Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: google group | github issues

Project: eXo PLF:: Forum Forum

org.exoplatform.forum:forum-forum:5.3.x-SNAPSHOT

Scan Information (show all):

Display: Showing Vulnerable Dependencies (click to show all)

Dependency CPE Coordinates Highest Severity CVE Count CPE Confidence Evidence Count
commons-lang-2.6.jar org.netbeans.external:org-apache-commons-lang:RELEASE90 ✓   0 40
jcr-1.0.1.jar cpe:/a:content_project:content:1.0.1 javax.jcr:jcr:1.0.1 Medium 1 Low 25
jsr311-api-1.1.1.jar javax.ws.rs:jsr311-api:1.1.1 ✓   0 28
commons-webui-component-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-webui-component:5.3.x-SNAPSHOT   0 24
commons-api-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-api:5.3.x-SNAPSHOT   0 24
exo.ws.commons-5.3.x-SNAPSHOT.jar cpe:/a:ws_project:ws:5.3.20190908 org.exoplatform.ws:exo.ws.commons:5.3.x-SNAPSHOT   0 Low 24
bayeux-api-3.0.8.jar org.cometd.java:bayeux-api:3.0.8 ✓   0 29
cometd-java-common-3.0.8.jar org.cometd.java:cometd-java-common:3.0.8 ✓   0 29
cometd-java-websocket-javax-server-3.0.8.jar org.cometd.java:cometd-java-websocket-javax-server:3.0.8 ✓   0 29
cometd-java-websocket-common-server-3.0.8.jar org.cometd.java:cometd-java-websocket-common-server:3.0.8 ✓   0 29
cometd-java-annotations-3.0.8.jar org.cometd.java:cometd-java-annotations:3.0.8 ✓   0 29
jetty-io-9.2.14.v20151106.jar org.eclipse.jetty:jetty-io:9.2.14.v20151106 ✓   0 35
cometd-java-client-3.0.8.jar org.cometd.java:cometd-java-client:3.0.8 ✓   0 29
cometd-java-websocket-common-client-3.0.8.jar org.cometd.java:cometd-java-websocket-common-client:3.0.8 ✓   0 29
cometd-java-websocket-javax-client-3.0.8.jar org.cometd.java:cometd-java-websocket-javax-client:3.0.8 ✓   0 29
cometd-java-oort-3.0.8.jar org.cometd.java:cometd-java-oort:3.0.8 ✓   0 29
jetty-jmx-9.2.14.v20151106.jar cpe:/a:jetty:jetty:9.2.14.v20151106
cpe:/a:eclipse:jetty:9.2.14.v20151106 		org.eclipse.jetty:jetty-jmx:9.2.14.v20151106 ✓ High 4 Low 37
cometd-java-server-3.0.8.jar org.cometd.java:cometd-java-server:3.0.8 ✓   0 29
commons-comet-service-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-comet-service:5.3.x-SNAPSHOT   0 24
jsr250-api-1.0.jar javax.annotation:jsr250-api:1.0 ✓   0 20
portlet-api-2.0.jar javax.portlet:portlet-api:2.0 ✓   0 22
common-common-2.2.2.Final.jar org.gatein.common:common-common:2.2.2.Final ✓   0 31
hibernate-entitymanager-4.2.21.Final.jar org.hibernate:hibernate-entitymanager:4.2.21.Final ✓   0 32
liquibase-core-3.4.2.jar org.liquibase:liquibase-core:3.4.2 ✓   0 19
aopalliance-1.0.jar aopalliance:aopalliance:1.0 ✓   0 20
guice-3.0.jar com.google.inject:guice:3.0 ✓   0 29
joda-time-2.4.jar joda-time:joda-time:2.4 ✓   0 34
oauth-20100527.jar net.oauth.core:oauth:20100527 ✓   0 18
ehcache-core-2.6.9.jar net.sf.ehcache:ehcache-core:2.6.9 ✓   0 19
juel-impl-2.2.7.jar de.odysseus.juel:juel-impl:2.2.7 ✓   0 26
el-api-6.0.41.jar cpe:/a:apache_tomcat:apache_tomcat:6.0.41
cpe:/a:apache:tomcat:6.0.41
cpe:/a:apache_software_foundation:tomcat:6.0.41 		org.apache.tomcat:el-api:6.0.41 ✓ High 21 Highest 19
jasper-el-6.0.41.jar cpe:/a:apache_tomcat:apache_tomcat:6.0.41
cpe:/a:apache:tomcat:6.0.41
cpe:/a:apache_software_foundation:tomcat:6.0.41
cpe:/a:jasper_project:jasper:6.0.41 		org.apache.tomcat:jasper-el:6.0.41 ✓ High 21 Highest 21
xml-apis-1.4.01.jar xml-apis:xml-apis:1.4.01 ✓   0 49
shindig-common-2.5.2.jar cpe:/a:apache:shindig:2.5.2 org.apache.shindig:shindig-common:2.5.2 ✓   0 Low 26
exo.portal.gadgets-core-5.3.x-SNAPSHOT.jar cpe:/a:in-portal:in-portal:5.3 org.exoplatform.gatein.portal:exo.portal.gadgets-core:5.3.x-SNAPSHOT   0 Low 27
