Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
File Path: /home/ciagent/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar MD5: 4d5c1693079575b362edf41500630bbd SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
bundle-symbolicname
org.apache.commons.lang
Medium
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
pom
parent-groupid
org.apache.commons
Medium
Vendor
Manifest
specification-vendor
The Apache Software Foundation
Low
Vendor
pom
artifactid
commons-lang
Low
Vendor
central
groupid
org.netbeans.external
High
Vendor
pom
parent-artifactid
commons-parent
Low
Vendor
pom
name
Commons Lang
High
Vendor
pom
url
http://commons.apache.org/lang/
Highest
Vendor
file
name
commons-lang
High
Vendor
pom
groupid
commons-lang
Highest
Vendor
Manifest
bundle-docurl
http://commons.apache.org/lang/
Low
Vendor
Manifest
Implementation-Vendor
The Apache Software Foundation
High
Vendor
pom
description
Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Vendor
manifest
Bundle-Description
Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Vendor
central
groupid
commons-lang
High
Product
Manifest
bundle-symbolicname
org.apache.commons.lang
Medium
Product
pom
url
http://commons.apache.org/lang/
Medium
Product
Manifest
Implementation-Title
Commons Lang
High
Product
pom
artifactid
commons-lang
Highest
Product
pom
groupid
commons-lang
Low
Product
Manifest
specification-title
Commons Lang
Medium
Product
pom
name
Commons Lang
High
Product
central
artifactid
org-apache-commons-lang
High
Product
file
name
commons-lang
High
Product
central
artifactid
commons-lang
High
Product
pom
parent-artifactid
commons-parent
Medium
Product
Manifest
bundle-docurl
http://commons.apache.org/lang/
Low
Product
pom
description
Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Product
Manifest
Bundle-Name
Commons Lang
Medium
Product
manifest
Bundle-Description
Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Description: Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.
License:
Day License: http://www.day.com/maven/jsr170/licenses/day-spec-license.htm
File Path: /home/ciagent/.m2/repository/javax/jcr/jcr/1.0.1/jcr-1.0.1.jar MD5: 4639c7b994528948dab1a4feb1f68d6f SHA1: 567ee103cf7592e3cf036e1bf4e2e06b9f08e1a1
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
description
Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.
Low
Vendor
file
name
jcr
High
Vendor
pom
groupid
javax.jcr
Highest
Vendor
Manifest
specification-vendor
Day Software Management AG
Low
Vendor
pom
organization url
http://www.day.com/
Medium
Vendor
pom
name
Content Repository for Java Technology API
High
Vendor
pom
organization name
Day Software Management AG
High
Vendor
pom
url
http://www.jcp.org/en/jsr/detail?id=170
Highest
Vendor
Manifest
Implementation-Vendor
Day Software Management AG
High
Vendor
Manifest
extension-name
jcr
Medium
Vendor
pom
artifactid
jcr
Low
Product
pom
description
Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.
The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-284 Improper Access Control
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-190 Integer Overflow or Wraparound
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-19 Data Handling
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-16 Configuration
Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.
Severity:
Medium
CVSS Score: 6.8
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-19 Data Handling
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-284 Improper Access Control
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Severity:
Medium
CVSS Score: 4.0
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Severity:
Medium
CVSS Score: 4.0
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-254 Security Features
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Severity:
Medium
CVSS Score: 5.1
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-284 Improper Access Control
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Severity:
High
CVSS Score: 7.2
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
Severity:
High
CVSS Score: 7.2
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-254 Security Features
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-284 Improper Access Control
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-284 Improper Access Control
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-16 Configuration
Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.
Severity:
Medium
CVSS Score: 6.8
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-19 Data Handling
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-284 Improper Access Control
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Severity:
Medium
CVSS Score: 4.0
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Severity:
Medium
CVSS Score: 4.0
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-254 Security Features
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Severity:
Medium
CVSS Score: 5.1
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-284 Improper Access Control
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Severity:
High
CVSS Score: 7.2
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
Severity:
High
CVSS Score: 7.2
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-254 Security Features
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-284 Improper Access Control
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-284 Improper Access Control
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.
Description: xml-commons provides an Apache-hosted set of DOM, SAX, and
JAXP interfaces for use in other xml-based projects. Our hope is that we
can standardize on both a common version and packaging scheme for these
critical XML standards interfaces to make the lives of both our developers
and users easier. The External Components portion of xml-commons contains
interfaces that are defined by external standards organizations. For DOM,
that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for
JAXP it's Sun.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
The SAX License: http://www.saxproject.org/copying.html
The W3C License: http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/java-binding.zip
File Path: /home/ciagent/.m2/repository/xml-apis/xml-apis/1.4.01/xml-apis-1.4.01.jar MD5: 7eaad6fea5925cca6c36ee8b3e02ac9d SHA1: 3789d9fada2d3d458c4ba2de349d48780f381ee3
Referenced In Project/Scope:
eXo PLF:: Forum Forum service:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
manifest: javax/xml/datatype/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
manifest: org/w3c/dom/ls/
Implementation-Vendor
World Wide Web Consortium
Medium
Vendor
manifest: javax/xml/parsers/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
manifest: javax/xml/namespace/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
pom
description
xml-commons provides an Apache-hosted set of DOM, SAX, and JAXP interfaces for use in other xml-based projects. Our hope is that we can standardize on both a common version and packaging scheme for these critical XML standards interfaces to make the lives of both our developers and users easier. The External Components portion of xml-commons contains interfaces that are defined by external standards organizations. For DOM, that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for JAXP it's Sun.
xml-commons provides an Apache-hosted set of DOM, SAX, and JAXP interfaces for use in other xml-based projects. Our hope is that we can standardize on both a common version and packaging scheme for these critical XML standards interfaces to make the lives of both our developers and users easier. The External Components portion of xml-commons contains interfaces that are defined by external standards organizations. For DOM, that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for JAXP it's Sun.
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.
File Path: /home/ciagent/.m2/repository/com/google/guava/guava/20.0/guava-20.0.jar MD5: f32a8a2524620dbecc9f6bf6a20c293f SHA1: 89507701249388e1ed5ddcf8c41f4ce1be7831ef
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
artifactid
guava
Low
Vendor
manifest
Bundle-Description
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec.
Low
Vendor
Manifest
bundle-symbolicname
com.google.guava
Medium
Vendor
pom
groupid
com.google.guava
Highest
Vendor
central
groupid
com.google.guava
Highest
Vendor
pom
groupid
google.guava
Highest
Vendor
pom
description
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec.
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec.
Low
Product
Manifest
bundle-symbolicname
com.google.guava
Medium
Product
central
artifactid
guava
Highest
Product
pom
description
Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Low
Vendor
pom
description
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Low
Product
pom
parent-groupid
org.apache.commons
Low
Product
pom
description
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Description:
A framework for constructing recognizers, compilers,
and translators from grammatical descriptions containing
Java, C#, C++, or Python actions.
License:
BSD License: http://www.antlr.org/license.html
File Path: /home/ciagent/.m2/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar MD5: f8f1352c52a4c6a500b597596501fc64 SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
artifactid
antlr
Low
Vendor
central
groupid
antlr
Highest
Vendor
jar
package name
antlr
Low
Vendor
pom
name
AntLR Parser Generator
High
Vendor
pom
groupid
antlr
Highest
Vendor
file
name
antlr
High
Vendor
pom
description
A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
Low
Vendor
pom
url
http://www.antlr.org/
Highest
Product
pom
artifactid
antlr
Highest
Product
pom
groupid
antlr
Low
Product
pom
name
AntLR Parser Generator
High
Product
file
name
antlr
High
Product
pom
description
A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-91 XML Injection (aka Blind XPath Injection)
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-415 Double Free
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-190 Integer Overflow or Wraparound
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-787 Out-of-bounds Write
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-787 Out-of-bounds Write
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
Description:
Caja is a HTML/CSS/JavaScript compiler which allows websites to safely embed web applications
from third parties, and enables rich interaction between the embedding page and the embedded
applications using an object-capability security model.
File Path: /home/ciagent/.m2/repository/caja/caja/r5054/caja-r5054.jar MD5: 7379ecf5bc7945ca6ab533b905e449a3 SHA1: 18b47afa0172413346d9c8ae1595b6ffbbddd499
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
organization name
Google
High
Vendor
pom
name
Caja
High
Vendor
pom
url
http://code.google.com/p/google-caja
Highest
Vendor
pom
groupid
google.caja
Highest
Vendor
pom
organization url
http://www.google.com
Medium
Vendor
pom
groupid
caja
Highest
Vendor
pom
artifactid
caja
Low
Vendor
pom
description
Caja is a HTML/CSS/JavaScript compiler which allows websites to safely embed web applications from third parties, and enables rich interaction between the embedding page and the embedded applications using an object-capability security model.
