-tests.jar org.gagravarr:vorbis-java-core:0.1    0 23
vorbis-java-tika-0.1.jar cpe:/a:apache:tika:0.1 org.gagravarr:vorbis-java-tika:0.1  High 6 Highest 23
netcdf-4.2-min.jar edu.ucar:netcdf:4.2-min    0 21
apache-mime4j-core-0.7.2.jar cpe:/a:apache:james:0.7.2 org.apache.james:apache-mime4j-core:0.7.2    0 Low 33
xz-1.2.jar cpe:/a:tukaani:xz:1.2 org.tukaani:xz:1.2  Medium 1 Low 27
commons-compress-1.5.jar cpe:/a:apache:commons_compress:1.5
cpe:/a:apache:commons-compress:1.5
org.apache.commons:commons-compress:1.5    0 Low 39
bcmail-jdk15-1.45.jar cpe:/a:no-cms_project:no-cms:1.45 org.bouncycastle:bcmail-jdk15:1.45    0 Low 24
bcprov-jdk15-1.45.jar cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45
cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45
org.bouncycastle:bcprov-jdk15:1.45  Medium 1 Low 24
tagsoup-1.2.1.jar org.ccil.cowan.tagsoup:tagsoup:1.2.1    0 18
asm-debug-all-4.1.jar org.ow2.asm:asm-debug-all:4.1    0 28
isoparser-1.0-RC-1.jar cpe:/a:boxes_project:boxes:7.x-1.0 com.googlecode.mp4parser:isoparser:1.0-RC-1  Low 1 Highest 24
xmpcore-5.1.2.jar com.adobe.xmp:xmpcore:5.1.2    0 30
xercesImpl-2.9.1.jar cpe:/a:apache:xerces2_java:2.9.1 xerces:xercesImpl:2.9.1  High 1 Low 50
metadata-extractor-2.6.2.jar com.drewnoakes:metadata-extractor:2.6.2    0 21
rome-1.0.jar rome:rome:1.0    0 32
vorbis-java-core-0.1.jar org.gagravarr:vorbis-java-core:0.1    0 21
juniversalchardet-1.0.3.jar org.zenframework.z8.dependencies.commons:juniversalchardet-1.0.3:2.0    0 27
jhighlight-1.0.jar com.uwyn:jhighlight:1.0    0 25
xmlbeans-2.6.0.jar org.apache.xmlbeans:xmlbeans:2.6.0    0 24
exo.core.component.document-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.document:5.3.x-SNAPSHOT   0 22
exo.core.component.database-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.database:5.3.x-SNAPSHOT   0 22
lucene-core-3.6.2.jar org.apache.lucene:lucene-core:3.6.2    0 26
lucene-analyzers-3.6.2.jar org.apache.lucene:lucene-analyzers:3.6.2    0 26
lucene-spellchecker-3.6.2.jar org.apache.lucene:lucene-spellchecker:3.6.2    0 26
jta-1.1.jar javax.transaction:transaction-api:1.1    0 22
concurrent-1.3.4.jar concurrent:concurrent:1.3.4    0 23
commons-collections-3.2.2.jar cpe:/a:apache:commons_collections:3.2.2 commons-collections:commons-collections:3.2.2    0 Low 40
jgroups-3.6.13.Final.jar org.jgroups:jgroups:3.6.13.Final    0 32
jbossjta-4.16.6.Final.jar org.jboss.jbossts:jbossjta:4.16.6.Final    0 22
ws-commons-util-1.0.1.jar cpe:/a:ws_project:ws:1.0.1 ws-commons-util:ws-commons-util:1.0.1  Medium 1 Low 30
stringtemplate-3.2.1.jar org.antlr:stringtemplate:3.2.1    0 23
antlr-runtime-3.5.jar org.antlr:antlr-runtime:3.5    0 26
exo.kernel.component.ext.cache.impl.infinispan.v8-5.3.x-SNAPSHOT.jar cpe:/a:infinispan:infinispan:5.3.0 org.exoplatform.kernel:exo.kernel.component.ext.cache.impl.infinispan.v8:5.3.x-SNAPSHOT Medium 3 Highest 22
jboss-marshalling-osgi-2.0.0.Beta3.jar org.jboss.marshalling:jboss-marshalling-osgi:2.0.0.Beta3    0 29
infinispan-core-8.2.6.Final.jar cpe:/a:infinispan:infinispan:8.2.6 org.infinispan:infinispan-core:8.2.6.Final  Medium 3 Highest 35
exo.jcr.component.core-5.3.x-SNAPSHOT.jar org.exoplatform.jcr:exo.jcr.component.core:5.3.x-SNAPSHOT   0 22
jtidy-r938.jar cpe:/a:html-tidy:tidy:- net.sf.jtidy:jtidy:r938    0 Low 25
exo.core.component.xml-processing-5.3.x-SNAPSHOT.jar cpe:/a:processing:processing:5.3 org.exoplatform.core:exo.core.component.xml-processing:5.3.x-SNAPSHOT   0 Low 22
exo.core.component.script.groovy-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.script.groovy:5.3.x-SNAPSHOT   0 22
exo.ws.commons-5.3.x-SNAPSHOT.jar cpe:/a:ws_project:ws:5.3.20190908 org.exoplatform.ws:exo.ws.commons:5.3.x-SNAPSHOT   0 Low 24
exo.jcr.component.ext-5.3.x-SNAPSHOT.jar org.exoplatform.jcr:exo.jcr.component.ext:5.3.x-SNAPSHOT   0 22
jsr250-api-1.0.jar javax.annotation:jsr250-api:1.0    0 20
chromattic.core-1.3.0.jar org.chromattic:chromattic.core:1.3.0    0 23
javassist-3.20.0-GA.jar org.javassist:javassist:3.20.0-GA    0 27
hibernate-entitymanager-4.2.21.Final.jar org.hibernate:hibernate-entitymanager:4.2.21.Final    0 32