filters-2.0.235.jar cpe:/a:image_processing_software:image_processing_software:2.0.235
cpe:/a:processing:processing:2.0.235 		com.jhlabs:filters:2.0.235 ✓ Medium 2 Low 22
simplecaptcha-1.1.1.Final-gatein-4.jar org.gatein.captcha:simplecaptcha:1.1.1.Final-gatein-4   0 27
gatein-api-1.0.1.Final.jar org.gatein.api:gatein-api:1.0.1.Final ✓   0 29
aspectjrt-1.8.8.jar org.aspectj:aspectjrt:1.8.8 ✓   0 21
guava-20.0.jar cpe:/a:google:guava:20.0 com.google.guava:guava:20.0 ✓ Medium 1 Highest 29
commons-codec-1.10.jar commons-codec:commons-codec:1.10 ✓   0 38
owasp-java-html-sanitizer-20160413.1.jar cpe:/a:owasp-java-html-sanitizer_project:owasp-java-html-sanitizer:20160413.1 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20160413.1 ✓   0 Low 21
jrcs.diff-0.4.2.jar org.jvnet.hudson:org.suigeneris.jrcs.diff:0.4.2 ✓   0 17
ecs-1.4.2.jar ecs:ecs:1.4.2 ✓   0 14
jackson-core-2.9.8.jar cpe:/a:fasterxml:jackson:2.9.8 com.fasterxml.jackson.core:jackson-core:2.9.8 ✓   0 Low 41
jackson-databind-2.9.8.jar cpe:/a:fasterxml:jackson:2.9.8
cpe:/a:fasterxml:jackson-databind:2.9.8 		com.fasterxml.jackson.core:jackson-databind:2.9.8 ✓ High 5 Highest 41
snakeyaml-1.23.jar org.yaml:snakeyaml:1.23 ✓   0 25
swagger-annotations-1.5.22.jar io.swagger:swagger-annotations:1.5.22 ✓   0 24
swagger-models-1.5.22.jar io.swagger:swagger-models:1.5.22 ✓   0 24
validation-api-1.1.0.Final.jar javax.validation:validation-api:1.1.0.Final ✓   0 22
swagger-core-1.5.22.jar io.swagger:swagger-core:1.5.22 ✓   0 24
reflections-0.9.11.jar org.reflections:reflections:0.9.11 ✓   0 25
swagger-jaxrs-1.5.22.jar io.swagger:swagger-jaxrs:1.5.22 ✓   0 24
commons-component-common-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-component-common:5.3.x-SNAPSHOT   0 26
commons-component-product-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-component-product:5.3.x-SNAPSHOT   0 28
commons-component-upgrade-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-component-upgrade:5.3.x-SNAPSHOT   0 26
antlr-2.7.7.jar antlr:antlr:2.7.7 ✓   0 18
dom4j-1.6.1.jar cpe:/a:dom4j_project:dom4j:1.6.1 dom4j:dom4j:1.6.1 ✓ Medium 1 Highest 28
hibernate-jpa-2.0-api-1.0.1.Final.jar org.hibernate.javax.persistence:hibernate-jpa-2.0-api:1.0.1.Final ✓   0 26
jboss-logging-annotations-1.2.0.Beta1.jar org.jboss.logging:jboss-logging-annotations:1.2.0.Beta1 ✓   0 30
hibernate-commons-annotations-4.0.5.Final.jar org.hibernate.common:hibernate-commons-annotations:4.0.5.Final ✓   0 30
hibernate-core-4.2.21.Final.jar org.hibernate:hibernate-core:4.2.21.Final ✓   0 32
jakarta-regexp-1.4.jar jakarta-regexp:jakarta-regexp:1.4 ✓   0 14
xpp3-1.1.6.jar org.ogce:xpp3:1.1.6 ✓   0 24
exo.core.component.organization.api-5.3.x-SNAPSHOT.jar cpe:/a:api-platform:core:5.3 org.exoplatform.core:exo.core.component.organization.api:5.3.x-SNAPSHOT   0 Low 22
exo.core.component.security.core-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.security.core:5.3.x-SNAPSHOT   0 22
activation-1.1.1.jar javax.activation:activation:1.1.1 ✓   0 24
mail-1.4.7.jar cpe:/a:sun:javamail:1.4.7 javax.mail:mail:1.4.7 ✓   0 Low 38
forum-component-rendering-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-component-rendering:5.3.x-SNAPSHOT   0 25
exo.portal.webui.core-5.3.x-SNAPSHOT.jar cpe:/a:in-portal:in-portal:5.3.20190912 org.exoplatform.gatein.portal:exo.portal.webui.core:5.3.x-SNAPSHOT   0 Low 29
icu4j-56.1.jar cpe:/a:icu-project:international_components_for_unicode:56.1::~~~c%2fc%2b%2b~~ com.ibm.icu:icu4j:56.1 ✓ High 8 Highest 33
commons-file-storage-5.3.x-SNAPSHOT.jar org.exoplatform.commons:commons-file-storage:5.3.x-SNAPSHOT   0 24
pc-api-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-api:5.3.x-SNAPSHOT   0 27