Low
Vendor
jar
package name
caja
Low
Vendor
file
name
caja-r5054
High
Vendor
jar
package name
google
Low
Product
pom
name
Caja
High
Product
pom
groupid
google.caja
Low
Product
pom
description
Caja is a HTML/CSS/JavaScript compiler which allows websites to safely embed web applications from third parties, and enables rich interaction between the embedding page and the embedded applications using an object-capability security model.
Low
Product
jar
package name
caja
Low
Product
file
name
caja-r5054
High
Product
pom
organization name
Google
Low
Product
pom
url
http://code.google.com/p/google-caja
Medium
Product
pom
artifactid
caja
Highest
Product
pom
organization url
http://www.google.com
Low
Version
file
version
5054
Medium
Version
file
name
caja-r5054
Medium
Version
pom
version
r5054
Highest
Identifiers
maven: com.google.caja:caja:r5054
Confidence:High
htmlparser-r4209.jar
Description:
A patched version of the nu.validator v1.2.1 HTML parser.
License:
No Warranty
File Path: /home/ciagent/.m2/repository/caja/htmlparser/r4209/htmlparser-r4209.jar MD5: 31c18bc52991e53ed4eaa28347c44189 SHA1: 0573217e5c9bf8fad6ce827a94191ca0f5785087
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
htmlparser-r4209
High
Vendor
pom
url
http://code.google.com/p/google-caja
Highest
Vendor
pom
artifactid
htmlparser
Low
Vendor
pom
description
A patched version of the nu.validator v1.2.1 HTML parser.
Medium
Vendor
jar
package name
htmlparser
Low
Vendor
pom
groupid
caja
Highest
Vendor
pom
name
HtmlParser
High
Vendor
pom
organization url
http://validator.nu
Medium
Vendor
pom
organization name
Validator.nu
High
Vendor
jar
package name
validator
Low
Vendor
jar
package name
nu
Low
Product
file
name
htmlparser-r4209
High
Product
pom
groupid
caja
Low
Product
pom
organization name
Validator.nu
Low
Product
pom
organization url
http://validator.nu
Low
Product
pom
description
A patched version of the nu.validator v1.2.1 HTML parser.
Medium
Product
jar
package name
htmlparser
Low
Product
pom
name
HtmlParser
High
Product
pom
artifactid
htmlparser
Highest
Product
pom
url
http://code.google.com/p/google-caja
Medium
Product
jar
package name
validator
Low
Version
pom
version
r4209
Highest
Version
file
version
4209
Medium
Version
file
name
htmlparser-r4209
Medium
Identifiers
maven: caja:htmlparser:r4209
Confidence:High
oauth-consumer-20090617.jar
File Path: /home/ciagent/.m2/repository/net/oauth/core/oauth-consumer/20090617/oauth-consumer-20090617.jar MD5: f0e2849d152f4d8bf725aa4e11b8f969 SHA1: fb70a4c98119c27e78320c5e42a99f0b9eb7c356
Referenced In Projects/Scopes:
Description:
Xerces2 is the next generation of high performance, fully compliant XML parsers in the
Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI),
a complete framework for building parser components and configurations that is extremely
modular and easy to program.
File Path: /home/ciagent/.m2/repository/xerces/xercesImpl/2.9.1/xercesImpl-2.9.1.jar MD5: f807f86d7d9db25edbfc782aca7ca2a9 SHA1: 7bc7e49ddfe4fb5f193ed37ecc96c12292c8ceb6
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
central
groupid
xerces
Highest
Vendor
pom
url
http://xerces.apache.org/xerces2-j
Highest
Vendor
pom
artifactid
xercesImpl
Low
Vendor
pom
groupid
xerces
Highest
Vendor
manifest: javax/xml/datatype/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
manifest: org/w3c/dom/ls/
Implementation-Vendor
World Wide Web Consortium
Medium
Vendor
manifest: javax/xml/parsers/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
pom
parent-artifactid
apache
Low
Vendor
pom
description
Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.
Low
Vendor
manifest: org/w3c/dom/
Implementation-Vendor
World Wide Web Consortium
Medium
Vendor
manifest: org/xml/sax/
Implementation-Vendor
David Megginson
Medium
Vendor
file
name
xercesImpl
High
Vendor
manifest: org/apache/xerces/impl/Version.class
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
pom
parent-groupid
org.apache
Medium
Vendor
manifest: org/apache/xerces/xni/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
manifest: javax/xml/validation/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
manifest: javax/xml/transform/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
manifest: javax/xml/xpath/
Implementation-Vendor
Apache Software Foundation
Medium
Vendor
pom
name
Xerces2 Java Parser
High
Product
manifest: org/w3c/dom/
Specification-Title
Document Object Model, Level 3 Core
Medium
Product
manifest: org/w3c/dom/ls/
Specification-Title
Document Object Model, Level 3 Load and Save
Medium
Product
manifest: javax/xml/validation/
Implementation-Title
javax.xml.validation
Medium
Product
manifest: org/apache/xerces/xni/
Implementation-Title
org.apache.xerces.xni
Medium
Product
manifest: javax/xml/validation/
Specification-Title
Java API for XML Processing
Medium
Product
manifest: org/w3c/dom/ls/
Implementation-Title
org.w3c.dom.ls
Medium
Product
manifest: org/w3c/dom/
Implementation-Title
org.w3c.dom
Medium
Product
manifest: javax/xml/xpath/
Implementation-Title
javax.xml.xpath
Medium
Product
manifest: javax/xml/transform/
Implementation-Title
javax.xml.transform
Medium
Product
pom
description
Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Description:
Google HTTP Client Library for Java. Functionality that works on all supported Java platforms,
including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.
File Path: /home/ciagent/.m2/repository/com/google/http-client/google-http-client/1.14.1-beta/google-http-client-1.14.1-beta.jar MD5: 8a3711522ebceef2531d455e2f04a639 SHA1: cb503d4021739e6bac39442ac87b4e311ec77b5e
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
Implementation-Vendor
Google
High
Vendor
pom
name
Google HTTP Client Library for Java
High
Vendor
pom
groupid
com.google.http-client
Highest
Vendor
pom
description
Google HTTP Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.
Low
Vendor
pom
groupid
google.http-client
Highest
Vendor
central
groupid
com.google.http-client
Highest
Vendor
Manifest
Implementation-Vendor-Id
com.google.http-client
Medium
Vendor
pom
parent-groupid
com.google.http-client
Medium
Vendor
pom
artifactid
google-http-client
Low
Vendor
pom
parent-artifactid
google-http-client-parent
Low
Vendor
file
name
google-http-client
High
Product
pom
parent-groupid
com.google.http-client
Low
Product
pom
name
Google HTTP Client Library for Java
High
Product
pom
description
Google HTTP Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar MD5: 04a41f0a068986f0f73485cf507c0f40 SHA1: 5af35056b4d257e4b64b9e8069c0746e8b08629f
Referenced In Project/Scope:
eXo PLF:: Forum Forum service:compile
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
File Path: /home/ciagent/.m2/repository/org/freemarker/freemarker/2.3.18/freemarker-2.3.18.jar MD5: 179cfdc90bff3b95a8d08d810656ad33 SHA1: 7b0cd31bfed5ceb396bdcdc088b24e6ff9eae96f
Referenced In Project/Scope:
eXo PLF:: Forum Forum service:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
name
FreeMarker
High
Vendor
Manifest
extension-name
FreeMarker
Medium
Vendor
Manifest
Implementation-Vendor
Visigoth Software Society
High
Vendor
pom
artifactid
freemarker
Low
Vendor
pom
groupid
freemarker
Highest
Vendor
pom
description
FreeMarker is a "template engine"; a generic tool to generate text output based on templates.
Low
Vendor
file
name
freemarker
High
Vendor
pom
groupid
org.freemarker
Highest
Vendor
central
groupid
org.freemarker
Highest
Vendor
Manifest
specification-vendor
Visigoth Software Society
Low
Vendor
pom
url
http://freemarker.org
Highest
Product
pom
artifactid
freemarker
Highest
Product
pom
groupid
freemarker
Low
Product
pom
name
FreeMarker
High
Product
Manifest
extension-name
FreeMarker
Medium
Product
central
artifactid
freemarker
Highest
Product
pom
description
FreeMarker is a "template engine"; a generic tool to generate text output based on templates.