liquibase-core-3.4.2.jar org.liquibase:liquibase-core:3.4.2    0 19
commons-webui-component-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-webui-component:5.3.x-SNAPSHOT   0 24
commons-api-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-api:5.3.x-SNAPSHOT   0 24
bayeux-api-3.0.8.jar org.cometd.java:bayeux-api:3.0.8    0 29
cometd-java-common-3.0.8.jar org.cometd.java:cometd-java-common:3.0.8    0 29
cometd-java-websocket-javax-server-3.0.8.jar org.cometd.java:cometd-java-websocket-javax-server:3.0.8    0 29
cometd-java-websocket-common-server-3.0.8.jar org.cometd.java:cometd-java-websocket-common-server:3.0.8    0 29
cometd-java-annotations-3.0.8.jar org.cometd.java:cometd-java-annotations:3.0.8    0 29
jetty-io-9.2.14.v20151106.jar org.eclipse.jetty:jetty-io:9.2.14.v20151106    0 35
cometd-java-client-3.0.8.jar org.cometd.java:cometd-java-client:3.0.8    0 29
cometd-java-websocket-common-client-3.0.8.jar org.cometd.java:cometd-java-websocket-common-client:3.0.8    0 29
cometd-java-websocket-javax-client-3.0.8.jar org.cometd.java:cometd-java-websocket-javax-client:3.0.8    0 29
cometd-java-oort-3.0.8.jar org.cometd.java:cometd-java-oort:3.0.8    0 29
jetty-jmx-9.2.14.v20151106.jar cpe:/a:jetty:jetty:9.2.14.v20151106
cpe:/a:eclipse:jetty:9.2.14.v20151106
org.eclipse.jetty:jetty-jmx:9.2.14.v20151106  High 4 Low 37
cometd-java-server-3.0.8.jar org.cometd.java:cometd-java-server:3.0.8    0 29
commons-comet-service-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-comet-service:5.3.x-SNAPSHOT   0 24
exo.portal.webui.core-5.3.x-SNAPSHOT.jar cpe:/a:in-portal:in-portal:5.3.20190912 org.exoplatform.gatein.portal:exo.portal.webui.core:5.3.x-SNAPSHOT   0 Low 29
twitter4j-core-3.0.5.jar cpe:/a:twitter_project:twitter:3.0.5
cpe:/a:twitter:twitter:3.0.5
org.twitter4j:twitter4j-core:3.0.5    0 Low 22
scribe-1.3.5.jar cpe:/a:scribe:scribe:1.3.5 org.scribe:scribe:1.3.5    0 Low 23
google-http-client-1.14.1-beta.jar cpe:/a:google_forms_project:google_forms:1.14.1.beta com.google.http-client:google-http-client:1.14.1-beta    0 Low 24
jsr305-1.3.9.jar com.google.code.findbugs:jsr305:1.3.9    0 21
google-api-client-1.14.1-beta.jar com.google.api-client:google-api-client:1.14.1-beta    0 22
jackson-core-asl-1.9.11.jar cpe:/a:fasterxml:jackson:1.9.11 org.codehaus.jackson:jackson-core-asl:1.9.11    0 Low 32
google-http-client-jackson-1.14.1-beta.jar com.google.http-client:google-http-client-jackson:1.14.1-beta    0 22
google-api-services-plus-v1-rev69-1.14.2-beta.jar com.google.apis:google-api-services-plus:v1-rev69-1.14.2-beta    0 26
google-api-services-oauth2-v2-rev36-1.14.2-beta.jar com.google.apis:google-api-services-oauth2:v2-rev36-1.14.2-beta    0 26
json-simple-1.1.1.jar com.googlecode.json-simple:json-simple:1.1.1    0 23
caja-r5054.jar com.google.caja:caja:r5054   0 23
htmlparser-r4209.jar caja:htmlparser:r4209   0 24
oauth-consumer-20090617.jar net.oauth.core:oauth-consumer:20090617   0 17
oauth-httpclient4-20090913.jar net.oauth.core:oauth-httpclient4:20090913   0 20
oauth-provider-20100527.jar net.oauth.core:oauth-provider:20100527    0 18
guice-multibindings-3.0.jar com.google.inject.extensions:guice-multibindings:3.0    0 29
jdom-1.0.jar jdom:jdom:1.0    0 33
modules-0.3.2.jar rome:modules:0.3.2    0 24
icu4j-56.1.jar cpe:/a:icu-project:international_components_for_unicode:56.1::~~~c%2fc%2b%2b~~ com.ibm.icu:icu4j:56.1  High 8 Highest 33
nekohtml-1.9.22.jar net.sourceforge.nekohtml:nekohtml:1.9.22    0 20
sanselan-0.97-incubator.jar org.apache.sanselan:sanselan:0.97-incubator    0 35
httpcore-4.3.3.jar org.apache.httpcomponents:httpcore:4.3.3    0 32
commons-logging-1.1.3.jar commons-logging:commons-logging:1.1.3    0 36
httpclient-4.3.6.jar cpe:/a:apache:httpclient:4.3.6 org.apache.httpcomponents:httpclient:4.3.6    0 Low 32
aopalliance-1.0.jar aopalliance:aopalliance:1.0    0 20
guice-3.0.jar com.google.inject:guice:3.0    0 29
joda-time-2.4.jar joda-time:joda-time:2.4    0 34
oauth-20100527.jar net.oauth.core:oauth:20100527    0 18
ehcache-core-2.6.9.jar net.sf.ehcache:ehcache-core:2.6.9    0 19