json-simple-1.1.1.jar com.googlecode.json-simple:json-simple:1.1.1 ✓   0 23
caja-r5054.jar com.google.caja:caja:r5054   0 23
htmlparser-r4209.jar caja:htmlparser:r4209   0 24
oauth-consumer-20090617.jar net.oauth.core:oauth-consumer:20090617   0 17
oauth-httpclient4-20090913.jar net.oauth.core:oauth-httpclient4:20090913   0 20
oauth-provider-20100527.jar net.oauth.core:oauth-provider:20100527 ✓   0 18
guice-multibindings-3.0.jar com.google.inject.extensions:guice-multibindings:3.0 ✓   0 29
nekohtml-1.9.22.jar net.sourceforge.nekohtml:nekohtml:1.9.22 ✓   0 20
xercesImpl-2.9.1.jar cpe:/a:apache:xerces2_java:2.9.1 xerces:xercesImpl:2.9.1 ✓ High 1 Low 50
sanselan-0.97-incubator.jar org.apache.sanselan:sanselan:0.97-incubator ✓   0 35
httpcore-4.3.3.jar org.apache.httpcomponents:httpcore:4.3.3 ✓   0 32
httpclient-4.3.6.jar cpe:/a:apache:httpclient:4.3.6 org.apache.httpcomponents:httpclient:4.3.6 ✓   0 Low 32
social-component-core-5.3.x-SNAPSHOT.jar org.exoplatform.social:social-component-core:5.3.x-SNAPSHOT   0 28
social-component-common-5.3.x-SNAPSHOT.jar org.exoplatform.social:social-component-common:5.3.x-SNAPSHOT   0 26
closure-compiler-externs-v20170910.jar com.google.javascript:closure-compiler-externs:v20170910 ✓   0 19
args4j-2.33.jar args4j:args4j:2.33 ✓   0 24
error_prone_annotations-2.0.18.jar com.google.errorprone:error_prone_annotations:2.0.18 ✓   0 23
gson-2.7.jar com.google.code.gson:gson:2.7 ✓   0 34
jsinterop-annotations-1.0.0.jar com.google.jsinterop:jsinterop-annotations:1.0.0 ✓   0 19
closure-compiler-v20170910.jar com.google.javascript:closure-compiler:v20170910 ✓   0 13
twitter4j-core-3.0.5.jar cpe:/a:twitter_project:twitter:3.0.5
cpe:/a:twitter:twitter:3.0.5 		org.twitter4j:twitter4j-core:3.0.5 ✓   0 Low 22
scribe-1.3.5.jar cpe:/a:scribe:scribe:1.3.5 org.scribe:scribe:1.3.5 ✓   0 Low 23
google-http-client-1.14.1-beta.jar cpe:/a:google_forms_project:google_forms:1.14.1.beta com.google.http-client:google-http-client:1.14.1-beta ✓   0 Low 24
jsr305-1.3.9.jar com.google.code.findbugs:jsr305:1.3.9 ✓   0 21
google-api-client-1.14.1-beta.jar com.google.api-client:google-api-client:1.14.1-beta ✓   0 22
jackson-core-asl-1.9.11.jar cpe:/a:fasterxml:jackson:1.9.11 org.codehaus.jackson:jackson-core-asl:1.9.11 ✓   0 Low 32
google-http-client-jackson-1.14.1-beta.jar com.google.http-client:google-http-client-jackson:1.14.1-beta ✓   0 22
google-api-services-plus-v1-rev69-1.14.2-beta.jar com.google.apis:google-api-services-plus:v1-rev69-1.14.2-beta ✓   0 26
google-api-services-oauth2-v2-rev36-1.14.2-beta.jar com.google.apis:google-api-services-oauth2:v2-rev36-1.14.2-beta ✓   0 26
groovy-all-2.4.12.jar cpe:/a:apache:groovy:2.4.12 org.codehaus.groovy:groovy-all:2.4.12 ✓   0 Low 36
forum-application-common-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-application-common:5.3.x-SNAPSHOT   0 25
jboss-common-core-2.2.22.GA.jar org.jboss:jboss-common-core:2.2.22.GA ✓   0 30
forum-component-common-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-component-common:5.3.x-SNAPSHOT   0 25
log4j-1.2.17.jar cpe:/a:apache:log4j:2.0:alpha1 log4j:log4j:1.2.17 ✓ High 1 High 33
freemarker-2.3.18.jar org.freemarker:freemarker:2.3.18 ✓   0 25
wikbook.template.core-0.9.45.jar org.wikbook:wikbook.template.core:0.9.45 ✓   0 23
doc-style-5.3.x-SNAPSHOT.jar cpe:/a:style_it_project:style_it:5.3 org.exoplatform.doc:doc-style:5.3.x-SNAPSHOT   0 Low 24
commons-chain-1.2.jar commons-chain:commons-chain:1.2 ✓   0 34
commons-digester-2.1.jar commons-digester:commons-digester:2.1 ✓   0 34
exo.kernel.component.command-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.component.command:5.3.x-SNAPSHOT   0 22
