Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 3.1.2
Report Generated On : May 26, 2019 at 09:21:46 +00:00
Dependencies Scanned : 262 (218 unique)
Vulnerable Dependencies : 27
Vulnerabilities Found : 84
Vulnerabilities Suppressed : 0
...
NVD CVE 2002 : 16/05/2019 09:15:31
NVD CVE 2003 : 24/05/2019 08:15:38
NVD CVE 2004 : 16/05/2019 09:15:31
NVD CVE 2005 : 24/05/2019 08:15:38
NVD CVE 2006 : 23/05/2019 08:15:43
NVD CVE 2007 : 25/05/2019 08:15:38
NVD CVE 2008 : 25/05/2019 08:15:38
NVD CVE 2009 : 24/05/2019 08:15:38
NVD CVE 2010 : 24/05/2019 08:15:38
NVD CVE 2011 : 23/05/2019 08:15:44
NVD CVE 2012 : 25/05/2019 08:15:39
NVD CVE 2013 : 25/05/2019 08:15:39
NVD CVE 2014 : 25/05/2019 08:15:39
NVD CVE 2015 : 25/05/2019 07:45:46
NVD CVE 2016 : 25/05/2019 07:45:46
NVD CVE 2017 : 25/05/2019 07:45:47
NVD CVE 2018 : 25/05/2019 07:45:47
NVD CVE 2019 : 26/05/2019 07:15:28
NVD CVE Checked : 26/05/2019 08:05:29
NVD CVE Modified : 26/05/2019 05:15:29
VersionCheckOn : 1558857929499
Display:
Showing Vulnerable Dependencies (click to show all)
Dependencies
jtidy-r938.jar
Description:
JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be
used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the
document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML.
License:
Java HTML Tidy License: http://jtidy.svn.sourceforge.net/viewvc/jtidy/trunk/jtidy/LICENSE.txt?revision=95
File Path: /home/ciagent/.m2/repository/net/sf/jtidy/jtidy/r938/jtidy-r938.jar
MD5: 6a9121561b8f98c0a8fb9b6e57f50e6b
SHA1: ab08d87a225a715a69107732b67f21e1da930349
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid jtidy Low
Vendor pom name JTidy High
Vendor pom organization url http://sourceforge.net Medium
Vendor jar package name tidy Low
Vendor pom organization name sourceforge High
Vendor pom groupid net.sf.jtidy Highest
Vendor pom url http://jtidy.sourceforge.net Highest
Vendor jar package name w3c Low
Vendor pom description JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML. Low
Vendor file name jtidy-r938 High
Vendor central groupid net.sf.jtidy Highest
Product pom name JTidy High
Product pom organization name sourceforge Low
Product jar package name tidy Low
Product central artifactid jtidy Highest
Product pom organization url http://sourceforge.net Low
Product pom description JTidy is a Java port of HTML Tidy, a HTML syntax checker and pretty printer. Like its non-Java cousin, JTidy can be used as a tool for cleaning up malformed and faulty HTML. In addition, JTidy provides a DOM interface to the document that is being processed, which effectively makes you able to use JTidy as a DOM parser for real-world HTML. Low
Product pom url http://jtidy.sourceforge.net Medium
Product pom groupid net.sf.jtidy Low
Product file name jtidy-r938 High
Product pom artifactid jtidy Highest
Version central version r938 Highest
Version file name jtidy-r938 Medium
Version file version 938 Medium
Version pom version r938 Highest
exo.core.component.xml-processing-5.3.x-SNAPSHOT.jar
Description: Implementation of XML Processing Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.xml-processing/5.3.x-SNAPSHOT/exo.core.component.xml-processing-5.3.x-SNAPSHOT.jar
MD5: 72733f679e354536825490dcd09a699a
SHA1: 8abf87f511ed36fa29ee72cd75c7308f852c7b6f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom name eXo PLF Core :: Component :: XML Processing Service High
Vendor pom groupid org.exoplatform.core Highest
Vendor pom parent-artifactid core-parent Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium
Vendor pom artifactid exo.core.component.xml-processing Low
Vendor file name exo.core.component.xml-processing High
Vendor pom groupid exoplatform.core Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom description Implementation of XML Processing Service of Exoplatform SAS 'eXo Core' project. Medium
Vendor pom parent-groupid org.exoplatform.core Medium
Product pom parent-groupid org.exoplatform.core Low
Product pom name eXo PLF Core :: Component :: XML Processing Service High
Product pom groupid exoplatform.core Low
Product pom parent-artifactid core-parent Medium
Product file name exo.core.component.xml-processing High
Product Manifest Implementation-Title eXo PLF Core :: Component :: XML Processing Service High
Product pom artifactid exo.core.component.xml-processing Highest
Product Manifest specification-title exo-core Medium
Product pom description Implementation of XML Processing Service of Exoplatform SAS 'eXo Core' project. Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
cpe: cpe:/a:processing:processing:5.3
Confidence :Low
suppress
maven: org.exoplatform.core:exo.core.component.xml-processing:5.3.x-SNAPSHOT
Confidence :High
exo.core.component.script.groovy-5.3.x-SNAPSHOT.jar
Description: Groovy Scripts Instantiator of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.script.groovy/5.3.x-SNAPSHOT/exo.core.component.script.groovy-5.3.x-SNAPSHOT.jar
MD5: 7b83e6a1b4a6dad0afeeb2169f8bed89
SHA1: ee331e349386b130980f5564f3ba15a9cba7ebce
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom groupid org.exoplatform.core Highest
Vendor pom parent-artifactid core-parent Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium
Vendor pom description Groovy Scripts Instantiator of Exoplatform SAS 'eXo Core' project. Medium
Vendor file name exo.core.component.script.groovy High
Vendor pom groupid exoplatform.core Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom artifactid exo.core.component.script.groovy Low
Vendor pom name eXo PLF Core :: Component :: Groovy Scripts Instantiator High
Vendor pom parent-groupid org.exoplatform.core Medium
Product pom parent-groupid org.exoplatform.core Low
Product pom groupid exoplatform.core Low
Product pom parent-artifactid core-parent Medium
Product pom artifactid exo.core.component.script.groovy Highest
Product pom description Groovy Scripts Instantiator of Exoplatform SAS 'eXo Core' project. Medium