juel-impl-2.2.7.jar de.odysseus.juel:juel-impl:2.2.7    0 26
el-api-6.0.41.jar cpe:/a:apache_tomcat:apache_tomcat:6.0.41
cpe:/a:apache:tomcat:6.0.41
cpe:/a:apache_software_foundation:tomcat:6.0.41
org.apache.tomcat:el-api:6.0.41  High 21 Highest 19
jasper-el-6.0.41.jar cpe:/a:apache_tomcat:apache_tomcat:6.0.41
cpe:/a:apache:tomcat:6.0.41
cpe:/a:apache_software_foundation:tomcat:6.0.41
cpe:/a:jasper_project:jasper:6.0.41
org.apache.tomcat:jasper-el:6.0.41  High 21 Highest 21
xml-apis-1.4.01.jar xml-apis:xml-apis:1.4.01    0 49
shindig-common-2.5.2.jar cpe:/a:apache:shindig:2.5.2 org.apache.shindig:shindig-common:2.5.2    0 Low 26
geronimo-stax-api_1.0_spec-1.0.1.jar org.apache.geronimo.specs:geronimo-stax-api_1.0_spec:1.0.1    0 26
exo.portal.gadgets-core-5.3.x-SNAPSHOT.jar cpe:/a:in-portal:in-portal:5.3 org.exoplatform.gatein.portal:exo.portal.gadgets-core:5.3.x-SNAPSHOT   0 Low 27
filters-2.0.235.jar cpe:/a:image_processing_software:image_processing_software:2.0.235
cpe:/a:processing:processing:2.0.235
com.jhlabs:filters:2.0.235  Medium 2 Low 22
simplecaptcha-1.1.1.Final-gatein-4.jar org.gatein.captcha:simplecaptcha:1.1.1.Final-gatein-4   0 27
gatein-api-1.0.1.Final.jar org.gatein.api:gatein-api:1.0.1.Final    0 29
aspectjrt-1.8.8.jar org.aspectj:aspectjrt:1.8.8    0 21
c3p0-0.9.1.1.jar cpe:/a:mchange:c3p0:0.9.1.1 c3p0:c3p0:0.9.1.1  Medium 1 Highest 23
quartz-2.2.2.jar org.quartz-scheduler:quartz:2.2.2    0 43
jmock-1.0.1.jar jmock:jmock:1.0.1    0 14
xpp3-1.1.4c.jar xpp3:xpp3:1.1.4c    0 26
picocontainer-1.1.jar picocontainer:picocontainer:1.1    0 28
guava-20.0.jar cpe:/a:google:guava:20.0 com.google.guava:guava:20.0  Medium 1 Highest 29
commons-codec-1.10.jar commons-codec:commons-codec:1.10    0 38
owasp-java-html-sanitizer-20160413.1.jar cpe:/a:owasp-java-html-sanitizer_project:owasp-java-html-sanitizer:20160413.1 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20160413.1    0 Low 21
jrcs.diff-0.4.2.jar org.jvnet.hudson:org.suigeneris.jrcs.diff:0.4.2    0 17
ecs-1.4.2.jar ecs:ecs:1.4.2    0 14
jackson-core-2.9.8.jar cpe:/a:fasterxml:jackson:2.9.8 com.fasterxml.jackson.core:jackson-core:2.9.8    0 Low 41
jackson-databind-2.9.8.jar cpe:/a:fasterxml:jackson:2.9.8
cpe:/a:fasterxml:jackson-databind:2.9.8
com.fasterxml.jackson.core:jackson-databind:2.9.8  High 5 Highest 41
snakeyaml-1.23.jar org.yaml:snakeyaml:1.23    0 25
swagger-annotations-1.5.22.jar io.swagger:swagger-annotations:1.5.22    0 24
swagger-models-1.5.22.jar io.swagger:swagger-models:1.5.22    0 24
validation-api-1.1.0.Final.jar javax.validation:validation-api:1.1.0.Final    0 22
swagger-core-1.5.22.jar io.swagger:swagger-core:1.5.22    0 24
reflections-0.9.11.jar org.reflections:reflections:0.9.11    0 25
swagger-jaxrs-1.5.22.jar io.swagger:swagger-jaxrs:1.5.22    0 24
commons-component-common-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-component-common:5.3.x-SNAPSHOT   0 26
exo.kernel.component.cache-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.component.cache:5.3.x-SNAPSHOT   0 22
jboss-common-core-2.2.22.GA.jar org.jboss:jboss-common-core:2.2.22.GA    0 30
forum-component-common-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-component-common:5.3.x-SNAPSHOT   0 24
mime-util-2.1.3.jar eu.medsea.mimeutil:mime-util:2.1.3    0 30
jakarta-regexp-1.4.jar jakarta-regexp:jakarta-regexp:1.4    0 14
xpp3-1.1.6.jar org.ogce:xpp3:1.1.6    0 24
slf4j-api-1.7.18.jar org.slf4j:slf4j-api:1.7.18    0 31
exo.kernel.commons-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.commons:5.3.x-SNAPSHOT   0 22
commons-beanutils-1.8.3.jar cpe:/a:apache:commons_beanutils:1.8.3 commons-beanutils:commons-beanutils:1.8.3  High 2 Low 34
common-common-2.2.2.Final.jar org.gatein.common:common-common:2.2.2.Final    0 31
wci-wci-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.wci:wci-wci:5.3.x-SNAPSHOT   0 27
jibx-run-1.2.6.jar org.jibx:jibx-run:1.2.6    0 29
javax.inject-1.jar javax.inject:javax.inject:1    0 20
cdi-api-1.0-SP4.jar javax.enterprise:cdi-api:1.0-SP4    0 31
exo.kernel.container-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.container:5.3.x-SNAPSHOT   0 24