fontbox-1.8.14.jar cpe:/a:apache:pdfbox:1.8.14 org.apache.pdfbox:fontbox:1.8.14 ✓ Medium 2 Highest 37
jempbox-1.8.14.jar cpe:/a:apache:pdfbox:1.8.14 org.apache.pdfbox:jempbox:1.8.14 ✓ Medium 2 Highest 35
pdfbox-1.8.14.jar cpe:/a:apache:pdfbox:1.8.14 org.apache.pdfbox:pdfbox:1.8.14 ✓ Medium 2 Highest 35
htmllexer-2.1.jar org.htmlparser:htmllexer:2.1 ✓   0 23
htmlparser-2.1.jar org.htmlparser:htmlparser:2.1 ✓   0 23
poi-3.13.jar cpe:/a:apache:poi:3.13 org.apache.poi:poi:3.13 ✓ High 2 Highest 28
tika-core-1.5.jar cpe:/a:apache:tika:1.5 org.apache.tika:tika-core:1.5 ✓ High 8 Highest 33
vorbis-java-core-0.1-tests.jar org.gagravarr:vorbis-java-core:0.1 ✓   0 23
vorbis-java-tika-0.1.jar cpe:/a:apache:tika:0.1 org.gagravarr:vorbis-java-tika:0.1 ✓ High 6 Highest 23
netcdf-4.2-min.jar edu.ucar:netcdf:4.2-min ✓   0 21
apache-mime4j-core-0.7.2.jar cpe:/a:apache:james:0.7.2 org.apache.james:apache-mime4j-core:0.7.2 ✓   0 Low 33
xz-1.2.jar cpe:/a:tukaani:xz:1.2 org.tukaani:xz:1.2 ✓ Medium 1 Low 27
commons-compress-1.5.jar cpe:/a:apache:commons_compress:1.5
cpe:/a:apache:commons-compress:1.5 		org.apache.commons:commons-compress:1.5 ✓   0 Low 39
bcmail-jdk15-1.45.jar cpe:/a:no-cms_project:no-cms:1.45 org.bouncycastle:bcmail-jdk15:1.45 ✓   0 Low 24
bcprov-jdk15-1.45.jar cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45
cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45 		org.bouncycastle:bcprov-jdk15:1.45 ✓ Medium 1 Low 24
tagsoup-1.2.1.jar org.ccil.cowan.tagsoup:tagsoup:1.2.1 ✓   0 18
asm-debug-all-4.1.jar org.ow2.asm:asm-debug-all:4.1 ✓   0 28
isoparser-1.0-RC-1.jar cpe:/a:boxes_project:boxes:7.x-1.0 com.googlecode.mp4parser:isoparser:1.0-RC-1 ✓ Low 1 Highest 24
xmpcore-5.1.2.jar com.adobe.xmp:xmpcore:5.1.2 ✓   0 30
metadata-extractor-2.6.2.jar com.drewnoakes:metadata-extractor:2.6.2 ✓   0 21
vorbis-java-core-0.1.jar org.gagravarr:vorbis-java-core:0.1 ✓   0 21
juniversalchardet-1.0.3.jar org.zenframework.z8.dependencies.commons:juniversalchardet-1.0.3:2.0 ✓   0 27
jhighlight-1.0.jar com.uwyn:jhighlight:1.0 ✓   0 25
xmlbeans-2.6.0.jar org.apache.xmlbeans:xmlbeans:2.6.0 ✓   0 24
exo.core.component.document-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.document:5.3.x-SNAPSHOT   0 22
exo.core.component.database-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.database:5.3.x-SNAPSHOT   0 22
lucene-core-3.6.2.jar org.apache.lucene:lucene-core:3.6.2 ✓   0 26
lucene-analyzers-3.6.2.jar org.apache.lucene:lucene-analyzers:3.6.2 ✓   0 26
lucene-spellchecker-3.6.2.jar org.apache.lucene:lucene-spellchecker:3.6.2 ✓   0 26
jta-1.1.jar javax.transaction:transaction-api:1.1 ✓   0 22
concurrent-1.3.4.jar concurrent:concurrent:1.3.4 ✓   0 23
commons-collections-3.2.2.jar cpe:/a:apache:commons_collections:3.2.2 commons-collections:commons-collections:3.2.2 ✓   0 Low 40
jgroups-3.6.13.Final.jar org.jgroups:jgroups:3.6.13.Final ✓   0 32
jbossjta-4.16.6.Final.jar org.jboss.jbossts:jbossjta:4.16.6.Final ✓   0 22
ws-commons-util-1.0.1.jar cpe:/a:ws_project:ws:1.0.1 ws-commons-util:ws-commons-util:1.0.1 ✓ Medium 1 Low 30
stringtemplate-3.2.1.jar org.antlr:stringtemplate:3.2.1 ✓   0 23
antlr-runtime-3.5.jar org.antlr:antlr-runtime:3.5 ✓   0 26
exo.kernel.component.ext.cache.impl.infinispan.v8-5.3.x-SNAPSHOT.jar cpe:/a:infinispan:infinispan:5.3.0 org.exoplatform.kernel:exo.kernel.component.ext.cache.impl.infinispan.v8:5.3.x-SNAPSHOT Medium 3 Highest 22
jboss-marshalling-osgi-2.0.0.Beta3.jar org.jboss.marshalling:jboss-marshalling-osgi:2.0.0.Beta3 ✓   0 29
infinispan-core-8.2.6.Final.jar cpe:/a:infinispan:infinispan:8.2.6 org.infinispan:infinispan-core:8.2.6.Final ✓ Medium 3 Highest 35