Product file name exo.core.component.script.groovy High
Product Manifest Implementation-Title eXo PLF Core :: Component :: Groovy Scripts Instantiator High
Product pom name eXo PLF Core :: Component :: Groovy Scripts Instantiator High
Product Manifest specification-title exo-core Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.script.groovy:5.3.x-SNAPSHOT
Confidence :High
exo.jcr.component.ext-5.3.x-SNAPSHOT.jar
Description: Implementation of Extension Service of Exoplatform SAS 'eXo JCR' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/jcr/exo.jcr.component.ext/5.3.x-SNAPSHOT/exo.jcr.component.ext-5.3.x-SNAPSHOT.jar
MD5: 80ba6722d208fa7b15b8c7d090d4c0cc
SHA1: ecd82797b6732d7e1c33328f5970ffd1d7caee03
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom description Implementation of Extension Service of Exoplatform SAS 'eXo JCR' project. Medium
Vendor pom parent-groupid org.exoplatform.jcr Medium
Vendor pom parent-artifactid jcr-parent Low
Vendor pom artifactid exo.jcr.component.ext Low
Vendor pom groupid org.exoplatform.jcr Highest
Vendor Manifest Implementation-Vendor-Id org.exoplatform.jcr Medium
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.jcr Highest
Vendor pom name eXo PLF:: JCR :: Component :: Extension Service High
Vendor file name exo.jcr.component.ext High
Product pom description Implementation of Extension Service of Exoplatform SAS 'eXo JCR' project. Medium
Product pom groupid exoplatform.jcr Low
Product Manifest Implementation-Title eXo PLF:: JCR :: Component :: Extension Service High
Product pom parent-groupid org.exoplatform.jcr Low
Product Manifest specification-title exo-jcr Medium
Product pom parent-artifactid jcr-parent Medium
Product pom name eXo PLF:: JCR :: Component :: Extension Service High
Product pom artifactid exo.jcr.component.ext Highest
Product file name exo.jcr.component.ext High
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.jcr:exo.jcr.component.ext:5.3.x-SNAPSHOT
Confidence :High
exo.portal.webui.core-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.webui.core/5.3.x-SNAPSHOT/exo.portal.webui.core-5.3.x-SNAPSHOT.jar
MD5: 4e253065194ba0054c6d12ec0b724bad
SHA1: 40016d9274ed13258c15197a39051966ad7c20f0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid exo.portal.webui Low
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom artifactid exo.portal.webui.core Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.portal Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor pom groupid exoplatform.gatein.portal Highest
Vendor Manifest implementation-url www.gatein.org/exo.portal.parent/exo.portal.webui/exo.portal.webui.core/ Low
Vendor pom parent-groupid org.exoplatform.gatein.portal Medium
Vendor Manifest os-name Linux Medium
Vendor Manifest build-timestamp Fri, 24 May 2019 09:23:29 +0000 Low
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor pom groupid org.exoplatform.gatein.portal Highest
Vendor file name exo.portal.webui.core High
Vendor pom name GateIn Portal WebUI Core High
Product pom artifactid exo.portal.webui.core Highest
Product Manifest specification-title GateIn Portal WebUI Core Medium
Product pom parent-artifactid exo.portal.webui Medium
Product Manifest Implementation-Title GateIn Portal WebUI Core High
Product Manifest build-timestamp Fri, 24 May 2019 09:23:29 +0000 Low
Product pom parent-groupid org.exoplatform.gatein.portal Low
Product file name exo.portal.webui.core High
Product pom groupid exoplatform.gatein.portal Low
Product Manifest implementation-url www.gatein.org/exo.portal.parent/exo.portal.webui/exo.portal.webui.core/ Low
Product Manifest os-name Linux Medium
Product pom name GateIn Portal WebUI Core High
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
Related Dependencies
exo.portal.component.web.api-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.api/5.3.x-SNAPSHOT/exo.portal.component.web.api-5.3.x-SNAPSHOT.jar
SHA1: f165f72a61ffe9be8cc5439d1e3aad5038cdeeda
MD5: df11e4023eef859c54f42f88ca54bf3c
exo.portal.component.web.security-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.security/5.3.x-SNAPSHOT/exo.portal.component.web.security-5.3.x-SNAPSHOT.jar
SHA1: e37beac9738288445a37d22bb35f7658625cac00
MD5: e5a36a0c806d6c1a5636f000d91d4a15
exo.portal.component.identity-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.identity/5.3.x-SNAPSHOT/exo.portal.component.identity-5.3.x-SNAPSHOT.jar
SHA1: 8fffa81e8cd85c152feb81dcbfc005d7ceb509c9
MD5: b61dcad072b18546986d710b3bf8279a
exo.portal.component.web.server-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.server/5.3.x-SNAPSHOT/exo.portal.component.web.server-5.3.x-SNAPSHOT.jar
SHA1: dc3e363540d3d8f8fec0eab9b678b9b72dd55204
MD5: 596429c3b83eee1fbb9a6900fb5bc767
exo.portal.component.web.controller-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.controller/5.3.x-SNAPSHOT/exo.portal.component.web.controller-5.3.x-SNAPSHOT.jar
SHA1: 3a4bd38a13733428585e9a0d912b575bb0171065
MD5: 6c1694454dfac1798e4a0c331488ef46
exo.portal.component.application-registry-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.application-registry/5.3.x-SNAPSHOT/exo.portal.component.application-registry-5.3.x-SNAPSHOT.jar
SHA1: 41f3a1ed6ceeced14843f9b2d93b7e140de841f2
MD5: 369c376f07f42f61c2dff876226fa8d9
exo.portal.component.pc-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.pc/5.3.x-SNAPSHOT/exo.portal.component.pc-5.3.x-SNAPSHOT.jar
SHA1: da8ee53758da5d87ef6fe43a9c7ad345b1f14b75
MD5: 86fce480119fc8f6c452ef9f986f3a8c
exo.portal.component.web.resources-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.resources/5.3.x-SNAPSHOT/exo.portal.component.web.resources-5.3.x-SNAPSHOT.jar
SHA1: 4c7c2c7c8a9ef857c5e6795726325b48221a7208
MD5: c26f1dd1af02de020041a91458e46a1b
exo.portal.gadgets-core-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.gadgets-core/5.3.x-SNAPSHOT/exo.portal.gadgets-core-5.3.x-SNAPSHOT.jar