File Path: /home/ciagent/.m2/repository/org/wikbook/wikbook.template.core/0.9.45/wikbook.template.core-0.9.45.jar MD5: 830af5160a42ed28624d966959b49fbd SHA1: 67cd7abca5de9bb35ec44cf319b750c2fb7cd487
Referenced In Project/Scope:
eXo PLF:: Forum Forum service:compile
File Path: /home/ciagent/.m2/repository/org/exoplatform/doc/doc-style/5.3.x-SNAPSHOT/doc-style-5.3.x-SNAPSHOT.jar MD5: 7be9dd2d8d7f77cf384ec39d3b4b0f61 SHA1: 9720e690fad06a9643591ff5a4f7333d07f9ed2b
Referenced In Project/Scope:
eXo PLF:: Forum Forum service:compile
Description:
The Digester package lets you configure an XML to Java object mapping module
which triggers certain actions called rules whenever a particular
pattern of nested XML elements is recognized.
File Path: /home/ciagent/.m2/repository/commons-digester/commons-digester/2.1/commons-digester-2.1.jar MD5: 528445033f22da28f5047b6abcd1c7c9 SHA1: 73a8001e7a54a255eef0f03521ec1805dc738ca0
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
name
Commons Digester
High
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
manifest
Bundle-Description
The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized.
Low
Vendor
pom
parent-groupid
org.apache.commons
Medium
Vendor
Manifest
bundle-symbolicname
org.apache.commons.digester
Medium
Vendor
Manifest
specification-vendor
The Apache Software Foundation
Low
Vendor
Manifest
bundle-docurl
http://commons.apache.org/digester/
Low
Vendor
pom
url
http://commons.apache.org/digester/
Highest
Vendor
pom
parent-artifactid
commons-parent
Low
Vendor
pom
groupid
commons-digester
Highest
Vendor
pom
artifactid
commons-digester
Low
Vendor
Manifest
Implementation-Vendor
The Apache Software Foundation
High
Vendor
file
name
commons-digester
High
Vendor
central
groupid
commons-digester
Highest
Vendor
pom
description
The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized.
Low
Product
pom
name
Commons Digester
High
Product
pom
artifactid
commons-digester
Highest
Product
central
artifactid
commons-digester
Highest
Product
manifest
Bundle-Description
The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized.
Low
Product
Manifest
bundle-symbolicname
org.apache.commons.digester
Medium
Product
Manifest
Bundle-Name
Commons Digester
Medium
Product
pom
url
http://commons.apache.org/digester/
Medium
Product
Manifest
specification-title
Commons Digester
Medium
Product
Manifest
bundle-docurl
http://commons.apache.org/digester/
Low
Product
Manifest
Implementation-Title
Commons Digester
High
Product
pom
parent-artifactid
commons-parent
Medium
Product
file
name
commons-digester
High
Product
pom
description
The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized.
Description:
The Apache FontBox library is an open source Java tool to obtain low level information
from font files. FontBox is a subproject of Apache PDFBox.
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Description:
The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM)
specification. JempBox is a subproject of Apache PDFBox.
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Description: This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Severity:
Medium
CVSS Score: 5.8
(AV:N/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Severity:
High
CVSS Score: 9.3
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Severity:
High
CVSS Score: 9.3
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.
Description:
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
Apache Commons Compress software defines an API for working with compression and archive formats.These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
Low
Vendor
pom
name
Commons Compress
High
Vendor
Manifest
Implementation-Vendor
The Apache Software Foundation
High
Vendor
pom
url
http://commons.apache.org/compress/
Highest
Vendor
pom
description
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
Apache Commons Compress software defines an API for working with compression and archive formats.These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
Low
Product
pom
name
Commons Compress
High
Product
pom
parent-artifactid
commons-parent
Medium
Product
Manifest
specification-title
Commons Compress
Medium
Product
pom
parent-groupid
org.apache.commons
Low
Product
pom
description
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
Description: The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs. If the S/MIME API is used, the JavaMail API and the Java activation framework will also be needed.
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcmail-jdk15/1.45/bcmail-jdk15-1.45.jar MD5: 13321fc7eff7bcada7b4fedfb592025c SHA1: 3aed7e642dd8d39dc14ed1dec3ff79e084637148
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
extension-name
org.bouncycastle.bcmail
Medium
Vendor
pom
description
The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider ...
Low
Vendor
pom
url
http://www.bouncycastle.org/java.html
Highest
Vendor
Manifest
Implementation-Vendor
BouncyCastle.org
High
Vendor
pom
artifactid
bcmail-jdk15
Low
Vendor
file
name
bcmail-jdk15
High
Vendor
central
groupid
org.bouncycastle
Highest
Vendor
pom
name
Bouncy Castle CMS and S/MIME API
High
Vendor
Manifest
Implementation-Vendor-Id
org.bouncycastle
Medium
Vendor
pom
groupid
bouncycastle
Highest
Vendor
pom
groupid
org.bouncycastle
Highest
Vendor
Manifest
specification-vendor
BouncyCastle.org
Low
Product
Manifest
extension-name
org.bouncycastle.bcmail
Medium
Product
pom
groupid
bouncycastle
Low
Product
file
name
bcmail-jdk15
High
Product
pom
description
The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider ...
Description: The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5.
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcprov-jdk15/1.45/bcprov-jdk15-1.45.jar MD5: 2062f8e3d15748443ea60a94b266371c SHA1: 7741883cb07b4634e8b5fd3337113b6ea770a9bb
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
bcprov-jdk15
High
Vendor
pom
url
http://www.bouncycastle.org/java.html
Highest
Vendor
Manifest
Implementation-Vendor
BouncyCastle.org
High
Vendor
pom
artifactid
bcprov-jdk15
Low
Vendor
central
groupid
org.bouncycastle
Highest
Vendor
Manifest
extension-name
org.bouncycastle.bcprovider
Medium
Vendor
Manifest
Implementation-Vendor-Id
org.bouncycastle
Medium
Vendor
pom
groupid
bouncycastle
Highest
Vendor
pom
name
Bouncy Castle Provider
High
Vendor
pom
groupid
org.bouncycastle
Highest
Vendor
Manifest
specification-vendor
BouncyCastle.org
Low
Vendor
pom
description
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5.
Low
Product
pom
groupid
bouncycastle
Low
Product
file
name
bcprov-jdk15
High
Product
Manifest
extension-name
org.bouncycastle.bcprovider
Medium
Product
pom
url
http://www.bouncycastle.org/java.html
Medium
Product
pom
name
Bouncy Castle Provider
High
Product
central
artifactid
bcprov-jdk15
Highest
Product
pom
artifactid
bcprov-jdk15
Highest
Product
pom
description
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5.
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-310 Cryptographic Issues
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Description: TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML.
File Path: /home/ciagent/.m2/repository/org/ccil/cowan/tagsoup/tagsoup/1.2.1/tagsoup-1.2.1.jar MD5: ae73a52cdcbec10cd61d9ef22fab5936 SHA1: 5584627487e984c03456266d3f8802eb85a9ce97
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
tagsoup
High
Vendor
pom
artifactid
tagsoup
Low
Vendor
central
groupid
org.ccil.cowan.tagsoup
Highest
Vendor
pom
groupid
ccil.cowan.tagsoup
Highest
Vendor
pom
groupid
org.ccil.cowan.tagsoup
Highest
Vendor
pom
description
TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML.
Low
Vendor
pom
url
http://home.ccil.org/~cowan/XML/tagsoup/
Highest
Vendor
pom
name
TagSoup
High
Product
pom
url
http://home.ccil.org/~cowan/XML/tagsoup/
Medium
Product
file
name
tagsoup
High
Product
central
artifactid
tagsoup
Highest
Product
pom
description
TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML.
Severity:
Low
CVSS Score: 2.1
(AV:N/AC:H/Au:S/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
Description:
JHighlight is an embeddable pure Java syntax highlighting
library that supports Java, HTML, XHTML, XML and LZX
languages and outputs to XHTML.
It also supports RIFE templates tags and highlights them
clearly so that you can easily identify the difference
between your RIFE markup and the actual marked up source.
License:
CDDL, v1.0: http://www.opensource.org/licenses/cddl1.php
LGPL, v2.1 or later: http://www.opensource.org/licenses/lgpl-license.php
File Path: /home/ciagent/.m2/repository/com/uwyn/jhighlight/1.0/jhighlight-1.0.jar MD5: 0ad5cf1bc56657f5e9e327e5e768da0a SHA1: 0b1774029ee29472df8c25e5ba796431f7689fd6
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
groupid
uwyn
Highest
Vendor
pom
organization url
http://uwyn.com/
Medium
Vendor
central
groupid
com.uwyn
Highest
Vendor
pom
organization name
Uwyn
High
Vendor
pom
url
https://jhighlight.dev.java.net/
Highest
Vendor
jar
package name
uwyn
Low
Vendor
file
name
jhighlight
High
Vendor
pom
artifactid
jhighlight
Low
Vendor
jar
package name
jhighlight
Low
Vendor
pom
name
JHighlight
High
Vendor
pom
description
JHighlight is an embeddable pure Java syntax highlighting library that supports Java, HTML, XHTML, XML and LZX languages and outputs to XHTML. It also supports RIFE templates tags and highlights them clearly so that you can easily identify the difference between your RIFE markup and the actual marked up source.