exo.jcr.component.core-5.3.x-SNAPSHOT.jar org.exoplatform.jcr:exo.jcr.component.core:5.3.x-SNAPSHOT   0 22
jtidy-r938.jar cpe:/a:html-tidy:tidy:- net.sf.jtidy:jtidy:r938 ✓   0 Low 25
exo.core.component.xml-processing-5.3.x-SNAPSHOT.jar cpe:/a:processing:processing:5.3 org.exoplatform.core:exo.core.component.xml-processing:5.3.x-SNAPSHOT   0 Low 22
exo.core.component.script.groovy-5.3.x-SNAPSHOT.jar org.exoplatform.core:exo.core.component.script.groovy:5.3.x-SNAPSHOT   0 22
exo.jcr.component.ext-5.3.x-SNAPSHOT.jar org.exoplatform.jcr:exo.jcr.component.ext:5.3.x-SNAPSHOT   0 22
mime-util-2.1.3.jar eu.medsea.mimeutil:mime-util:2.1.3 ✓   0 30
slf4j-api-1.7.18.jar org.slf4j:slf4j-api:1.7.18 ✓   0 31
exo.kernel.commons-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.commons:5.3.x-SNAPSHOT   0 22
exo.kernel.component.cache-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.component.cache:5.3.x-SNAPSHOT   0 22
commons-dbcp-1.4.jar commons-dbcp:commons-dbcp:1.4 ✓   0 34
commons-pool-1.6.jar commons-pool:commons-pool:1.6 ✓   0 36
exo.kernel.component.common-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.component.common:5.3.x-SNAPSHOT   0 22
commons-beanutils-1.8.3.jar cpe:/a:apache:commons_beanutils:1.8.3 commons-beanutils:commons-beanutils:1.8.3 ✓ High 2 Low 34
wci-wci-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.wci:wci-wci:5.3.x-SNAPSHOT   0 27
jibx-run-1.2.6.jar org.jibx:jibx-run:1.2.6 ✓   0 29
javax.inject-1.jar javax.inject:javax.inject:1 ✓   0 20
cdi-api-1.0-SP4.jar javax.enterprise:cdi-api:1.0-SP4 ✓   0 31
exo.kernel.container-5.3.x-SNAPSHOT.jar org.exoplatform.kernel:exo.kernel.container:5.3.x-SNAPSHOT   0 24
commons-fileupload-1.3.3.jar cpe:/a:apache:commons_fileupload:1.3.3 commons-fileupload:commons-fileupload:1.3.3 ✓   0 Low 40
exo.ws.rest.core-5.3.x-SNAPSHOT.jar cpe:/a:ws_project:ws:5.3 org.exoplatform.ws:exo.ws.rest.core:5.3.x-SNAPSHOT   0 Low 22
common-logging-2.2.2.Final.jar org.gatein.common:common-logging:2.2.2.Final ✓   0 31
pc-portlet-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-portlet:5.3.x-SNAPSHOT   0 27
pc-federation-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-federation:5.3.x-SNAPSHOT   0 27
pc-bridge-5.3.x-SNAPSHOT.jar org.exoplatform.gatein.pc:pc-bridge:5.3.x-SNAPSHOT   0 27
mop-api-1.3.2.Final.jar org.gatein.mop:mop-api:1.3.2.Final   0 30
mop-spi-1.3.2.Final.jar org.gatein.mop:mop-spi:1.3.2.Final   0 30
mop-core-1.3.2.Final.jar org.gatein.mop:mop-core:1.3.2.Final   0 30
gatein-management-api-2.1.0.Final.jar org.gatein.management:gatein-management-api:2.1.0.Final   0 28
gatein-management-spi-2.1.0.Final.jar org.gatein.management:gatein-management-spi:2.1.0.Final   0 28
commons-lang3-3.3.2.jar org.apache.commons:commons-lang3:3.3.2 ✓   0 37
json-20070829.jar org.json:json:20070829 ✓   0 23
staxnav.core-0.9.8.jar org.staxnav:staxnav.core:0.9.8 ✓   0 19
c3p0-0.9.1.1.jar cpe:/a:mchange:c3p0:0.9.1.1 c3p0:c3p0:0.9.1.1 ✓ Medium 1 Highest 23
quartz-2.2.2.jar org.quartz-scheduler:quartz:2.2.2 ✓   0 43
xpp3-1.1.4c.jar xpp3:xpp3:1.1.4c ✓   0 26
picocontainer-1.1.jar picocontainer:picocontainer:1.1 ✓   0 28
jdom-1.0.jar jdom:jdom:1.0 ✓   0 33
rome-1.0.jar rome:rome:1.0 ✓   0 32
javax.servlet-api-3.0.1.jar javax.servlet:javax.servlet-api:3.0.1 ✓   0 38
xmlpull-1.1.3.1.jar xmlpull:xmlpull:1.1.3.1 ✓   0 18
xstream-1.4.10.jar cpe:/a:xstream_project:xstream:1.4.10 com.thoughtworks.xstream:xstream:1.4.10 ✓ High 2 Highest 53
chromattic.api-1.3.0.jar org.chromattic:chromattic.api:1.3.0 ✓   0 23
xpp3_min-1.1.4c.jar xpp3:xpp3_min:1.1.4c ✓   0 24
javassist-3.20.0-GA.jar org.javassist:javassist:3.20.0-GA ✓   0 27
jdom-1.1.3.jar org.jdom:jdom:1.1.3 ✓   0 44