SHA1: 2cbcc3ccdfe72fd9b1758b41de7debffaa4a19b7
MD5: 584daf75b24db418bda422c83db4f06f
exo.portal.component.portal-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.portal/5.3.x-SNAPSHOT/exo.portal.component.portal-5.3.x-SNAPSHOT.jar
SHA1: f951922ad0ef8aca6befdcbafcb827434ab29152
MD5: e25c9bf4891b78d4fdbce23182b4b802
exo.portal.component.api-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.api/5.3.x-SNAPSHOT/exo.portal.component.api-5.3.x-SNAPSHOT.jar
SHA1: 05b6efbd373dc6066badcca29d5fb105ff35ac37
MD5: 90ddb3572d45c3250425cf477c7e9dcc
exo.portal.component.web.oauth-common-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.web.oauth-common/5.3.x-SNAPSHOT/exo.portal.component.web.oauth-common-5.3.x-SNAPSHOT.jar
SHA1: 4936fafeba68d81bb3c90d38147bbaf19cc27057
MD5: f19372047bf2fcc6e53988f48acda2be
exo.portal.component.common-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.common/5.3.x-SNAPSHOT/exo.portal.component.common-5.3.x-SNAPSHOT.jar
SHA1: b1490240b45a4cd6c9dafd1a91e699c6fb2105f0
MD5: 2392ffd0fd1d546111f3534caad4c85d
exo.portal.webui.portal-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.webui.portal/5.3.x-SNAPSHOT/exo.portal.webui.portal-5.3.x-SNAPSHOT.jar
SHA1: 07aa539953ad436ea88f9dcf84b22bf69e9f3b65
MD5: c8e2e27703b38aa313c458b73c6868bf
exo.portal.component.scripting-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.scripting/5.3.x-SNAPSHOT/exo.portal.component.scripting-5.3.x-SNAPSHOT.jar
SHA1: 06f89c090ce9b36c00cc9087ea6769a45901e19b
MD5: 12d3305d4cb34b5807cce436589455b9
exo.portal.webui.portlet-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.webui.portlet/5.3.x-SNAPSHOT/exo.portal.webui.portlet-5.3.x-SNAPSHOT.jar
SHA1: 5018ace82feea85d91963b5da0960278bb572d86
MD5: a38f6ddb28f8547da691be9b522bec58
exo.portal.webui.eXo-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.webui.eXo/5.3.x-SNAPSHOT/exo.portal.webui.eXo-5.3.x-SNAPSHOT.jar
SHA1: b3bdd8a793cb283d9bbf16af2cb13f1675e413f8
MD5: afa037f8dc2dab13c67c2c1d589ea2a8
exo.portal.webui.framework-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.webui.framework/5.3.x-SNAPSHOT/exo.portal.webui.framework-5.3.x-SNAPSHOT.jar
SHA1: ef9436758e0044f245e0fa6b6b7c379ab286c52d
MD5: ac6505c0b91c838e9d5608a3a21349a3
exo.portal.component.resources-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/portal/exo.portal.component.resources/5.3.x-SNAPSHOT/exo.portal.component.resources-5.3.x-SNAPSHOT.jar
SHA1: c23cb03c0f52b2dd68bcd86b8113a185ed30bd6b
MD5: 123ae03a809ba15e1ba8149c634670ca
maven: org.exoplatform.gatein.portal:exo.portal.webui.core:5.3.x-SNAPSHOT
Confidence :High
cpe: cpe:/a:in-portal:in-portal:5.3
Confidence :Low
suppress
commons-webui-component-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-webui-component/5.3.x-SNAPSHOT/commons-webui-component-5.3.x-SNAPSHOT.jar
MD5: afe16b7e36ecbb581a371dafe5370c3b
SHA1: 3b0b4a1f913cd523987ed381a1d4883f59c3f899
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor Manifest implementation-url https://projects.exoplatform.org/commons/commons-webui-component Low
Vendor pom parent-groupid org.exoplatform.commons Medium
Vendor pom artifactid commons-webui-component Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.commons Medium
Vendor file name commons-webui-component High
Vendor Manifest date 2019-05-24T09:54:58Z Low
Vendor pom parent-artifactid commons Low
Vendor pom groupid org.exoplatform.commons Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.commons Highest
Vendor pom name eXo PLF:: Commons - Commons WebUI High
Product pom artifactid commons-webui-component Highest
Product pom parent-groupid org.exoplatform.commons Low
Product Manifest Implementation-Title eXo PLF:: Commons - Commons WebUI High
Product pom parent-artifactid commons Medium
Product Manifest implementation-url https://projects.exoplatform.org/commons/commons-webui-component Low
Product pom groupid exoplatform.commons Low
Product Manifest specification-title eXo PLF:: Commons - Commons WebUI Medium
Product file name commons-webui-component High
Product pom name eXo PLF:: Commons - Commons WebUI High
Product Manifest date 2019-05-24T09:54:58Z Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.commons:commons-webui-component:5.3.x-SNAPSHOT
Confidence :High
commons-chain-1.2.jar
Description:
An implementation of the GoF Chain of Responsibility pattern
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-chain/commons-chain/1.2/commons-chain-1.2.jar
MD5: e18e2c87826644e4c8c08635572c154f
SHA1: 744a13e8766e338bd347b6fbc28c6db12979d0c6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description
An implementation of the GoF Chain of Responsibility pattern
Medium
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest bundle-docurl http://commons.apache.org/chain/ Low
Vendor pom parent-artifactid commons-parent Low
Vendor pom name Commons Chain High
Vendor manifest Bundle-Description An implementation of the GoF Chain of Responsibility pattern Medium
Vendor file name commons-chain High
Vendor central groupid commons-chain Highest
Vendor pom groupid commons-chain Highest
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom url http://commons.apache.org/chain/ Highest
Vendor Manifest bundle-symbolicname org.apache.commons.chain Medium
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom artifactid commons-chain Low
Product pom description
An implementation of the GoF Chain of Responsibility pattern
Medium
Product pom parent-artifactid commons-parent Medium
Product Manifest bundle-docurl http://commons.apache.org/chain/ Low
Product pom groupid commons-chain Low
Product Manifest specification-title Commons Chain Medium
Product Manifest Bundle-Name Commons Chain Medium
Product pom name Commons Chain High
Product manifest Bundle-Description An implementation of the GoF Chain of Responsibility pattern Medium
Product file name commons-chain High
Product pom parent-groupid org.apache.commons Low