Low
Vendor
pom
groupid
com.uwyn
Highest
Product
pom
organization url
http://uwyn.com/
Low
Product
pom
url
https://jhighlight.dev.java.net/
Medium
Product
jar
package name
jhighlight
Low
Product
pom
name
JHighlight
High
Product
pom
artifactid
jhighlight
Highest
Product
pom
organization name
Uwyn
Low
Product
pom
description
JHighlight is an embeddable pure Java syntax highlighting library that supports Java, HTML, XHTML, XML and LZX languages and outputs to XHTML. It also supports RIFE templates tags and highlights them clearly so that you can easily identify the difference between your RIFE markup and the actual marked up source.
Description: This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/ws/commons/ws-commons-util/1.0.1/ws-commons-util-1.0.1.jar MD5: 66919d22287ddab742a135da764c2cd6 SHA1: 126e80ff798fece634bc94e61f8be8a8da00be60
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
groupid
org.apache.ws.commons
Highest
Vendor
Manifest
specification-vendor
Apache Software Foundation
Low
Vendor
Manifest
Implementation-Vendor
Apache Software Foundation
High
Vendor
pom
groupid
apache.ws.commons
Highest
Vendor
Manifest
extension-name
ws-commons-util
Medium
Vendor
central
groupid
ws-commons-util
High
Vendor
pom
description
This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced.
Low
Vendor
pom
organization url
http://www.apache.org/
Medium
Vendor
pom
url
http://ws.apache.org/commons/util
Highest
Vendor
file
name
ws-commons-util
High
Vendor
pom
name
Apache WebServices Common Utilities
High
Vendor
pom
artifactid
ws-commons-util
Low
Vendor
pom
organization name
Apache Software Foundation
High
Vendor
central
groupid
org.apache.ws.commons
High
Product
central
artifactid
ws-commons-util
High
Product
Manifest
extension-name
ws-commons-util
Medium
Product
pom
description
This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced.
Low
Product
pom
artifactid
ws-commons-util
Highest
Product
pom
organization name
Apache Software Foundation
Low
Product
pom
organization url
http://www.apache.org/
Low
Product
pom
groupid
apache.ws.commons
Low
Product
file
name
ws-commons-util
High
Product
pom
name
Apache WebServices Common Utilities
High
Product
Manifest
Implementation-Title
ws-commons-util
High
Product
Manifest
specification-title
This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced.
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Description: StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output.
StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization.
It evolved over years of effort developing jGuru.com.
StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic
is that unlike other engines, it strictly enforces model-view separation.
Strict separation makes websites and code generators more flexible
and maintainable; it also provides an excellent defense against malicious
template authors.
There are currently about 600 StringTemplate source downloads a month.
License:
BSD licence: http://antlr.org/license.html
File Path: /home/ciagent/.m2/repository/org/antlr/stringtemplate/3.2.1/stringtemplate-3.2.1.jar MD5: b58ca53e518a92a1991eb63b61917582 SHA1: 59ec8083721eae215c6f3caee944c410d2be34de
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
url
http://www.stringtemplate.org
Highest
Vendor
central
groupid
org.antlr
Highest
Vendor
pom
description
StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output. StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization. It evolved over years of effort developing jGuru.com. StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic is that un...
Low
Vendor
jar
package name
stringtemplate
Low
Vendor
file
name
stringtemplate
High
Vendor
jar
package name
language
Low
Vendor
jar
package name
antlr
Low
Vendor
pom
name
ANTLR StringTemplate
High
Vendor
pom
groupid
org.antlr
Highest
Vendor
pom
groupid
antlr
Highest
Vendor
pom
artifactid
stringtemplate
Low
Product
pom
artifactid
stringtemplate
Highest
Product
pom
description
StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output. StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization. It evolved over years of effort developing jGuru.com. StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic is that un...
Description: A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
File Path: /home/ciagent/.m2/repository/org/antlr/antlr-runtime/3.5/antlr-runtime-3.5.jar MD5: aa6d7c8b425df59f5f5bc98c58cfd9fc SHA1: 0baa82bff19059401e90e1b90020beb9c96305d7
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
description
A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
Low
Vendor
pom
parent-artifactid
antlr-master
Low
Vendor
pom
url
http://www.antlr.org
Highest
Vendor
pom
parent-groupid
org.antlr
Medium
Vendor
file
name
antlr-runtime
High
Vendor
pom
groupid
antlr
Highest
Vendor
pom
artifactid
antlr-runtime
Low
Vendor
central
groupid
org.antlr
Highest
Vendor
pom
name
ANTLR 3 Runtime
High
Vendor
pom
groupid
org.antlr
Highest
Vendor
Manifest
Implementation-Vendor-Id
org.antlr
Medium
Vendor
Manifest
Implementation-Vendor
ANTLR
High
Product
pom
description
A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Description:
JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be
used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the
document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML.
License:
Java HTML Tidy License: http://jtidy.svn.sourceforge.net/viewvc/jtidy/trunk/jtidy/LICENSE.txt?revision=95
File Path: /home/ciagent/.m2/repository/net/sf/jtidy/jtidy/r938/jtidy-r938.jar MD5: 6a9121561b8f98c0a8fb9b6e57f50e6b SHA1: ab08d87a225a715a69107732b67f21e1da930349
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
jar
package name
w3c
Low
Vendor
pom
description
JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML.
Low
Vendor
pom
organization name
sourceforge
High
Vendor
pom
name
JTidy
High
Vendor
pom
url
http://jtidy.sourceforge.net
Highest
Vendor
central
groupid
net.sf.jtidy
Highest
Vendor
pom
artifactid
jtidy
Low
Vendor
jar
package name
tidy
Low
Vendor
pom
groupid
net.sf.jtidy
Highest
Vendor
pom
organization url
http://sourceforge.net
Medium
Vendor
file
name
jtidy-r938
High
Product
central
artifactid
jtidy
Highest
Product
pom
organization url
http://sourceforge.net
Low
Product
pom
description
JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML.
Description: mime-util is a simple to use, small, light weight and fast open source java utility library that can detect
MIME types from files, input streams, URL's and byte arrays.
Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/eu/medsea/mimeutil/mime-util/2.1.3/mime-util-2.1.3.jar MD5: 3d4f3e1a96eb79683197f1c8b182f4a6 SHA1: 0c9cfae15c74f62491d4f28def0dff1dabe52a47
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
bundle-symbolicname
eu.medsea.mimeutil.mime-util
Medium
Vendor
pom
organization name
Medsea Business Solutions S.L.
High
Vendor
manifest
Bundle-Description
mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
Low
Vendor
file
name
mime-util
High
Vendor
central
groupid
eu.medsea.mimeutil
Highest
Vendor
pom
url
http://www.medsea.eu/mime-util/
Highest
Vendor
pom
organization url
http://www.medsea.eu
Medium
Vendor
pom
name
Mime Detection Utility
High
Vendor
pom
description
mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
Low
Vendor
Manifest
url
http://www.medsea.eu/mime-util/
Low
Vendor
pom
groupid
eu.medsea.mimeutil
Highest
Vendor
pom
artifactid
mime-util
Low
Vendor
Manifest
bundle-docurl
http://www.medsea.eu
Low
Product
pom
groupid
eu.medsea.mimeutil
Low
Product
Manifest
bundle-symbolicname
eu.medsea.mimeutil.mime-util
Medium
Product
manifest
Bundle-Description
mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
Low
Product
pom
url
http://www.medsea.eu/mime-util/
Medium
Product
file
name
mime-util
High
Product
pom
artifactid
mime-util
Highest
Product
pom
organization name
Medsea Business Solutions S.L.
Low
Product
pom
name
Mime Detection Utility
High
Product
pom
description
mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Description:
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar MD5: dd77e787b7b5dc56f6a1cb658716d55d SHA1: 04ff14d809195b711fd6bcc87e6777f886730ca1
Referenced In Projects/Scopes:
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.
Low
Vendor
manifest
Bundle-Description
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.
Low
Product
manifest
Bundle-Description
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
File Path: /home/ciagent/.m2/repository/org/apache/commons/commons-lang3/3.3.2/commons-lang3-3.3.2.jar MD5: 3128bf75a2549ebe38663401191bacab SHA1: 90a3822c38ec8c996e84c16a3477ef632cbc87a3
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
bundle-symbolicname
org.apache.commons.lang3
Medium
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
pom
parent-groupid
org.apache.commons
Medium
Vendor
Manifest
specification-vendor
The Apache Software Foundation
Low
Vendor
central
groupid
org.apache.commons
Highest
Vendor
pom
description
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Vendor
manifest
Bundle-Description
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Product
manifest
Bundle-Description
Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Description:
JSON (JavaScript Object Notation) is a lightweight data-interchange format.