jdom2-2.0.5.jar org.jdom:jdom2:2.0.5 ✓   0 43
htmlcleaner-2.7.jar cpe:/a:htmlcleaner_project:htmlcleaner:2.7 net.sourceforge.htmlcleaner:htmlcleaner:2.7 ✓   0 Low 20
stax-utils-20070216.jar net.java.dev.stax-utils:stax-utils:20070216 ✓   0 20
xwiki-commons-xml-5.4.7.jar cpe:/a:xwiki:xwiki:5.4.7 org.xwiki.commons:xwiki-commons-xml:5.4.7 Low 1 Low 26
sac-1.3.jar org.w3c.css:sac:1.3 ✓   0 27
cssparser-0.9.18.jar net.sourceforge.cssparser:cssparser:0.9.18 ✓   0 27
jcommon-1.0.17.jar org.jfree:jcommon:1.0.17 ✓   0 23
jfreechart-1.0.14.jar org.jfree:jfreechart:1.0.14 ✓   0 25
velocity-1.7.jar org.apache.velocity:velocity:1.7 ✓   0 33
velocity-tools-1.4.jar cpe:/a:apache:struts:1.4 velocity-tools:velocity-tools:1.4 ✓   0 Low 19
ezmorph-1.0.6.jar net.sf.ezmorph:ezmorph:1.0.6 ✓   0 22
json-lib-2.4-jdk15.jar com.hynnet:json-lib:2.4 ✓   0 15
commons-configuration-1.10.jar commons-configuration:commons-configuration:1.10 ✓   0 36
wiki-renderer-5.3.x-SNAPSHOT.jar org.exoplatform.wiki:wiki-renderer:5.3.x-SNAPSHOT   0 24
forum-component-bbcode-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-component-bbcode:5.3.x-SNAPSHOT   0 25
javaparser-1.0.8.jar com.google.code.javaparser:javaparser:1.0.8   0 20
chromattic.testgenerator-1.3.0.jar org.chromattic:chromattic.testgenerator:1.3.0 ✓   0 23
chromattic.metamodel-1.3.0.jar org.chromattic:chromattic.metamodel:1.3.0 ✓   0 23
reflext.api-1.1.0.jar org.reflext:reflext.api:1.1.0 ✓   0 23
reflext.core-1.1.0.jar org.reflext:reflext.core:1.1.0 ✓   0 23
reflext.spi-1.1.0.jar org.reflext:reflext.spi:1.1.0 ✓   0 25
reflext.apt-1.1.0.jar cpe:/a:processing:processing:1.1.0 org.reflext:reflext.apt:1.1.0 ✓ Medium 1 Low 23
chromattic.apt-1.3.0.jar org.chromattic:chromattic.apt:1.3.0 ✓   0 23
chromattic.common-1.3.0.jar org.chromattic:chromattic.common:1.3.0 ✓   0 25
chromattic.ext-1.3.0.jar org.chromattic:chromattic.ext:1.3.0 ✓   0 25
chromattic.spi-1.3.0.jar org.chromattic:chromattic.spi:1.3.0 ✓   0 25
forum-forum-service-5.3.x-SNAPSHOT.jar org.exoplatform.forum:forum-forum-service:5.3.x-SNAPSHOT   0 24
commons-io-2.4.jar commons-io:commons-io:2.4 ✓   0 36
jcl-over-slf4j-1.7.18.jar org.slf4j:jcl-over-slf4j:1.7.18 ✓   0 31
reflext.jlr-1.1.0.jar org.reflext:reflext.jlr:1.1.0 ✓   0 23
chromattic.core-1.3.0.jar org.chromattic:chromattic.core:1.3.0 ✓   0 23
jaxb-api-2.1.jar javax.xml.bind:jaxb-api:2.1 ✓   0 15
jaxb-impl-2.1.8.jar com.sun.xml.bind:jaxb-impl:2.1.8 ✓   0 20
picketlink-idm-core-1.4.6.Final.jar cpe:/a:picketlink:picketlink:1.4.6 org.picketlink.idm:picketlink-idm-core:1.4.6.Final ✓ Medium 3 Low 37
platform-ui-skin-5.3.x-SNAPSHOT.war org.exoplatform.platform-ui:platform-ui-skin:5.3.x-SNAPSHOT   0 24
ehcache-core-2.6.9.jar: sizeof-agent.jar net.sf.ehcache:sizeof-agent:1.0.1   0 26
closure-compiler-v20170910.jar/META-INF/maven/com.google.javascript/closure-compiler/pom.xml cpe:/a:google:gmail:- com.google.javascript:closure-compiler:v20170910 Medium 1 Low 15
closure-compiler-v20170910.jar/META-INF/maven/com.google.protobuf/protobuf-java/pom.xml cpe:/a:google:protobuf:3.0.2 com.google.protobuf:protobuf-java:3.0.2 Medium 1 Highest 13
closure-compiler-v20170910.jar/META-INF/maven/com.google.code.findbugs/jsr305/pom.xml com.google.code.findbugs:jsr305:3.0.1   0 11
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling/pom.xml org.jboss.marshalling:jboss-marshalling:2.0.0.Beta3   0 13
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-river/pom.xml org.jboss.marshalling:jboss-marshalling-river:2.0.0.Beta3   0 13
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-serial/pom.xml org.jboss.marshalling:jboss-marshalling-serial:2.0.0.Beta3   0 13