log4j-1.2.17.jar cpe:/a:apache:log4j:2.0:alpha1 log4j:log4j:1.2.17  High 1 High 33
jsr311-api-1.1.1.jar javax.ws.rs:jsr311-api:1.1.1    0 28
freemarker-2.3.18.jar org.freemarker:freemarker:2.3.18    0 25
wikbook.template.core-0.9.45.jar org.wikbook:wikbook.template.core:0.9.45    0 23
doc-style-5.3.x-SNAPSHOT.jar cpe:/a:style_it_project:style_it:5.3 org.exoplatform.doc:doc-style:5.3.x-SNAPSHOT   0 Low 24
chromattic.api-1.3.0.jar org.chromattic:chromattic.api:1.3.0    0 23
javaparser-1.0.8.jar com.google.code.javaparser:javaparser:1.0.8   0 20
chromattic.testgenerator-1.3.0.jar org.chromattic:chromattic.testgenerator:1.3.0    0 23
reflext.jlr-1.1.0.jar org.reflext:reflext.jlr:1.1.0    0 23
chromattic.metamodel-1.3.0.jar org.chromattic:chromattic.metamodel:1.3.0    0 23
reflext.api-1.1.0.jar org.reflext:reflext.api:1.1.0    0 23
reflext.core-1.1.0.jar org.reflext:reflext.core:1.1.0    0 23
reflext.spi-1.1.0.jar org.reflext:reflext.spi:1.1.0    0 25
reflext.apt-1.1.0.jar cpe:/a:processing:processing:1.1.0 org.reflext:reflext.apt:1.1.0  Medium 1 Low 23
chromattic.apt-1.3.0.jar org.chromattic:chromattic.apt:1.3.0    0 23
chromattic.common-1.3.0.jar org.chromattic:chromattic.common:1.3.0    0 25
chromattic.ext-1.3.0.jar org.chromattic:chromattic.ext:1.3.0    0 25
chromattic.spi-1.3.0.jar org.chromattic:chromattic.spi:1.3.0    0 25
mail-1.4.7.jar cpe:/a:sun:javamail:1.4.7 javax.mail:mail:1.4.7    0 Low 38
exo.core.component.security.core-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.security.core:5.3.x-SNAPSHOT   0 22
antlr-2.7.7.jar antlr:antlr:2.7.7    0 18
dom4j-1.6.1.jar cpe:/a:dom4j_project:dom4j:1.6.1 dom4j:dom4j:1.6.1  Medium 1 Highest 28
hibernate-jpa-2.0-api-1.0.1.Final.jar org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.1.Final    0 26
jboss-logging-annotations-1.2.0.Beta1.jar org.jboss.logging:jboss-logging-annotations:1.2.0.Beta1    0 30
hibernate-commons-annotations-4.0.5.Final.jar org.hibernate.common:hibernate-commons-annotations:4.0.5.Final    0 30
hibernate-core-4.2.21.Final.jar org.hibernate:hibernate-core:4.2.21.Final    0 32
exo.core.component.organization.api-5.3.x-SNAPSHOT.jar cpe:/a:api-platform:core:5.3 org.exoplatform.core:exo.core.component.organization.api:5.3.x-SNAPSHOT   0 Low 22
groovy-all-2.4.12.jar cpe:/a:apache:groovy:2.4.12 org.codehaus.groovy:groovy-all:2.4.12    0 Low 36
portlet-api-2.0.jar javax.portlet:portlet-api:2.0    0 22
staxnav.core-0.9.8.jar org.staxnav:staxnav.core:0.9.8    0 19
commons-lang3-3.3.2.jar org.apache.commons:commons-lang3:3.3.2    0 37
commons-fileupload-1.3.3.jar cpe:/a:apache:commons_fileupload:1.3.3 commons-fileupload:commons-fileupload:1.3.3    0 Low 40
exo.ws.rest.core-5.3.x-SNAPSHOT.jar cpe:/a:ws_project:ws:5.3 org.exoplatform.ws:exo.ws.rest.core:5.3.x-SNAPSHOT   0 Low 22
pc-api-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-api:5.3.x-SNAPSHOT   0 27
pc-portlet-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-portlet:5.3.x-SNAPSHOT   0 27
pc-federation-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-federation:5.3.x-SNAPSHOT   0 27
pc-bridge-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-bridge:5.3.x-SNAPSHOT   0 27
xmlpull-1.1.3.1.jar xmlpull:xmlpull:1.1.3.1    0 18
xpp3_min-1.1.4c.jar xpp3:xpp3_min:1.1.4c    0 24
xstream-1.4.10.jar cpe:/a:xstream_project:xstream:1.4.10 com.thoughtworks.xstream:xstream:1.4.10  High 2 Highest 53
jcl-over-slf4j-1.7.18.jar org.slf4j:jcl-over-slf4j:1.7.18    0 31
commons-dbcp-1.4.jar commons-dbcp:commons-dbcp:1.4    0 34
jboss-logging-3.3.0.Final.jar org.jboss.logging:jboss-logging:3.3.0.Final    0 44
common-logging-2.2.2.Final.jar org.gatein.common:common-logging:2.2.2.Final    0 31
forum-component-rendering-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-component-rendering:5.3.x-SNAPSHOT   0 24
jdom-1.1.3.jar org.jdom:jdom:1.1.3    0 44
jdom2-2.0.5.jar org.jdom:jdom2:2.0.5    0 43
htmlcleaner-2.7.jar cpe:/a:htmlcleaner_project:htmlcleaner:2.7 net.sourceforge.htmlcleaner:htmlcleaner:2.7    0 Low 20
stax-utils-20070216.jar net.java.dev.stax-utils:stax-utils:20070216    0 20