It is easy for humans to read and write. It is easy for machines to parse and generate.
It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition
- December 1999. JSON is a text format that is completely language independent but uses
conventions that are familiar to programmers of the C-family of languages, including C, C++, C#,
Java, JavaScript, Perl, Python, and many others.
These properties make JSON an ideal data-interchange language.
File Path: /home/ciagent/.m2/repository/org/json/json/20070829/json-20070829.jar MD5: 4a913140f9099519dfc0212fa5d9a457 SHA1: 89190ff77b57203c3417555f32226998da97ff38
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
url
http://www.json.org/java/index.html
Highest
Vendor
pom
organization name
JSON
High
Vendor
pom
name
JSON (JavaScript Object Notation)
High
Vendor
file
name
json-20070829
High
Vendor
pom
groupid
json
Highest
Vendor
pom
description
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but...
Low
Vendor
central
groupid
org.json
Highest
Vendor
pom
groupid
org.json
Highest
Vendor
jar
package name
json
Low
Vendor
pom
artifactid
json
Low
Vendor
pom
organization url
http://json.org/
Medium
Product
pom
organization url
http://json.org/
Low
Product
pom
artifactid
json
Highest
Product
pom
groupid
json
Low
Product
pom
name
JSON (JavaScript Object Notation)
High
Product
central
artifactid
json
Highest
Product
file
name
json-20070829
High
Product
pom
description
JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but...
Description:
c3p0 is an easy-to-use library for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources,
including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension.
License:
GNU LESSER GENERAL PUBLIC LICENSE: http://www.gnu.org/licenses/lgpl.txt
File Path: /home/ciagent/.m2/repository/c3p0/c3p0/0.9.1.1/c3p0-0.9.1.1.jar MD5: 640c58226e7bb6beacc8ac3f6bb533d1 SHA1: 302704f30c6e7abb7a0457f7771739e03c973e80
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
extension-name
com.mchange.v2.c3p0
Medium
Vendor
pom
groupid
c3p0
Highest
Vendor
Manifest
Implementation-Vendor-Id
com.mchange
Medium
Vendor
file
name
c3p0
High
Vendor
pom
description
c3p0 is an easy-to-use library for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension.
Low
Vendor
pom
url
http://c3p0.sourceforge.net
Highest
Vendor
pom
artifactid
c3p0
Low
Vendor
central
groupid
c3p0
Highest
Vendor
Manifest
specification-vendor
Machinery For Change, Inc.
Low
Vendor
Manifest
Implementation-Vendor
Machinery For Change, Inc.
High
Vendor
pom
name
c3p0:JDBC DataSources/Resource Pools
High
Product
Manifest
extension-name
com.mchange.v2.c3p0
Medium
Product
central
artifactid
c3p0
Highest
Product
file
name
c3p0
High
Product
pom
description
c3p0 is an easy-to-use library for augmenting traditional (DriverManager-based) JDBC drivers with JNDI-bindable DataSources, including DataSources that implement Connection and Statement Pooling, as described by the jdbc3 spec and jdbc2 std extension.
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Description: MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs such as Hotspot in JDK 1.4+.
License:
Indiana University Extreme! Lab Software License, vesion 1.1.1: http://www.extreme.indiana.edu/viewcvs/~checkout~/XPP3/java/LICENSE.txt
Public Domain: http://creativecommons.org/licenses/publicdomain
Apache Software License, version 1.1: http://www.apache.org/licenses/LICENSE-1.1
File Path: /home/ciagent/.m2/repository/xpp3/xpp3/1.1.4c/xpp3-1.1.4c.jar MD5: 6e3c39f391e4994888b7d0030f775804 SHA1: 9b988ea84b9e4e9f1874e390ce099b8ac12cfff5
Referenced In Projects/Scopes:
MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ...
Low
Vendor
pom
organization name
Extreme! Lab, Indiana University
High
Vendor
pom
groupid
xpp3
Highest
Vendor
central
groupid
xpp3
Highest
Vendor
jar
package name
builder
Low
Product
pom
artifactid
xpp3
Highest
Product
jar
package name
v1
Low
Product
pom
groupid
xpp3
Low
Product
pom
description
MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ...
File Path: /home/ciagent/.m2/repository/jdom/jdom/1.0/jdom-1.0.jar MD5: 0b8f97de82fc9529b1028a77125ce4f8 SHA1: a2ac1cd690ab4c80defe7f9bce14d35934c35cec
Referenced In Project/Scope:
eXo PLF:: Forum Forum service:compile
Description: All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it
easy to work in Java with most syndication formats. Today it accepts all flavors of RSS
(0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes
a set of parsers and generators for the various flavors of feeds, as well as converters
to convert from one format to another. The parsers can give you back Java objects that
are either specific for the format you want to work with, or a generic normalized
SyndFeed object that lets you work on with the data without bothering about the
underlying format.
File Path: /home/ciagent/.m2/repository/rome/rome/1.0/rome-1.0.jar MD5: 53d38c030287b939f4e6d745ba1269a7 SHA1: 022b33347f315833e9348cec2751af1a5d5656e4
Referenced In Projects/Scopes:
eXo PLF:: Forum Forum service:compile
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
bundle-symbolicname
rome.rome
Medium
Vendor
pom
name
ROME, RSS and atOM utilitiEs for Java
High
Vendor
file
name
rome
High
Vendor
manifest
Bundle-Description
All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format.
Low
Vendor
central
groupid
rome
Highest
Vendor
Manifest
bundle-docurl
http://java.sun.com/
Low
Vendor
pom
groupid
rome
Highest
Vendor
pom
organization url
http://java.sun.com/
Medium
Vendor
pom
url
https://rome.dev.java.net/
Highest
Vendor
pom
description
All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format.
Low
Vendor
Manifest
originally-created-by
1.6.0_10 (Sun Microsystems Inc.)
Low
Vendor
pom
artifactid
rome
Low
Vendor
Manifest
embed-directory
META-INF/lib
Low
Vendor
pom
organization name
Sun Microsystems
High
Product
Manifest
bundle-symbolicname
rome.rome
Medium
Product
pom
name
ROME, RSS and atOM utilitiEs for Java
High
Product
file
name
rome
High
Product
manifest
Bundle-Description
All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format.
Low
Product
Manifest
bundle-docurl
http://java.sun.com/
Low
Product
pom
groupid
rome
Low
Product
pom
artifactid
rome
Highest
Product
central
artifactid
rome
Highest
Product
pom
organization name
Sun Microsystems
Low
Product
pom
description
All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Description: MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs such as Hotspot in JDK 1.4+.
License:
Indiana University Extreme! Lab Software License, vesion 1.1.1: http://www.extreme.indiana.edu/viewcvs/~checkout~/XPP3/java/LICENSE.txt
Public Domain: http://creativecommons.org/licenses/publicdomain
File Path: /home/ciagent/.m2/repository/xpp3/xpp3_min/1.1.4c/xpp3_min-1.1.4c.jar MD5: dcd95bcb84b09897b2b66d4684c040da SHA1: 19d4e90b43059058f6e056f794f0ea4030d60b86
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ...
Low
Vendor
pom
organization name
Extreme! Lab, Indiana University
High
Vendor
pom
artifactid
xpp3_min
Low
Vendor
jar
package name
xmlpull
Low
Vendor
pom
groupid
xpp3
Highest
Vendor
file
name
xpp3_min
High
Vendor
pom
name
MXP1: Xml Pull Parser 3rd Edition (XPP3)
High
Vendor
central
groupid
xpp3
Highest
Vendor
pom
organization url
http://www.extreme.indiana.edu/
Medium
Product
pom
artifactid
xpp3_min
Highest
Product
jar
package name
v1
Low
Product
pom
groupid
xpp3
Low
Product
pom
description
MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ...
File Path: /home/ciagent/.m2/repository/org/javassist/javassist/3.20.0-GA/javassist-3.20.0-GA.jar MD5: a89dd7907d76e061ec2c07e762a74256 SHA1: a9cbcdfb7e9f86fbc74d3afae65f2248bfbf82a0
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
specification-vendor
Shigeru Chiba, www.javassist.org
Low
Vendor
pom
name
Javassist
High
Vendor
pom
organization name
Shigeru Chiba, www.javassist.org
High
Vendor
pom
groupid
javassist
Highest
Vendor
manifest
Bundle-Description
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java.
Low
Vendor
Manifest
bundle-symbolicname
javassist
Medium
Vendor
pom
artifactid
javassist
Low
Vendor
central
groupid
org.javassist
Highest
Vendor
pom
description
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java.