Dependencies

commons-lang-2.6.jar

Description:  Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

jcr-1.0.1.jar

Description: Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.

License:

Day License: http://www.day.com/maven/jsr170/licenses/day-spec-license.htm
File Path: /home/ciagent/.m2/repository/javax/jcr/jcr/1.0.1/jcr-1.0.1.jar
MD5: 4639c7b994528948dab1a4feb1f68d6f
SHA1: 567ee103cf7592e3cf036e1bf4e2e06b9f08e1a1
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • cpe: cpe:/a:content_project:content:1.0.1   Confidence:Low   
  • maven: javax.jcr:jcr:1.0.1   Confidence:High

CVE-2017-16111  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.

Vulnerable Software & Versions:

jsr311-api-1.1.1.jar

License:

                CDDL License
            : http://www.opensource.org/licenses/cddl1.php
File Path: /home/ciagent/.m2/repository/javax/ws/rs/jsr311-api/1.1.1/jsr311-api-1.1.1.jar
MD5: c9803468299ec255c047a280ddec510f
SHA1: 59033da2a1afd56af1ac576750a8d0b1830d59e6
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

commons-webui-component-5.3.x-SNAPSHOT.jar

File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-webui-component/5.3.x-SNAPSHOT/commons-webui-component-5.3.x-SNAPSHOT.jar
MD5: d7dff473a4df1cdcf2622d1cf5c69fa3
SHA1: 2a713a4d4683b1b25b04308309f7fbd6c660bfa8
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • maven: org.exoplatform.commons:commons-webui-component:5.3.x-SNAPSHOT   Confidence:High

commons-api-5.3.x-SNAPSHOT.jar

File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-api/5.3.x-SNAPSHOT/commons-api-5.3.x-SNAPSHOT.jar
MD5: f35d4e7ecd153980b0486a8b1869580f
SHA1: 9a6902e0b714d3b4087624341715aa9112a65e48
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • maven: org.exoplatform.commons:commons-api:5.3.x-SNAPSHOT   Confidence:High

exo.ws.commons-5.3.x-SNAPSHOT.jar

Description: Implementation of Commons Utils for Exoplatform SAS 'Web Services' project.

File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.commons/5.3.x-SNAPSHOT/exo.ws.commons-5.3.x-SNAPSHOT.jar
MD5: 51c7e72b542e2520c7c8fbd6476f14ba
SHA1: 4faef5652372c417405daa1007960d55a2f66cb5
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • cpe: cpe:/a:ws_project:ws:5.3.20190908   Confidence:Low   
  • maven: org.exoplatform.ws:exo.ws.commons:5.3.x-SNAPSHOT   Confidence:High

bayeux-api-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/bayeux-api/3.0.8/bayeux-api-3.0.8.jar
MD5: a09842b7f274cefffa408299b5fc8dd0
SHA1: d5aceb0e7fef4a140f7e95be48338b97723d3163
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-common-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-common/3.0.8/cometd-java-common-3.0.8.jar
MD5: 70c7cc13ecc20634a6b357e33134d551
SHA1: 5e2134a1b3bc6e03b7e1666a74e9993d0bb52a7d
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-websocket-javax-server-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-javax-server/3.0.8/cometd-java-websocket-javax-server-3.0.8.jar
MD5: afa5e80138d48292a6f93b708257d2fc
SHA1: 353860f809886a58c181dd9e273ee7b79e133277
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-websocket-common-server-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-common-server/3.0.8/cometd-java-websocket-common-server-3.0.8.jar
MD5: 5772b2360cec4ff610e62151fb4deb62
SHA1: 61538a1231b700bf045fa197514f63509960985e
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-annotations-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-annotations/3.0.8/cometd-java-annotations-3.0.8.jar
MD5: 98b60697675562cf957655c3239a1ad3
SHA1: 5b56875b2ac024b5666633596abb90702ec35e81
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

jetty-io-9.2.14.v20151106.jar

Description: Administrative parent pom for Jetty modules

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-io/9.2.14.v20151106/jetty-io-9.2.14.v20151106.jar
MD5: 94d0e857144c7615b6fd65019cd32b59
SHA1: dfa4137371a3f08769820138ca1a2184dacda267
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-client-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-client/3.0.8/cometd-java-client-3.0.8.jar
MD5: 24f1367fb4d96fe70a3f07a1f48e447e
SHA1: 826d4ae9402e7c48cc98fe287389788134e4986f
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-websocket-common-client-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-common-client/3.0.8/cometd-java-websocket-common-client-3.0.8.jar
MD5: c17616c290c54ffc4a70dda2b901919a
SHA1: 8b75f11de5bba306d0bcb20a6c1bed89675579cd
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-websocket-javax-client-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-javax-client/3.0.8/cometd-java-websocket-javax-client-3.0.8.jar
MD5: 433dd449f689697bbe1a75b0ed2788f8
SHA1: b44bcf098667f0112301d75f73adb5ba3295699d
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

cometd-java-oort-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-oort/3.0.8/cometd-java-oort-3.0.8.jar
MD5: 62dbbecedab27927495fc9c9e0b70505
SHA1: a72695546e010c250ba65519fc91867b208fc8f9
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

jetty-jmx-9.2.14.v20151106.jar

Description: JMX management artifact for jetty.

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-jmx/9.2.14.v20151106/jetty-jmx-9.2.14.v20151106.jar
MD5: 5eccc25d22921cb4787812d0687a2978
SHA1: 617edc5e966b4149737811ef8b289cd94b831bab
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • cpe: cpe:/a:jetty:jetty:9.2.14.v20151106   Confidence:Low   
  • maven: org.eclipse.jetty:jetty-jmx:9.2.14.v20151106 ✓   Confidence:Highest
  • cpe: cpe:/a:eclipse:jetty:9.2.14.v20151106   Confidence:Low   

CVE-2017-7656  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-284 Improper Access Control

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

Vulnerable Software & Versions: (show all)

CVE-2017-7657  

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-190 Integer Overflow or Wraparound

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Vulnerable Software & Versions: (show all)

CVE-2017-7658  

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-19 Data Handling

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Vulnerable Software & Versions: (show all)