xwiki-commons-xml-5.4.7.jar cpe:/a:xwiki:xwiki:5.4.7 org.xwiki.commons:xwiki-commons-xml:5.4.7 Low 1 Low 26
sac-1.3.jar org.w3c.css:sac:1.3    0 27
cssparser-0.9.18.jar net.sourceforge.cssparser:cssparser:0.9.18    0 27
jcommon-1.0.17.jar org.jfree:jcommon:1.0.17    0 23
jfreechart-1.0.14.jar org.jfree:jfreechart:1.0.14    0 25
velocity-1.7.jar org.apache.velocity:velocity:1.7    0 33
velocity-tools-1.4.jar cpe:/a:apache:struts:1.4 velocity-tools:velocity-tools:1.4    0 Low 19
ezmorph-1.0.6.jar net.sf.ezmorph:ezmorph:1.0.6    0 22
json-lib-2.4-jdk15.jar com.hynnet:json-lib:2.4    0 15
commons-configuration-1.10.jar commons-configuration:commons-configuration:1.10    0 36
wiki-renderer-5.3.x-SNAPSHOT.jar org.exoplatform.wiki:wiki-renderer:5.3.x-SNAPSHOT   0 24
commons-lang3-3.2.jar org.apache.commons:commons-lang3:3.2    0 37
commons-component-product-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-component-product:5.3.x-SNAPSHOT   0 28
commons-component-upgrade-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-component-upgrade:5.3.x-SNAPSHOT   0 26
activation-1.1.1.jar javax.activation:activation:1.1.1    0 24
commons-file-storage-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-file-storage:5.3.x-SNAPSHOT   0 24
social-component-core-5.3.x-SNAPSHOT.jar org.exoplatform.social:social-component-core:5.3.x-SNAPSHOT   0 28
social-component-common-5.3.x-SNAPSHOT.jar org.exoplatform.social:social-component-common:5.3.x-SNAPSHOT   0 26
closure-compiler-externs-v20170910.jar com.google.javascript:closure-compiler-externs:v20170910    0 19
args4j-2.33.jar args4j:args4j:2.33    0 24
error_prone_annotations-2.0.18.jar com.google.errorprone:error_prone_annotations:2.0.18    0 23
gson-2.7.jar com.google.code.gson:gson:2.7    0 34
jsinterop-annotations-1.0.0.jar com.google.jsinterop:jsinterop-annotations:1.0.0    0 19
closure-compiler-v20170910.jar com.google.javascript:closure-compiler:v20170910    0 13
forum-application-common-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-application-common:5.3.x-SNAPSHOT   0 24
mop-api-1.3.2.Final.jar org.gatein.mop:mop-api:1.3.2.Final   0 30
mop-spi-1.3.2.Final.jar org.gatein.mop:mop-spi:1.3.2.Final   0 30
mop-core-1.3.2.Final.jar org.gatein.mop:mop-core:1.3.2.Final   0 30
gatein-management-api-2.1.0.Final.jar org.gatein.management:gatein-management-api:2.1.0.Final   0 28
gatein-management-spi-2.1.0.Final.jar org.gatein.management:gatein-management-spi:2.1.0.Final   0 28
json-20070829.jar org.json:json:20070829    0 23
javax.servlet-api-3.0.1.jar javax.servlet:javax.servlet-api:3.0.1    0 38
forum-component-bbcode-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-component-bbcode:5.3.x-SNAPSHOT   0 24
forum-forum-service-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-forum-service:5.3.x-SNAPSHOT   0 24
jaxb-api-2.1.jar javax.xml.bind:jaxb-api:2.1    0 15
jaxb-impl-2.1.8.jar com.sun.xml.bind:jaxb-impl:2.1.8    0 20
picketlink-idm-core-1.4.6.Final.jar cpe:/a:picketlink:picketlink:1.4.6 org.picketlink.idm:picketlink-idm-core:1.4.6.Final  Medium 3 Low 37
platform-ui-skin-5.3.x-SNAPSHOT.war org.exoplatform.platform-ui:platform-ui-skin:5.3.x-SNAPSHOT   0 24
ehcache-core-2.6.9.jar: sizeof-agent.jar net.sf.ehcache:sizeof-agent:1.0.1   0 26
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling/pom.xml org.jboss.marshalling:jboss-marshalling:2.0.0.Beta3   0 13
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-river/pom.xml org.jboss.marshalling:jboss-marshalling-river:2.0.0.Beta3   0 13
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-serial/pom.xml org.jboss.marshalling:jboss-marshalling-serial:2.0.0.Beta3   0 13
closure-compiler-v20170910.jar/META-INF/maven/com.google.javascript/closure-compiler/pom.xml cpe:/a:google:gmail:- com.google.javascript:closure-compiler:v20170910 Medium 1 Low 15
closure-compiler-v20170910.jar/META-INF/maven/com.google.protobuf/protobuf-java/pom.xml cpe:/a:google:protobuf:3.0.2 com.google.protobuf:protobuf-java:3.0.2 Medium 1 Highest 13
closure-compiler-v20170910.jar/META-INF/maven/com.google.code.findbugs/jsr305/pom.xml com.google.code.findbugs:jsr305:3.0.1   0 11