Product pom url http://commons.apache.org/chain/ Medium
Product Manifest Implementation-Title Commons Chain High
Product pom artifactid commons-chain Highest
Product Manifest bundle-symbolicname org.apache.commons.chain Medium
Product central artifactid commons-chain Highest
Version pom version 1.2 Highest
Version central version 1.2 Highest
Version file version 1.2 Highest
Version Manifest Implementation-Version 1.2 High
commons-digester-2.1.jar
Description:
The Digester package lets you configure an XML to Java object mapping module
which triggers certain actions called rules whenever a particular
pattern of nested XML elements is recognized.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-digester/commons-digester/2.1/commons-digester-2.1.jar
MD5: 528445033f22da28f5047b6abcd1c7c9
SHA1: 73a8001e7a54a255eef0f03521ec1805dc738ca0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid commons-digester Highest
Vendor pom artifactid commons-digester Low
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom parent-artifactid commons-parent Low
Vendor file name commons-digester High
Vendor central groupid commons-digester Highest
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor Manifest bundle-symbolicname org.apache.commons.digester Medium
Vendor pom description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom name Commons Digester High
Vendor Manifest bundle-docurl http://commons.apache.org/digester/ Low
Vendor pom url http://commons.apache.org/digester/ Highest
Vendor manifest Bundle-Description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low
Product pom parent-artifactid commons-parent Medium
Product pom groupid commons-digester Low
Product pom artifactid commons-digester Highest
Product file name commons-digester High
Product pom parent-groupid org.apache.commons Low
Product Manifest bundle-symbolicname org.apache.commons.digester Medium
Product Manifest Bundle-Name Commons Digester Medium
Product pom description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low
Product central artifactid commons-digester Highest
Product pom name Commons Digester High
Product Manifest specification-title Commons Digester Medium
Product Manifest bundle-docurl http://commons.apache.org/digester/ Low
Product Manifest Implementation-Title Commons Digester High
Product manifest Bundle-Description The Digester package lets you configure an XML to Java object mapping module which triggers certain actions called rules whenever a particular pattern of nested XML elements is recognized. Low
Product pom url http://commons.apache.org/digester/ Medium
Version pom version 2.1 Highest
Version central version 2.1 Highest
Version file version 2.1 Highest
Version Manifest Implementation-Version 2.1 High
exo.kernel.component.command-5.3.x-SNAPSHOT.jar
Description: Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.command/5.3.x-SNAPSHOT/exo.kernel.component.command-5.3.x-SNAPSHOT.jar
MD5: c8e34b4521db08641687547b1fbc1ce5
SHA1: 1527c8dccb38e62fb298b68bda8263e9005bc6c1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium
Vendor pom parent-groupid org.exoplatform.kernel Medium
Vendor pom description Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project. Medium
Vendor pom groupid org.exoplatform.kernel Highest
Vendor file name exo.kernel.component.command High
Vendor pom groupid exoplatform.kernel Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-artifactid kernel-parent Low
Vendor pom name eXo PLF:: Kernel :: Component :: Command Service High
Vendor pom artifactid exo.kernel.component.command Low
Product Manifest specification-title exo-kernel Medium
Product pom description Implementation of Command Service of Exoplatform SAS 'eXo Kernel' project. Medium
Product pom artifactid exo.kernel.component.command Highest
Product file name exo.kernel.component.command High
Product pom parent-artifactid kernel-parent Medium
Product Manifest Implementation-Title eXo PLF:: Kernel :: Component :: Command Service High
Product pom parent-groupid org.exoplatform.kernel Low
Product pom groupid exoplatform.kernel Low
Product pom name eXo PLF:: Kernel :: Component :: Command Service High
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.component.command:5.3.x-SNAPSHOT
Confidence :High
fontbox-1.8.14.jar
Description:
The Apache FontBox library is an open source Java tool to obtain low level information
from font files. FontBox is a subproject of Apache PDFBox.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/fontbox/1.8.14/fontbox-1.8.14.jar
MD5: 901640f7e2bd12508ae4a7cccba3df79
SHA1: 9c7caec614a6a132bedc83f1d6d247bb96ca0df3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-symbolicname org.apache.pdfbox.fontbox Medium
Vendor central groupid org.apache.pdfbox Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest Implementation-Vendor-Id org.apache.pdfbox Medium
Vendor pom groupid apache.pdfbox Highest
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Vendor pom groupid org.apache.pdfbox Highest
Vendor Manifest bundle-docurl http://pdfbox.apache.org Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom url http://pdfbox.apache.org/ Highest
Vendor file name fontbox High
Vendor pom parent-groupid org.apache.pdfbox Medium
Vendor pom name Apache FontBox High
Vendor manifest Bundle-Description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low
Vendor pom parent-artifactid pdfbox-parent Low
Vendor pom description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low
Vendor pom artifactid fontbox Low
Product Manifest bundle-symbolicname org.apache.pdfbox.fontbox Medium
Product Manifest specification-title Apache FontBox Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Product Manifest bundle-docurl http://pdfbox.apache.org Low
Product pom url http://pdfbox.apache.org/ Medium
Product pom parent-artifactid pdfbox-parent Medium
Product file name fontbox High