CVE-2017-9735  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Vulnerable Software & Versions:

cometd-java-server-3.0.8.jar

Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-server/3.0.8/cometd-java-server-3.0.8.jar
MD5: c55eb617762fad72683da9de856e008c
SHA1: 11d535c657bdb491abc2ccd820118f9d6a8f44e0
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

commons-comet-service-5.3.x-SNAPSHOT.jar

File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-comet-service/5.3.x-SNAPSHOT/commons-comet-service-5.3.x-SNAPSHOT.jar
MD5: e5c350fc6af71abc72d4a94839259b7b
SHA1: 6fdda0ddef28ff5cbb4d0dc9f1066a6a80bca8c1
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • maven: org.exoplatform.commons:commons-comet-service:5.3.x-SNAPSHOT   Confidence:High

jsr250-api-1.0.jar

Description: JSR-250 Reference Implementation by Glassfish

License:

COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html
File Path: /home/ciagent/.m2/repository/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar
MD5: 4cd56b2e4977e541186de69f5126b4a6
SHA1: 5025422767732a1ab45d93abfea846513d742dcf
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

portlet-api-2.0.jar

Description: The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group.

File Path: /home/ciagent/.m2/repository/javax/portlet/portlet-api/2.0/portlet-api-2.0.jar
MD5: 0ec08593cda1df33985391919996c740
SHA1: 1cd72f2a37fcf8ab9893a9468d7ba71c85fe2653
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

common-common-2.2.2.Final.jar

File Path: /home/ciagent/.m2/repository/org/gatein/common/common-common/2.2.2.Final/common-common-2.2.2.Final.jar
MD5: 8ce16b5e3991285cd27e553740d09d1f
SHA1: 44522d899e31a5a10dbd70f7b0ca2fe5a614f740
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

hibernate-entitymanager-4.2.21.Final.jar

Description: A module of the Hibernate O/RM project

License:

GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/hibernate/hibernate-entitymanager/4.2.21.Final/hibernate-entitymanager-4.2.21.Final.jar
MD5: 2c1a3f1c7bb83b730ab3db1fe588904e
SHA1: a6675070b4c7bb843d74d6ab3bc9440fd315dbb3
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

liquibase-core-3.4.2.jar

File Path: /home/ciagent/.m2/repository/org/liquibase/liquibase-core/3.4.2/liquibase-core-3.4.2.jar
MD5: d4ad6d5f7958b69b8fbd01a5564ae45b
SHA1: c91ccf342466857251cf6795b0cecc42509206f2
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

aopalliance-1.0.jar

Description: AOP Alliance

License:

Public Domain
File Path: /home/ciagent/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

guice-3.0.jar

Description: Guice is a lightweight dependency injection framework for Java 5 and above

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/google/inject/guice/3.0/guice-3.0.jar
MD5: ca1c7ba366884cfcd2cfb48d2395c400
SHA1: 9d84f15fe35e2c716a02979fb62f50a29f38aefa
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

joda-time-2.4.jar

Description: Date and time library to replace JDK date handling

License:

Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/joda-time/joda-time/2.4/joda-time-2.4.jar
MD5: 1231c3e09de6aa5d6b6d9982c0224e20
SHA1: 89e9725439adffbbd41c5f5c215c136082b34a7f
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

oauth-20100527.jar

File Path: /home/ciagent/.m2/repository/net/oauth/core/oauth/20100527/oauth-20100527.jar
MD5: 91c7c70579f95b7ddee95b2143a49b41
SHA1: a84c5331e225bc25a5a288db328048d6b1bb6fd5
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

ehcache-core-2.6.9.jar

Description: This is the ehcache core module. Pair it with other modules for added functionality.

License:

The Apache Software License, Version 2.0: src/assemble/EHCACHE-CORE-LICENSE.txt
File Path: /home/ciagent/.m2/repository/net/sf/ehcache/ehcache-core/2.6.9/ehcache-core-2.6.9.jar
MD5: 521348c6da7c20dba2058917a6a8c0a9
SHA1: e892585cc2cf95d46a2533df438a1d3323034ae8
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

juel-impl-2.2.7.jar

File Path: /home/ciagent/.m2/repository/de/odysseus/juel/juel-impl/2.2.7/juel-impl-2.2.7.jar
MD5: c5d7a62edafb5706b6beadbbcfd8f57d
SHA1: 97958467acef4c2b230b72354a4eefc66628dd99
Referenced In Projects/Scopes:

  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

el-api-6.0.41.jar

Description: Expression language package

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/tomcat/el-api/6.0.41/el-api-6.0.41.jar
MD5: 7073be2b44ca903e88ef0d36794cbfd8
SHA1: 9b2915f70905fcd366c7cde00cf25ccd2246e38b
Referenced In Projects/Scopes:
  • eXo PLF:: Forum Forum service:compile
  • eXo PLF:: Forum Forum application:compile

Identifiers

  • cpe: cpe:/a:apache_tomcat:apache_tomcat:6.0.41   Confidence:Low   
  • cpe: cpe:/a:apache:tomcat:6.0.41   Confidence:Highest   
  • maven: org.apache.tomcat:el-api:6.0.41 ✓   Confidence:Highest
  • cpe: cpe:/a:apache_software_foundation:tomcat:6.0.41   Confidence:Low   

CVE-2012-5568  

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-16 Configuration

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

Vulnerable Software & Versions: (show all)

CVE-2013-2185  

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.

Vulnerable Software & Versions: (show all)

CVE-2013-4444  

Severity: Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

Vulnerable Software & Versions: (show all)

CVE-2014-0227  

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-19 Data Handling

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

Vulnerable Software & Versions: (show all)

CVE-2014-0230  

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.