Dependencies

commons-lang-2.6.jar

Description:  Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

jcr-1.0.1.jar

Description: Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.

License:

Day License: http://www.day.com/maven/jsr170/licenses/day-spec-license.htm
File Path: /home/ciagent/.m2/repository/javax/jcr/jcr/1.0.1/jcr-1.0.1.jar
MD5: 4639c7b994528948dab1a4feb1f68d6f
SHA1: 567ee103cf7592e3cf036e1bf4e2e06b9f08e1a1
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

  • cpe: cpe:/a:content_project:content:1.0.1   Confidence:Low   
  • maven: javax.jcr:jcr:1.0.1   Confidence:High

CVE-2017-16111  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.

Vulnerable Software & Versions:

commons-chain-1.2.jar

Description:  An implementation of the GoF Chain of Responsibility pattern

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-chain/commons-chain/1.2/commons-chain-1.2.jar
MD5: e18e2c87826644e4c8c08635572c154f
SHA1: 744a13e8766e338bd347b6fbc28c6db12979d0c6
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

commons-digester-2.1.jar

Description:  The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-digester/commons-digester/2.1/commons-digester-2.1.jar
MD5: 528445033f22da28f5047b6abcd1c7c9
SHA1: 73a8001e7a54a255eef0f03521ec1805dc738ca0
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

exo.kernel.component.command-5.3.x-SNAPSHOT.jar

Description: Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project.

File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.command/5.3.x-SNAPSHOT/exo.kernel.component.command-5.3.x-SNAPSHOT.jar
MD5: 0e958f1e97410fcf5f569b5e7c14994b
SHA1: b3c825524cc971a0bf1bf8674084cc05c409c43c
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

  • maven: org.exoplatform.kernel:exo.kernel.component.command:5.3.x-SNAPSHOT   Confidence:High

commons-pool-1.6.jar

Description: Commons Object Pooling Library

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-pool/commons-pool/1.6/commons-pool-1.6.jar
MD5: 5ca02245c829422176d23fa530e919cc
SHA1: 4572d589699f09d866a226a14b7f4323c6d8f040
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Common components:runtime
  • eXo PLF:: Forum Common Statistics:runtime
  • eXo PLF:: Forum Applications commons:runtime
  • eXo PLF:: Forum Rendering:runtime
  • eXo PLF:: Forum create:runtime
  • eXo PLF:: Forum Forum service:runtime
  • eXo PLF:: Forum Forum application:runtime

Identifiers

exo.kernel.component.common-5.3.x-SNAPSHOT.jar

Description: Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project.