Product pom groupid apache.pdfbox Low
Product pom name Apache FontBox High
Product manifest Bundle-Description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low
Product pom artifactid fontbox Highest
Product pom description The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox. Low
Product central artifactid fontbox Highest
Product pom parent-groupid org.apache.pdfbox Low
Product Manifest Bundle-Name Apache FontBox Medium
Product Manifest Implementation-Title Apache FontBox High
Version pom version 1.8.14 Highest
Version Manifest Implementation-Version 1.8.14 High
Version file version 1.8.14 Highest
Version central version 1.8.14 Highest
Published Vulnerabilities
CVE-2018-11797 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerable Software & Versions: (show all )
CVE-2018-8036 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Vulnerable Software & Versions: (show all )
jempbox-1.8.14.jar
Description:
The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM)
specification. JempBox is a subproject of Apache PDFBox.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/jempbox/1.8.14/jempbox-1.8.14.jar
MD5: 393135759731daf4e301903b3de2fbbb
SHA1: 7f94c7cd4efc21e78729436cc4cf0c09eeea0f38
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.apache.pdfbox Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest Implementation-Vendor-Id org.apache.pdfbox Medium
Vendor pom groupid apache.pdfbox Highest
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Vendor pom groupid org.apache.pdfbox Highest
Vendor Manifest bundle-docurl http://pdfbox.apache.org Low
Vendor Manifest bundle-symbolicname org.apache.pdfbox.jempbox Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom parent-groupid org.apache.pdfbox Medium
Vendor manifest Bundle-Description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low
Vendor pom artifactid jempbox Low
Vendor pom parent-artifactid pdfbox-parent Low
Vendor pom name Apache JempBox High
Vendor file name jempbox High
Vendor pom description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low
Product central artifactid jempbox Highest
Product Manifest specification-title Apache JempBox Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Product Manifest bundle-docurl http://pdfbox.apache.org Low
Product pom parent-artifactid pdfbox-parent Medium
Product Manifest bundle-symbolicname org.apache.pdfbox.jempbox Medium
Product Manifest Implementation-Title Apache JempBox High
Product pom groupid apache.pdfbox Low
Product manifest Bundle-Description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low
Product Manifest Bundle-Name Apache JempBox Medium
Product pom name Apache JempBox High
Product pom artifactid jempbox Highest
Product file name jempbox High
Product pom parent-groupid org.apache.pdfbox Low
Product pom description The Apache JempBox library is an open source Java tool that implements Adobe's XMP(TM) specification. JempBox is a subproject of Apache PDFBox. Low
Version pom version 1.8.14 Highest
Version Manifest Implementation-Version 1.8.14 High
Version file version 1.8.14 Highest
Version central version 1.8.14 Highest
Published Vulnerabilities
CVE-2018-11797 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerable Software & Versions: (show all )
CVE-2018-8036 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Vulnerable Software & Versions: (show all )
pdfbox-1.8.14.jar
Description:
The Apache PDFBox library is an open source Java tool for working with PDF documents.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/pdfbox/pdfbox/1.8.14/pdfbox-1.8.14.jar
MD5: c90740e185fc2f8013d1119f509ea4f3
SHA1: 7550298240c8540b721733ede6dc88fcf4fa2b0f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.apache.pdfbox Highest
Vendor Manifest bundle-symbolicname org.apache.pdfbox Medium
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest Implementation-Vendor-Id org.apache.pdfbox Medium
Vendor pom description
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Medium
Vendor file name pdfbox High
Vendor pom groupid apache.pdfbox Highest
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Vendor pom groupid org.apache.pdfbox Highest
Vendor Manifest bundle-docurl http://pdfbox.apache.org Low
Vendor pom name Apache PDFBox High
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom parent-groupid org.apache.pdfbox Medium
Vendor manifest Bundle-Description The Apache PDFBox library is an open source Java tool for working with PDF documents. Medium
Vendor pom parent-artifactid pdfbox-parent Low
Vendor pom artifactid pdfbox Low
Product Manifest Bundle-Name Apache PDFBox Medium
Product Manifest bundle-symbolicname org.apache.pdfbox Medium
Product central artifactid pdfbox Highest
Product pom artifactid pdfbox Highest
Product Manifest Implementation-Title Apache PDFBox High
Product pom description
The Apache PDFBox library is an open source Java tool for working with PDF documents.
Medium
Product file name pdfbox High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Product Manifest bundle-docurl http://pdfbox.apache.org Low
Product pom parent-artifactid pdfbox-parent Medium
Product pom name Apache PDFBox High
Product pom groupid apache.pdfbox Low
Product Manifest specification-title Apache PDFBox Medium
Product manifest Bundle-Description The Apache PDFBox library is an open source Java tool for working with PDF documents. Medium
Product pom parent-groupid org.apache.pdfbox Low
Version pom version 1.8.14 Highest
Version Manifest Implementation-Version 1.8.14 High
Version file version 1.8.14 Highest
Version central version 1.8.14 Highest
Published Vulnerabilities
CVE-2018-11797 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerable Software & Versions: (show all )
CVE-2018-8036 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Vulnerable Software & Versions: (show all )
htmllexer-2.1.jar
Description: HTML Lexer is the low level lexical analyzer.