Low
Vendor
pom
url
http://www.javassist.org/
Highest
Vendor
pom
groupid
org.javassist
Highest
Vendor
file
name
javassist
High
Product
Manifest
specification-title
Javassist
Medium
Product
pom
artifactid
javassist
Highest
Product
pom
name
Javassist
High
Product
manifest
Bundle-Description
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java.
Low
Product
Manifest
bundle-symbolicname
javassist
Medium
Product
pom
organization name
Shigeru Chiba, www.javassist.org
Low
Product
Manifest
Bundle-Name
Javassist
Medium
Product
pom
description
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java.
Description:
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
License:
Similar to Apache License but with the acknowledgment clause removed: https://raw.github.com/hunterhacker/jdom/master/LICENSE.txt
File Path: /home/ciagent/.m2/repository/org/jdom/jdom/1.1.3/jdom-1.1.3.jar MD5: 140bfed13341fe2039eee0f26a16d705 SHA1: 8bdfeb39fa929c35f5e4f0b02d34350db39a1efc
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
manifest: org/jdom/input/
Implementation-Vendor
jdom.org
Medium
Vendor
manifest: org/jdom/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
name
JDOM
High
Vendor
manifest: org/jdom/adapters/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
groupid
jdom
Highest
Vendor
pom
description
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
Medium
Vendor
central
groupid
org.jdom
High
Vendor
file
name
jdom
High
Vendor
pom
artifactid
jdom
Low
Vendor
pom
url
http://www.jdom.org
Highest
Vendor
pom
groupid
org.jdom
Highest
Vendor
manifest: org/jdom/xpath/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
organization name
JDOM
High
Vendor
manifest: org/jdom/filter/
Implementation-Vendor
jdom.org
Medium
Vendor
manifest: org/jdom/transform/
Implementation-Vendor
jdom.org
Medium
Vendor
manifest: org/jdom/output/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
organization url
http://www.jdom.org
Medium
Product
manifest: org/jdom/input/
Specification-Title
JDOM Input Classes
Medium
Product
central
artifactid
jdom-legacy
High
Product
pom
name
JDOM
High
Product
manifest: org/jdom/adapters/
Implementation-Title
org.jdom.adapters
Medium
Product
pom
description
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
Description:
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
License:
Similar to Apache License but with the acknowledgment clause removed: https://raw.github.com/hunterhacker/jdom/master/LICENSE.txt
File Path: /home/ciagent/.m2/repository/org/jdom/jdom2/2.0.5/jdom2-2.0.5.jar MD5: 302db3c65c38d3c10ef31bca76bd76b4 SHA1: 2001db51c131e555bafdb77fc52af6a9408c505e
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
name
JDOM
High
Vendor
manifest: org/jdom2/output/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
groupid
jdom
Highest
Vendor
pom
description
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
Medium
Vendor
central
groupid
org.jdom
Highest
Vendor
manifest: org/jdom2/filter/
Implementation-Vendor
jdom.org
Medium
Vendor
manifest: org/jdom2/adapters/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
url
http://www.jdom.org
Highest
Vendor
pom
groupid
org.jdom
Highest
Vendor
manifest: org/jdom2/xpath/
Implementation-Vendor
jdom.org
Medium
Vendor
manifest: org/jdom2/
Implementation-Vendor
jdom.org
Medium
Vendor
manifest: org/jdom2/input/
Implementation-Vendor
jdom.org
Medium
Vendor
pom
organization name
JDOM
High
Vendor
manifest: org/jdom2/transform/
Implementation-Vendor
jdom.org
Medium
Vendor
file
name
jdom2
High
Vendor
pom
artifactid
jdom2
Low
Vendor
pom
organization url
http://www.jdom.org
Medium
Product
manifest: org/jdom2/filter/
Implementation-Title
org.jdom2.filter
Medium
Product
pom
name
JDOM
High
Product
manifest: org/jdom2/
Implementation-Title
org.jdom2
Medium
Product
pom
description
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
Description:
HtmlCleaner is an HTML parser written in Java. It transforms dirty HTML to well-formed XML following
the same rules that most web-browsers use.
File Path: /home/ciagent/.m2/repository/net/sourceforge/htmlcleaner/htmlcleaner/2.7/htmlcleaner-2.7.jar MD5: 59c43d382a268e31867fcd3de90991a0 SHA1: e2f6f5e109695701578258934d9819379c5bffe4
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
artifactid
htmlcleaner
Low
Vendor
jar
package name
htmlcleaner
Low
Vendor
pom
groupid
net.sourceforge.htmlcleaner
Highest
Vendor
file
name
htmlcleaner
High
Vendor
central
groupid
net.sourceforge.htmlcleaner
Highest
Vendor
hint analyzer
vendor
htmlcleaner_project
Highest
Vendor
pom
name
HtmlCleaner
High
Vendor
pom
description
HtmlCleaner is an HTML parser written in Java. It transforms dirty HTML to well-formed XML following the same rules that most web-browsers use.
Low
Vendor
pom
url
http://htmlcleaner.sourceforge.net/
Highest
Product
file
name
htmlcleaner
High
Product
pom
url
http://htmlcleaner.sourceforge.net/
Medium
Product
pom
artifactid
htmlcleaner
Highest
Product
pom
name
HtmlCleaner
High
Product
pom
description
HtmlCleaner is an HTML parser written in Java. It transforms dirty HTML to well-formed XML following the same rules that most web-browsers use.
File Path: /home/ciagent/.m2/repository/net/java/dev/stax-utils/stax-utils/20070216/stax-utils-20070216.jar MD5: e4e3c9cad3b8289b1f905d6705bb6368 SHA1: 1d9fc60be26a0482c36b7a04d2c581ddf758b6ea
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
stax-utils-20070216
High
Vendor
jar
package name
javanet
Low
Vendor
jar
package name
staxutils
Low
Vendor
pom
description
Provides a set of utility classes to integrate StAX into existing XML processing applications.
Medium
Vendor
pom
url
http://java.net/projects/stax-utils/
Highest
Vendor
pom
artifactid
stax-utils
Low
Vendor
pom
groupid
net.java.dev.stax-utils
Highest
Vendor
central
groupid
net.java.dev.stax-utils
Highest
Vendor
pom
name
StAX Utilities Project
High
Product
file
name
stax-utils-20070216
High
Product
jar
package name
staxutils
Low
Product
central
artifactid
stax-utils
Highest
Product
pom
description
Provides a set of utility classes to integrate StAX into existing XML processing applications.
File Path: /home/ciagent/.m2/repository/org/xwiki/commons/xwiki-commons-xml/5.4.7/xwiki-commons-xml-5.4.7.jar MD5: 292ec670c150223faee3a24a5288b9bd SHA1: 788b59fc9ea9109aacc237a15f059530b1afb793
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Description: SAC is a standard interface for CSS parsers.
License:
The W3C Software License: http://www.w3.org/Consortium/Legal/copyright-software-19980720
File Path: /home/ciagent/.m2/repository/org/w3c/css/sac/1.3/sac-1.3.jar MD5: eb04fa63fc70c722f2b8ec156166343b SHA1: cdb2dcb4e22b83d6b32b93095f644c3462739e82
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Description: A CSS parser which implements SAC (the Simple API for CSS).
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl.txt
File Path: /home/ciagent/.m2/repository/net/sourceforge/cssparser/cssparser/0.9.18/cssparser-0.9.18.jar MD5: dc57713d4c7a54a569fc67529ce3b525 SHA1: 61c015378d27b5e245a5deb7a324c7e716b4706a
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
groupid
net.sourceforge.cssparser
Highest
Vendor
Manifest
implementation-url
http://cssparser.sourceforge.net/
Low
Vendor
Manifest
url
http://cssparser.sourceforge.net/
Low
Vendor
pom
description
A CSS parser which implements SAC (the Simple API for CSS).
Medium
Vendor
file
name
cssparser
High
Vendor
Manifest
Implementation-Vendor-Id
net.sourceforge.cssparser
Medium
Vendor
pom
name
CSS Parser
High
Vendor
pom
artifactid
cssparser
Low
Vendor
pom
url
http://cssparser.sourceforge.net/
Highest
Vendor
central
groupid
net.sourceforge.cssparser
Highest
Vendor
Manifest
build-time
2015-10-27 19:57
Low
Product
Manifest
specification-title
CSS Parser
Medium
Product
pom
groupid
net.sourceforge.cssparser
Low
Product
Manifest
url
http://cssparser.sourceforge.net/
Low
Product
pom
description
A CSS parser which implements SAC (the Simple API for CSS).
Description:
JCommon is a free general purpose Java class library that is used in
several projects at www.jfree.org, including JFreeChart and
JFreeReport.