File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.common/5.3.x-SNAPSHOT/exo.kernel.component.common-5.3.x-SNAPSHOT.jar
MD5: c18d2b5e62ca094dc3af3a67ab37d2ab
SHA1: 013cabbb2b566014bc2d648beafb61927ae20de6
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

  • maven: org.exoplatform.kernel:exo.kernel.component.common:5.3.x-SNAPSHOT   Confidence:High

commons-io-2.4.jar

Description:  The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-io/commons-io/2.4/commons-io-2.4.jar
MD5: 7f97854dc04c119d461fed14f5d8bb96
SHA1: b1b6ea3b7e4aa4f492509a4952029cd8e48019ad
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

fontbox-1.8.14.jar

Description:  The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/fontbox/1.8.14/fontbox-1.8.14.jar
MD5: 901640f7e2bd12508ae4a7cccba3df79
SHA1: 9c7caec614a6a132bedc83f1d6d247bb96ca0df3
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2018-11797  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Vulnerable Software & Versions: (show all)

CVE-2018-8036  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Vulnerable Software & Versions: (show all)

jempbox-1.8.14.jar

Description:  The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/jempbox/1.8.14/jempbox-1.8.14.jar
MD5: 393135759731daf4e301903b3de2fbbb
SHA1: 7f94c7cd4efc21e78729436cc4cf0c09eeea0f38
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2018-11797  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Vulnerable Software & Versions: (show all)

CVE-2018-8036  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Vulnerable Software & Versions: (show all)

pdfbox-1.8.14.jar

Description:  The Apache PDFBox library is an open source Java tool for working with PDF documents.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/pdfbox/1.8.14/pdfbox-1.8.14.jar
MD5: c90740e185fc2f8013d1119f509ea4f3
SHA1: 7550298240c8540b721733ede6dc88fcf4fa2b0f
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2018-11797  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

Vulnerable Software & Versions: (show all)

CVE-2018-8036  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

Vulnerable Software & Versions: (show all)

htmllexer-2.1.jar

Description: HTML Lexer is the low level lexical analyzer.

File Path: /home/ciagent/.m2/repository/org/htmlparser/htmllexer/2.1/htmllexer-2.1.jar
MD5: 1cb7184766a0c52f4d98d671bb08be19
SHA1: 2ebf2c073e649b7e674cddd0558ff102a486402f
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

htmlparser-2.1.jar

Description: HTML Parser is the high level syntactical analyzer.

File Path: /home/ciagent/.m2/repository/org/htmlparser/htmlparser/2.1/htmlparser-2.1.jar
MD5: aa05b921026c228f92ef8b4a13c26f8d
SHA1: c752e5984b7767533cbd3fdffa48cecb52fa226c
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

poi-3.13.jar

Description: Apache POI - Java API To Access Microsoft Format Files

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi/3.13/poi-3.13.jar
MD5: 1b43f32e2211546040597a9e2d07b869
SHA1: 0f59f504ba8c521e61e25f417ec652fd485010f3
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2016-5000  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Vulnerable Software & Versions:

CVE-2017-5644  

Severity: High
CVSS Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Vulnerable Software & Versions:

tika-core-1.5.jar

Description: This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/tika/tika-core/1.5/tika-core-1.5.jar
MD5: e864bf637f51283dc525087b015d7b1a
SHA1: 194ca0fb3d73b07737524806fbc3bec89063c03a
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2016-6809  

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

Vulnerable Software & Versions:

CVE-2018-11761  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

Vulnerable Software & Versions: (show all)

CVE-2018-11762  

Severity: Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.

Vulnerable Software & Versions: (show all)

CVE-2018-11796  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.

Vulnerable Software & Versions: (show all)

CVE-2018-1335  

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.

Vulnerable Software & Versions: (show all)

CVE-2018-1338  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Vulnerable Software & Versions: (show all)

CVE-2018-1339  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.

Vulnerable Software & Versions: (show all)

CVE-2018-8017  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.

Vulnerable Software & Versions: (show all)

vorbis-java-core-0.1-tests.jar

File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-core/0.1/vorbis-java-core-0.1-tests.jar
MD5: d58f076c08a917277d03f3417aa867a6
SHA1: c849979e199d8a7c3da1a00799c623c00f94efac
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum application:test,provided
  • eXo PLF:: Forum Forum service:test,provided
  • eXo PLF:: Forum Applications commons:test,provided
  • eXo PLF:: Forum Common Statistics:test,provided
  • eXo PLF:: Forum Common components:test,provided
  • eXo PLF:: Forum Rendering:test,provided
  • eXo PLF:: Forum create:test,provided
  • eXo PLF:: Forum BBCode processing:test,provided

Identifiers

vorbis-java-tika-0.1.jar

File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-tika/0.1/vorbis-java-tika-0.1.jar
MD5: 1fccc6796a0924ba4f32eb1d44b8616b
SHA1: 6966c8663a7f689021accb13cceaa6101f53ea3d
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2016-6809  

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

Vulnerable Software & Versions:

CVE-2018-11761  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

Vulnerable Software & Versions: (show all)

CVE-2018-11796  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.

Vulnerable Software & Versions: (show all)

CVE-2018-1335  

Severity: High
CVSS Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.

Vulnerable Software & Versions: (show all)

CVE-2018-1338  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Vulnerable Software & Versions: (show all)

CVE-2018-1339  

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.

Vulnerable Software & Versions: (show all)

netcdf-4.2-min.jar

Description: The NetCDF-Java Library is a Java interface to NetCDF files, as well as to many other types of scientific data formats.