File Path: /home/ciagent/.m2/repository/org/htmlparser/htmllexer/2.1/htmllexer-2.1.jar
MD5: 1cb7184766a0c52f4d98d671bb08be19
SHA1: 2ebf2c073e649b7e674cddd0558ff102a486402f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description HTML Lexer is the low level lexical analyzer. Medium
Vendor pom parent-artifactid HTMLParserProject Low
Vendor pom groupid htmlparser Highest
Vendor pom parent-groupid org.htmlparser Medium
Vendor file name htmllexer High
Vendor central groupid org.htmlparser Highest
Vendor pom url http://htmlparser.org Highest
Vendor jar package name htmlparser Low
Vendor pom groupid org.htmlparser Highest
Vendor pom artifactid htmllexer Low
Vendor pom name HTML Lexer Jar High
Product pom description HTML Lexer is the low level lexical analyzer. Medium
Product pom artifactid htmllexer Highest
Product file name htmllexer High
Product pom groupid htmlparser Low
Product pom parent-artifactid HTMLParserProject Medium
Product pom url http://htmlparser.org Medium
Product central artifactid htmllexer Highest
Product pom parent-groupid org.htmlparser Low
Product pom name HTML Lexer Jar High
Version pom version 2.1 Highest
Version central version 2.1 Highest
Version file version 2.1 Highest
htmlparser-2.1.jar
Description: HTML Parser is the high level syntactical analyzer.
File Path: /home/ciagent/.m2/repository/org/htmlparser/htmlparser/2.1/htmlparser-2.1.jar
MD5: aa05b921026c228f92ef8b4a13c26f8d
SHA1: c752e5984b7767533cbd3fdffa48cecb52fa226c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid HTMLParserProject Low
Vendor pom groupid htmlparser Highest
Vendor pom parent-groupid org.htmlparser Medium
Vendor pom artifactid htmlparser Low
Vendor central groupid org.htmlparser Highest
Vendor pom url http://htmlparser.org Highest
Vendor jar package name htmlparser Low
Vendor file name htmlparser High
Vendor pom groupid org.htmlparser Highest
Vendor pom description HTML Parser is the high level syntactical analyzer. Medium
Vendor pom name HTML Parser Jar High
Product pom artifactid htmlparser Highest
Product central artifactid htmlparser Highest
Product pom groupid htmlparser Low
Product pom parent-artifactid HTMLParserProject Medium
Product pom url http://htmlparser.org Medium
Product file name htmlparser High
Product pom description HTML Parser is the high level syntactical analyzer. Medium
Product pom parent-groupid org.htmlparser Low
Product pom name HTML Parser Jar High
Version pom version 2.1 Highest
Version central version 2.1 Highest
Version file version 2.1 Highest
poi-3.13.jar
Description: Apache POI - Java API To Access Microsoft Format Files
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi/3.13/poi-3.13.jar
MD5: 1b43f32e2211546040597a9e2d07b869
SHA1: 0f59f504ba8c521e61e25f417ec652fd485010f3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid org.apache.poi Highest
Vendor file name poi High
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom groupid apache.poi Highest
Vendor pom name Apache POI High
Vendor pom organization name Apache Software Foundation High
Vendor pom organization url http://www.apache.org/ Medium
Vendor Manifest Implementation-Vendor-Id org.apache.poi Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom artifactid poi Low
Vendor central groupid org.apache.poi Highest
Vendor pom description Apache POI - Java API To Access Microsoft Format Files Medium
Vendor pom url http://poi.apache.org/ Highest
Product Manifest specification-title Apache POI Medium
Product pom artifactid poi Highest
Product file name poi High
Product central artifactid poi Highest
Product pom name Apache POI High
Product pom description Apache POI - Java API To Access Microsoft Format Files Medium
Product pom organization name Apache Software Foundation Low
Product pom organization url http://www.apache.org/ Low
Product pom groupid apache.poi Low
Product pom url http://poi.apache.org/ Medium
Product Manifest Implementation-Title Apache POI High
Version Manifest Implementation-Version 3.13 High
Version pom version 3.13 Highest
Version central version 3.13 Highest
Version file version 3.13 Highest
Related Dependencies
poi-scratchpad-3.13.jar
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi-scratchpad/3.13/poi-scratchpad-3.13.jar
SHA1: 09d763275e6c7fa05d47e2581606748669e88c55
MD5: d8dbe05b289da779874e4783881e1b57
cpe: cpe:/a:apache:poi:3.13
maven: org.apache.poi:poi-scratchpad:3.13 ✓
poi-ooxml-3.13.jar
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi-ooxml/3.13/poi-ooxml-3.13.jar
SHA1: c364a8f5422d613e3a56db3b4b889f2989d7ee73
MD5: 38bb36c35a16030d4bc0ac14421430d7
cpe: cpe:/a:apache:poi:3.13
maven: org.apache.poi:poi-ooxml:3.13 ✓
poi-ooxml-schemas-3.13.jar
File Path: /home/ciagent/.m2/repository/org/apache/poi/poi-ooxml-schemas/3.13/poi-ooxml-schemas-3.13.jar
SHA1: 56fb0b9f3ffc3d7f7fc9b59e17b5fa2c3ab921e7
MD5: ca12e13961e9df83ddd5471733d73d91
cpe: cpe:/a:apache:poi:3.13
maven: org.apache.poi:poi-ooxml-schemas:3.13 ✓
Published Vulnerabilities
CVE-2016-5000 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerable Software & Versions:
CVE-2017-5644 suppress
Severity:
High
CVSS Score: 7.1
(AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Vulnerable Software & Versions:
tika-core-1.5.jar
Description: This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/tika/tika-core/1.5/tika-core-1.5.jar
MD5: e864bf637f51283dc525087b015d7b1a
SHA1: 194ca0fb3d73b07737524806fbc3bec89063c03a
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest Bundle-Description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low
Vendor pom url http://tika.apache.org/ Highest
Vendor pom artifactid tika-core Low
Vendor pom groupid apache.tika Highest
Vendor Manifest bundle-symbolicname org.apache.tika.core Medium
Vendor pom parent-groupid org.apache.tika Medium
Vendor pom organization name The Apache Software Foundation High