License:
GNU Lesser General Public Licence: http://www.gnu.org/licenses/lgpl.txt
File Path: /home/ciagent/.m2/repository/org/jfree/jcommon/1.0.17/jcommon-1.0.17.jar MD5: d123cd511e2ebc4542e8b424cd20bbde SHA1: 7bcb68fde08258e59fe7bcc758c08af830fb2c1d
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
central
groupid
org.jfree
Highest
Vendor
jar
package name
jfree
Low
Vendor
pom
groupid
org.jfree
Highest
Vendor
pom
description
JCommon is a free general purpose Java class library that is used in several projects at www.jfree.org, including JFreeChart and JFreeReport.
Low
Vendor
file
name
jcommon
High
Vendor
pom
organization url
http://www.jfree.org/
Medium
Vendor
pom
url
http://www.jfree.org/jcommon/
Highest
Vendor
pom
groupid
jfree
Highest
Vendor
pom
organization name
JFree.org
High
Vendor
pom
artifactid
jcommon
Low
Vendor
pom
name
JCommon
High
Product
pom
url
http://www.jfree.org/jcommon/
Medium
Product
pom
artifactid
jcommon
Highest
Product
central
artifactid
jcommon
Highest
Product
pom
groupid
jfree
Low
Product
pom
description
JCommon is a free general purpose Java class library that is used in several projects at www.jfree.org, including JFreeChart and JFreeReport.
Description:
JFreeChart is a class library, written in Java, for generating charts.
Utilising the Java2D APIs, it currently supports bar charts, pie charts,
line charts, XY-plots and time series plots.
License:
GNU Lesser General Public Licence: http://www.gnu.org/licenses/lgpl.txt
File Path: /home/ciagent/.m2/repository/org/jfree/jfreechart/1.0.14/jfreechart-1.0.14.jar MD5: e0ac6e8ecb858f946200b326209fe639 SHA1: fa67c798b0ae80b84f3854d69e341abacd3867c5
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
organization url
http://www.jfree.org/
Medium
Vendor
pom
organization name
JFree.org
High
Vendor
pom
url
http://www.jfree.org/jfreechart/
Highest
Vendor
pom
name
JFreeChart
High
Vendor
central
groupid
org.jfree
Highest
Vendor
jar
package name
jfree
Low
Vendor
pom
groupid
org.jfree
Highest
Vendor
file
name
jfreechart
High
Vendor
pom
groupid
jfree
Highest
Vendor
pom
description
JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots.
Low
Vendor
pom
artifactid
jfreechart
Low
Vendor
jar
package name
chart
Low
Product
pom
artifactid
jfreechart
Highest
Product
central
artifactid
jfreechart
Highest
Product
pom
groupid
jfree
Low
Product
pom
organization url
http://www.jfree.org/
Low
Product
file
name
jfreechart
High
Product
pom
description
JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots.
Description: Apache Velocity is a general purpose template engine.
File Path: /home/ciagent/.m2/repository/org/apache/velocity/velocity/1.7/velocity-1.7.jar MD5: 3692dd72f8367cb35fb6280dc2916725 SHA1: 2ceb567b8f3f21118ecdec129fe1271dbc09aa7a
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
Manifest
bundle-symbolicname
org.apache.velocity
Medium
Vendor
file
name
velocity
High
Vendor
Manifest
specification-vendor
Apache Software Foundation
Low
Vendor
Manifest
Implementation-Vendor
Apache Software Foundation
High
Vendor
pom
artifactid
velocity
Low
Vendor
pom
name
Apache Velocity
High
Vendor
pom
parent-artifactid
apache
Low
Vendor
pom
url
http://velocity.apache.org/engine/devel/
Highest
Vendor
central
groupid
org.apache.velocity
Highest
Vendor
pom
parent-groupid
org.apache
Medium
Vendor
pom
description
Apache Velocity is a general purpose template engine.
Medium
Vendor
pom
groupid
apache.velocity
Highest
Vendor
Manifest
extension-name
velocity
Medium
Vendor
pom
groupid
org.apache.velocity
Highest
Product
pom
parent-artifactid
apache
Medium
Product
Manifest
Implementation-Title
org.apache.velocity
High
Product
Manifest
bundle-symbolicname
org.apache.velocity
Medium
Product
Manifest
specification-title
Velocity is a Java-based template engine
Medium
Product
file
name
velocity
High
Product
pom
name
Apache Velocity
High
Product
Manifest
Bundle-Name
Apache Velocity
Medium
Product
pom
parent-groupid
org.apache
Low
Product
pom
groupid
apache.velocity
Low
Product
pom
description
Apache Velocity is a general purpose template engine.
File Path: /home/ciagent/.m2/repository/velocity-tools/velocity-tools/1.4/velocity-tools-1.4.jar MD5: 2ef7ed8b728186558b5d587c38900b84 SHA1: 4e1f4d507030a00959f4c0c7fcc60b3565617d08
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
velocity-tools
High
Vendor
pom
artifactid
velocity-tools
Low
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
Manifest
extension-name
velocity-tools
Medium
Vendor
central
groupid
velocity-tools
Highest
Vendor
Manifest
specification-vendor
Apache Software Foundation
Low
Vendor
Manifest
Implementation-Vendor
Apache Software Foundation
High
Vendor
pom
groupid
velocity-tools
Highest
Product
file
name
velocity-tools
High
Product
Manifest
Implementation-Title
org.apache.velocity
High
Product
Manifest
extension-name
velocity-tools
Medium
Product
pom
artifactid
velocity-tools
Highest
Product
pom
groupid
velocity-tools
Low
Product
central
artifactid
velocity-tools
Highest
Product
Manifest
specification-title
VelocityTools is a set of utilities for use with the Velocity template engine and Struts web framework
Description:
Simple java library for transforming an Object to another Object.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/net/sf/ezmorph/ezmorph/1.0.6/ezmorph-1.0.6.jar MD5: 1fa113c6aacf3a01af1449df77acd474 SHA1: 01e55d2a0253ea37745d33062852fd2c90027432
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
url
http://ezmorph.sourceforge.net
Highest
Vendor
central
groupid
net.sf.ezmorph
Highest
Vendor
jar
package name
ezmorph
Low
Vendor
pom
groupid
net.sf.ezmorph
Highest
Vendor
file
name
ezmorph
High
Vendor
pom
description
Simple java library for transforming an Object to another Object.
Medium
Vendor
jar
package name
sf
Low
Vendor
jar
package name
net
Low
Vendor
pom
name
ezmorph
High
Vendor
pom
artifactid
ezmorph
Low
Product
pom
artifactid
ezmorph
Highest
Product
jar
package name
ezmorph
Low
Product
file
name
ezmorph
High
Product
pom
description
Simple java library for transforming an Object to another Object.
File Path: /home/ciagent/.m2/repository/net/sf/json-lib/json-lib/2.4/json-lib-2.4-jdk15.jar MD5: f5db294d05b3d5a5bfb873455b0a8626 SHA1: 136743e0d12df4e785e62b48618cee169b2ae546
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/commons-configuration/commons-configuration/1.10/commons-configuration-1.10.jar MD5: b16511ce540fefd53981245f5f21c5f8 SHA1: 2b36e4adfb66d966c5aef2d73deb6be716389dc9
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
file
name
commons-configuration
High
Vendor
pom
name
Apache Commons Configuration
High
Vendor
central
groupid
commons-configuration
Highest
Vendor
pom
groupid
commons-configuration
Highest
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
manifest
Bundle-Description
Tools to assist in the reading of configuration/preferences files in various formats.
Medium
Vendor
pom
parent-groupid
org.apache.commons
Medium
Vendor
Manifest
specification-vendor
The Apache Software Foundation
Low
Vendor
Manifest
bundle-docurl
http://commons.apache.org/configuration/
Low
Vendor
pom
artifactid
commons-configuration
Low
Vendor
pom
description
Tools to assist in the reading of configuration/preferences files in various formats.
File Path: /home/ciagent/.m2/repository/org/exoplatform/wiki/wiki-renderer/5.3.x-SNAPSHOT/wiki-renderer-5.3.x-SNAPSHOT.jar MD5: b8b186ca043dd0fd13fc3abbaf9b5d60 SHA1: a8d447e4dbcae5c1df51ff41a75afcb17e07cf7e
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /srv/ciagent/workspace/PLF/forum-develop-site/sources/component/bbcode/target/forum-component-bbcode-5.3.x-SNAPSHOT.jar MD5: 9728a6e2bd3e402725256db04c80165a SHA1: 7687b0972a8f794efea08b7051ea282cc85a9165
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Description: A Java 1.5 Parser with AST generation and visitor support. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code.
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl.html
File Path: /home/ciagent/.m2/repository/com/google/code/javaparser/javaparser/1.0.8/javaparser-1.0.8.jar MD5: 32228e53ef6cc2ebe515bc40d7c9a4f9 SHA1: 9ca2f8ef2233babc53a8c2b6bb21869d94f5fcc1
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:runtime
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
groupid
google.code.javaparser
Highest
Vendor
pom
name
Java 1.5 Parser and AST
High
Vendor
pom
description
A Java 1.5 Parser with AST generation and visitor support. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code.