License:

(MIT-style) netCDF C library license.: http://www.unidata.ucar.edu/software/netcdf/copyright.html
File Path: /home/ciagent/.m2/repository/edu/ucar/netcdf/4.2-min/netcdf-4.2-min.jar
MD5: eb00b40b0511f0fc1dfcfc9cb89e3c53
SHA1: 0f3c3f3db4c54483aa1fbc4497e300879ce24da1
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

apache-mime4j-core-0.7.2.jar

Description: Java stream based MIME message parser

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/james/apache-mime4j-core/0.7.2/apache-mime4j-core-0.7.2.jar
MD5: 88f799546eca803c53eee01a4ce5edcd
SHA1: a81264fe0265ebe8fd1d8128aad06dc320de6eef
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

xz-1.2.jar

Description: XZ data compression

License:

Public Domain
File Path: /home/ciagent/.m2/repository/org/tukaani/xz/1.2/xz-1.2.jar
MD5: 04bd31459826c30c2a3c304e3b225ad4
SHA1: bfc66dda280a18ab341b5023248925265c00394c
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

  • maven: org.tukaani:xz:1.2    Confidence:Highest
  • cpe: cpe:/a:tukaani:xz:1.2   Confidence:Low   

CVE-2015-4035  

Severity: Medium
CVSS Score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.

Vulnerable Software & Versions:

commons-compress-1.5.jar

Description:  Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/commons/commons-compress/1.5/commons-compress-1.5.jar
MD5: 5e18cfcf472548c2e0b90a4ea1cedf42
SHA1: d2bd2c0bd328f1dabdf33e10b6d223ebcbe93343
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

  • cpe: cpe:/a:apache:commons_compress:1.5   Confidence:Low   
  • maven: org.apache.commons:commons-compress:1.5    Confidence:Highest
  • cpe: cpe:/a:apache:commons-compress:1.5   Confidence:Low   

bcmail-jdk15-1.45.jar

Description: The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs. If the S/MIME API is used, the JavaMail API and the Java activation framework will also be needed.

License:

Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcmail-jdk15/1.45/bcmail-jdk15-1.45.jar
MD5: 13321fc7eff7bcada7b4fedfb592025c
SHA1: 3aed7e642dd8d39dc14ed1dec3ff79e084637148
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

bcprov-jdk15-1.45.jar

Description: The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5.

License:

Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcprov-jdk15/1.45/bcprov-jdk15-1.45.jar
MD5: 2062f8e3d15748443ea60a94b266371c
SHA1: 7741883cb07b4634e8b5fd3337113b6ea770a9bb
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

  • cpe: cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45   Confidence:Low   
  • maven: org.bouncycastle:bcprov-jdk15:1.45    Confidence:Highest
  • cpe: cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45   Confidence:Low   

CVE-2015-7940  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-310 Cryptographic Issues

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Vulnerable Software & Versions: (show all)

tagsoup-1.2.1.jar

Description: TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML.

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/ccil/cowan/tagsoup/tagsoup/1.2.1/tagsoup-1.2.1.jar
MD5: ae73a52cdcbec10cd61d9ef22fab5936
SHA1: 5584627487e984c03456266d3f8802eb85a9ce97
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

asm-debug-all-4.1.jar

File Path: /home/ciagent/.m2/repository/org/ow2/asm/asm-debug-all/4.1/asm-debug-all-4.1.jar
MD5: 6c3a8842f484dd3d620002b361e3610e
SHA1: dd6ba5c392d4102458494e29f54f70ac534ec2a2
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

isoparser-1.0-RC-1.jar

Description: A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)

License:

Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/googlecode/mp4parser/isoparser/1.0-RC-1/isoparser-1.0-RC-1.jar
MD5: b0444fde2290319c9028564c3c3ff1ab
SHA1: 4a5768b1070b9488a433362d736720fd7a7b264f
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

CVE-2013-0259  

Severity: Low
CVSS Score: 2.1 (AV:N/AC:H/Au:S/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.

Vulnerable Software & Versions: (show all)

xmpcore-5.1.2.jar

Description:  The XMP Library for Java is based on the C++ XMPCore library and the API is similar.

License:

The BSD License: http://www.adobe.com/devnet/xmp/library/eula-xmp-library-java.html
File Path: /home/ciagent/.m2/repository/com/adobe/xmp/xmpcore/5.1.2/xmpcore-5.1.2.jar
MD5: 0b2cf2a09d32abdedd17de864e93ad25
SHA1: 55615fa2582424e38705487d1d3969af8554f637
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile
  • eXo PLF:: Forum Forum application:compile
  • eXo PLF:: Forum create:compile

Identifiers

xercesImpl-2.9.1.jar

Description:  Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

File Path: /home/ciagent/.m2/repository/xerces/xercesImpl/2.9.1/xercesImpl-2.9.1.jar
MD5: f807f86d7d9db25edbfc782aca7ca2a9
SHA1: 7bc7e49ddfe4fb5f193ed37ecc96c12292c8ceb6
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Rendering:compile
  • eXo PLF:: Forum Applications commons:compile
  • eXo PLF:: Forum BBCode processing:compile
  • eXo PLF:: Forum Common Statistics:compile
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Common components:compile