Vendor file name tika-core High
Vendor Manifest bundle-docurl http://tika.apache.org/ Low
Vendor pom groupid org.apache.tika Highest
Vendor pom parent-artifactid tika-parent Low
Vendor pom description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low
Vendor pom organization url http://www.apache.org Medium
Vendor central groupid org.apache.tika Highest
Vendor pom name Apache Tika core High
Product manifest Bundle-Description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low
Product pom organization url http://www.apache.org Low
Product Manifest Bundle-Name Apache Tika core Medium
Product Manifest bundle-symbolicname org.apache.tika.core Medium
Product pom artifactid tika-core Highest
Product file name tika-core High
Product Manifest bundle-docurl http://tika.apache.org/ Low
Product pom parent-groupid org.apache.tika Low
Product central artifactid tika-core Highest
Product pom groupid apache.tika Low
Product pom description This is the core Apache Tika™ toolkit library from which all other modules inherit functionality. It also includes the core facades for the Tika API. Low
Product pom url http://tika.apache.org/ Medium
Product pom organization name The Apache Software Foundation Low
Product pom name Apache Tika core High
Product pom parent-artifactid tika-parent Medium
Version central version 1.5 Highest
Version pom version 1.5 Highest
Version file version 1.5 Highest
Related Dependencies
tika-parsers-1.5.jar
File Path: /home/ciagent/.m2/repository/org/apache/tika/tika-parsers/1.5/tika-parsers-1.5.jar
SHA1: 9b895231b7a0dae7349dfb42cb1b926c345b5281
MD5: f1056da5d1021ad1bbac7dab01b335d1
cpe: cpe:/a:apache:tika:1.5
maven: org.apache.tika:tika-parsers:1.5 ✓
Published Vulnerabilities
CVE-2016-6809 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Vulnerable Software & Versions:
CVE-2018-11761 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Vulnerable Software & Versions: (show all )
CVE-2018-11762 suppress
Severity:
Medium
CVSS Score: 5.8
(AV:N/AC:M/Au:N/C:N/I:P/A:P)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Vulnerable Software & Versions: (show all )
CVE-2018-11796 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Vulnerable Software & Versions: (show all )
CVE-2018-1335 suppress
Severity:
High
CVSS Score: 9.3
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1338 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1339 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-8017 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Vulnerable Software & Versions: (show all )
vorbis-java-core-0.1-tests.jar
File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-core/0.1/vorbis-java-core-0.1-tests.jar
MD5: d58f076c08a917277d03f3417aa867a6
SHA1: c849979e199d8a7c3da1a00799c623c00f94efac
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name vorbis-java-core High
Vendor pom parent-groupid org.gagravarr Medium
Vendor pom parent-artifactid vorbis-java-parent Low
Vendor pom groupid org.gagravarr Highest
Vendor pom groupid gagravarr Highest
Vendor pom url Gagravarr/VorbisJava Highest
Vendor jar package name gagravarr Low
Vendor jar package name ogg Low
Vendor pom name Ogg and Vorbis for Java, Core High
Vendor pom artifactid vorbis-java-core Low
Vendor central groupid org.gagravarr Highest
Product file name vorbis-java-core High
Product pom parent-groupid org.gagravarr Low
Product pom groupid gagravarr Low
Product pom url Gagravarr/VorbisJava High
Product pom artifactid vorbis-java-core Highest
Product jar package name ogg Low
Product central artifactid vorbis-java-core Highest
Product pom name Ogg and Vorbis for Java, Core High
Product pom parent-artifactid vorbis-java-parent Medium
Version file version 0.1 Highest
Version central version 0.1 Highest
Version pom version 0.1 Highest
vorbis-java-tika-0.1.jar
File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-tika/0.1/vorbis-java-tika-0.1.jar
MD5: 1fccc6796a0924ba4f32eb1d44b8616b
SHA1: 6966c8663a7f689021accb13cceaa6101f53ea3d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid vorbis-java-tika Low
Vendor pom parent-groupid org.gagravarr Medium
Vendor pom parent-artifactid vorbis-java-parent Low
Vendor jar package name tika Low
Vendor pom name Apache Tika plugin for Ogg, Vorbis and FLAC High
Vendor pom groupid org.gagravarr Highest
Vendor pom groupid gagravarr Highest
Vendor pom url Gagravarr/VorbisJava Highest
Vendor jar package name gagravarr Low
Vendor file name vorbis-java-tika High
Vendor central groupid org.gagravarr Highest
Product pom parent-groupid org.gagravarr Low
Product pom groupid gagravarr Low
Product pom url Gagravarr/VorbisJava High
Product jar package name tika Low
Product central artifactid vorbis-java-tika Highest
Product pom name Apache Tika plugin for Ogg, Vorbis and FLAC High
Product pom parent-artifactid vorbis-java-parent Medium
Product pom artifactid vorbis-java-tika Highest
Product file name vorbis-java-tika High
Version file version 0.1 Highest
Version central version 0.1 Highest
Version pom version 0.1 Highest
Published Vulnerabilities
CVE-2016-6809 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Vulnerable Software & Versions:
CVE-2018-11761 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Vulnerable Software & Versions: (show all )
CVE-2018-11796 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Vulnerable Software & Versions: (show all )
CVE-2018-1335 suppress
Severity:
High
CVSS Score: 9.3
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1338 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
CVE-2018-1339 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Vulnerable Software & Versions: (show all )
netcdf-4.2-min.jar
Description: The NetCDF-Java Library is a Java interface to NetCDF files,
as well as to many other types of scientific data formats.