Low
Vendor
jar
package name
parser
Low
Vendor
pom
groupid
com.google.code.javaparser
Highest
Vendor
pom
url
http://code.google.com/p/javaparser/
Highest
Vendor
file
name
javaparser
High
Vendor
pom
artifactid
javaparser
Low
Vendor
jar
package name
japa
Low
Vendor
jar
package name
ast
Low
Product
pom
name
Java 1.5 Parser and AST
High
Product
pom
description
A Java 1.5 Parser with AST generation and visitor support. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code.
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.testgenerator/1.3.0/chromattic.testgenerator-1.3.0.jar MD5: 971802dfdfdc6500f1ff0e583a7659a1 SHA1: e725269db29a0fc8c982df481e5ce09b84e5d6a8
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:test-compile
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.metamodel/1.3.0/chromattic.metamodel-1.3.0.jar MD5: 0d534975c688ebabbc232601c6bc13da SHA1: fbaa10037faf34a2d4d8eeb4e6b5ce28c95a9455
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.api/1.1.0/reflext.api-1.1.0.jar MD5: fe732172fa2fb5ae4b63866ef15da41f SHA1: 28374c509099736aeedc52fef3d7b8e78238c2a0
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.core/1.1.0/reflext.core-1.1.0.jar MD5: cc65231f60a70dec43a57ccba5adce81 SHA1: 56316a714b99d7ac85d23d0f1a4680149c3273d6
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.spi/1.1.0/reflext.spi-1.1.0.jar MD5: 2c967ae0c3078d23b615f8825377f304 SHA1: 4df0428c39922079c53955602bce66735f9d20a8
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Description: The Reflext Framework Annotation Processing Tool Plugin
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.apt/1.1.0/reflext.apt-1.1.0.jar MD5: e6bb0195d6cdd15b618939c78999ea4e SHA1: 093ab21e03197c1c7a2d2d20da4d3dd34a60ac24
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
pom
groupid
reflext
Highest
Vendor
file
name
reflext.apt
High
Vendor
pom
artifactid
reflext.apt
Low
Vendor
pom
parent-artifactid
reflext.parent
Low
Vendor
pom
groupid
org.reflext
Highest
Vendor
pom
description
The Reflext Framework Annotation Processing Tool Plugin
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.apt/1.3.0/chromattic.apt-1.3.0.jar MD5: 5f51682435a2e2014a9bd9c5936a5cc5 SHA1: f2e219c2b8e13983a26b4c3f4e8eb54d71730b4d
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.common/1.3.0/chromattic.common-1.3.0.jar MD5: 15bfb4cc0312aefffb25952cdf18b2cd SHA1: 55470175c1ba46a917504acf97018e6ef2932659
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.ext/1.3.0/chromattic.ext-1.3.0.jar MD5: a8482bb9fe7572e77a58627251740ee1 SHA1: ea3bd25892c827d9b830aea768de69e200a93165
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.spi/1.3.0/chromattic.spi-1.3.0.jar MD5: e440e3f5a8e5ad38720975546ab7f06d SHA1: 64c36f826b832acab48fea793b7c70b019a46181
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/exoplatform/forum/forum-forum-service/5.3.x-SNAPSHOT/forum-forum-service-5.3.x-SNAPSHOT.jar MD5: 110bb927b29b216f1e66756af135735d SHA1: 338e5f8aec01ef3c17d6c792e05d3cd20bfea035
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Description:
The Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
File Path: /home/ciagent/.m2/repository/commons-io/commons-io/2.4/commons-io-2.4.jar MD5: 7f97854dc04c119d461fed14f5d8bb96 SHA1: b1b6ea3b7e4aa4f492509a4952029cd8e48019ad
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Evidence
Type
Source
Name
Value
Confidence
Vendor
central
groupid
commons-io
Highest
Vendor
file
name
commons-io
High
Vendor
Manifest
Implementation-Vendor-Id
org.apache
Medium
Vendor
pom
parent-groupid
org.apache.commons
Medium
Vendor
Manifest
bundle-docurl
http://commons.apache.org/io/
Low
Vendor
pom
name
Commons IO
High
Vendor
Manifest
specification-vendor
The Apache Software Foundation
Low
Vendor
pom
url
http://commons.apache.org/io/
Highest
Vendor
pom
artifactid
commons-io
Low
Vendor
Manifest
bundle-symbolicname
org.apache.commons.io
Medium
Vendor
manifest
Bundle-Description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
Low
Vendor
pom
parent-artifactid
commons-parent
Low
Vendor
pom
description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
Low
Vendor
Manifest
implementation-build
tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400
Low
Vendor
Manifest
Implementation-Vendor
The Apache Software Foundation
High
Vendor
pom
groupid
commons-io
Highest
Product
file
name
commons-io
High
Product
Manifest
specification-title
Commons IO
Medium
Product
Manifest
bundle-docurl
http://commons.apache.org/io/
Low
Product
pom
artifactid
commons-io
Highest
Product
pom
name
Commons IO
High
Product
pom
groupid
commons-io
Low
Product
central
artifactid
commons-io
Highest
Product
Manifest
Implementation-Title
Commons IO
High
Product
Manifest
bundle-symbolicname
org.apache.commons.io
Medium
Product
manifest
Bundle-Description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
Low
Product
pom
description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
File Path: /home/ciagent/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.18/jcl-over-slf4j-1.7.18.jar MD5: 86c8f80da62e4640564effb9dff7e003 SHA1: eca71be00af2579564e9f3a23ce0b245ca79ee5d
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Description: The Reflext Framework Java Lang Reflect Plugin
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.jlr/1.1.0/reflext.jlr-1.1.0.jar MD5: 1103f3b1ed3762e0bd100cbee6e7f345 SHA1: 79ad1a5053213cbb350d37ff12d5f767243c8c46
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.core/1.3.0/chromattic.core-1.3.0.jar MD5: 9ece56be0e1e1b3289bbe177e8e1b4ab SHA1: 1bc4ebc89d7b47af394b920f44a0b51409343034
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/javax/xml/bind/jaxb-api/2.1/jaxb-api-2.1.jar MD5: 9534ce6506dc96bac3944423d804be30 SHA1: d68570e722cffe2000358ce9c661a0b0bf1ebe11
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/com/sun/xml/bind/jaxb-impl/2.1.8/jaxb-impl-2.1.8.jar MD5: 1340264c75ea00b3d4d83e1ba57b606a SHA1: 41b915446cb6962f9b403d1a5da3817a95ee579e
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-core/1.4.6.Final/picketlink-idm-core-1.4.6.Final.jar MD5: a5c21c2186c186bc296d9909bcb11616 SHA1: 30d4385012393e4c50a82f8b84153eb6ee301a7d
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:compile
Severity:
Medium
CVSS Score: 6.0
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-284 Improper Access Control
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
Severity:
Medium
CVSS Score: 4.0
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
Severity:
Medium
CVSS Score: 6.0
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-17 Code
The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
File Path: /home/ciagent/.m2/repository/org/exoplatform/platform-ui/platform-ui-skin/5.3.x-SNAPSHOT/platform-ui-skin-5.3.x-SNAPSHOT.war MD5: a12d9704b41f096b6cd164783a1ed921 SHA1: c327e7d7fb60e776c6b54a0a1c2af00c89d44928
Referenced In Project/Scope:
eXo PLF:: Forum Forum application:provided
Description:
Closure Compiler is a JavaScript optimizing compiler. It parses your
JavaScript, analyzes it, removes dead code and rewrites and minimizes
what's left. It also checks syntax, variable references, and types, and
warns about common JavaScript pitfalls. It is used in many of Google's
JavaScript apps, including Gmail, Google Web Search, Google Maps, and
Google Docs.
Closure Compiler is a JavaScript optimizing compiler. It parses your JavaScript, analyzes it, removes dead code and rewrites and minimizes what's left. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. It is used in many of Google's JavaScript apps, including Gmail, Google Web Search, Google Maps, and Google Docs.
Low
Product
pom
parent-artifactid
closure-compiler-main
Medium
Product
pom
url
https://developers.google.com/closure/compiler/
Medium
Product
pom
parent-groupid
com.google.javascript
Low
Product
pom
name
Closure Compiler
High
Product
pom
groupid
google.javascript
Low
Product
pom
artifactid
closure-compiler
Highest
Product
pom
description
Closure Compiler is a JavaScript optimizing compiler. It parses your JavaScript, analyzes it, removes dead code and rewrites and minimizes what's left. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. It is used in many of Google's JavaScript apps, including Gmail, Google Web Search, Google Maps, and Google Docs.
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-310 Cryptographic Issues
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.