License:
(MIT-style) netCDF C library license.: http://www.unidata.ucar.edu/software/netcdf/copyright.html
File Path: /home/ciagent/.m2/repository/edu/ucar/netcdf/4.2-min/netcdf-4.2-min.jar
MD5: eb00b40b0511f0fc1dfcfc9cb89e3c53
SHA1: 0f3c3f3db4c54483aa1fbc4497e300879ce24da1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid edu.ucar Highest
Vendor file name netcdf High
Vendor pom name The NetCDF-Java Library High
Vendor Manifest Implementation-Vendor UCAR/Unidata High
Vendor pom description The NetCDF-Java Library is a Java interface to NetCDF files, as well as to many other types of scientific data formats. Low
Vendor pom groupid edu.ucar Highest
Vendor pom artifactid netcdf Low
Vendor Manifest built-on 2010-11-24 05:51:29 Low
Vendor pom url http://www.unidata.ucar.edu/software/netcdf-java/ Highest
Product pom groupid edu.ucar Low
Product file name netcdf High
Product pom name The NetCDF-Java Library High
Product Manifest Implementation-Title NetCDF-Java-Library High
Product pom artifactid netcdf Highest
Product pom description The NetCDF-Java Library is a Java interface to NetCDF files, as well as to many other types of scientific data formats. Low
Product pom url http://www.unidata.ucar.edu/software/netcdf-java/ Medium
Product central artifactid netcdf Highest
Product Manifest built-on 2010-11-24 05:51:29 Low
Version central version 4.2-min Highest
Version file version 4.2 Highest
Version pom version 4.2-min Highest
apache-mime4j-core-0.7.2.jar
Description: Java stream based MIME message parser
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/james/apache-mime4j-core/0.7.2/apache-mime4j-core-0.7.2.jar
MD5: 88f799546eca803c53eee01a4ce5edcd
SHA1: a81264fe0265ebe8fd1d8128aad06dc320de6eef
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom groupid apache.james Highest
Vendor central groupid org.apache.james Highest
Vendor Manifest bundle-symbolicname org.apache.james.apache-mime4j-core Medium
Vendor file name apache-mime4j-core High
Vendor manifest Bundle-Description Java stream based MIME message parser Medium
Vendor pom artifactid apache-mime4j-core Low
Vendor Manifest bundle-docurl http://www.apache.org/ Low
Vendor pom groupid org.apache.james Highest
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom parent-artifactid apache-mime4j-project Low
Vendor pom name Apache JAMES Mime4j (Core) High
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom parent-groupid org.apache.james Medium
Vendor Manifest url http://james.apache.org/mime4j/apache-mime4j-core Low
Product pom parent-artifactid apache-mime4j-project Medium
Product Manifest bundle-symbolicname org.apache.james.apache-mime4j-core Medium
Product file name apache-mime4j-core High
Product manifest Bundle-Description Java stream based MIME message parser Medium
Product Manifest Implementation-Title Apache Mime4j High
Product Manifest bundle-docurl http://www.apache.org/ Low
Product central artifactid apache-mime4j-core Highest
Product pom parent-groupid org.apache.james Low
Product pom artifactid apache-mime4j-core Highest
Product pom name Apache JAMES Mime4j (Core) High
Product Manifest specification-title Apache Mime4j Medium
Product Manifest url http://james.apache.org/mime4j/apache-mime4j-core Low
Product Manifest Bundle-Name Apache JAMES Mime4j (Core) Medium
Product pom groupid apache.james Low
Version pom version 0.7.2 Highest
Version central version 0.7.2 Highest
Version file version 0.7.2 Highest
Version Manifest Implementation-Version 0.7.2 High
Related Dependencies
apache-mime4j-dom-0.7.2.jar
File Path: /home/ciagent/.m2/repository/org/apache/james/apache-mime4j-dom/0.7.2/apache-mime4j-dom-0.7.2.jar
SHA1: 1c289aa264548a0a1f1b43685a9cb2ab23f67287
MD5: dedc747b5c367fbd7f8a7235d1d7cbee
maven: org.apache.james:apache-mime4j-dom:0.7.2 ✓
xz-1.2.jar
Description: XZ data compression
License:
Public Domain
File Path: /home/ciagent/.m2/repository/org/tukaani/xz/1.2/xz-1.2.jar
MD5: 04bd31459826c30c2a3c304e3b225ad4
SHA1: bfc66dda280a18ab341b5023248925265c00394c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid org.tukaani Highest
Vendor pom artifactid xz Low
Vendor central groupid org.tukaani Highest
Vendor Manifest bundle-symbolicname org.tukaani.xz Medium
Vendor Manifest implementation-url http://tukaani.org/xz/java.html Low
Vendor pom description XZ data compression Medium
Vendor file name xz High
Vendor pom name XZ for Java High
Vendor pom groupid tukaani Highest
Vendor Manifest bundle-docurl http://tukaani.org/xz/java.html Low
Vendor pom url http://tukaani.org/xz/java.html Highest
Product pom groupid tukaani Low
Product pom description XZ data compression Medium
Product pom name XZ for Java High
Product Manifest bundle-docurl http://tukaani.org/xz/java.html Low
Product Manifest Bundle-Name XZ data compression Medium
Product Manifest Implementation-Title XZ data compression High
Product Manifest bundle-symbolicname org.tukaani.xz Medium
Product pom url http://tukaani.org/xz/java.html Medium
Product Manifest implementation-url http://tukaani.org/xz/java.html Low
Product pom artifactid xz Highest
Product file name xz High
Product central artifactid xz Highest
Version pom version 1.2 Highest
Version central version 1.2 Highest
Version file version 1.2 Highest
Version Manifest Implementation-Version 1.2 High
maven: org.tukaani:xz:1.2 ✓
Confidence :Highest
cpe: cpe:/a:tukaani:xz:1.2
Confidence :Low
suppress
Published Vulnerabilities
CVE-2015-4035 suppress
Severity:
Medium
CVSS Score: 4.6
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.
Vulnerable Software & Versions:
commons-compress-1.5.jar
Description:
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/commons/commons-compress/1.5/commons-compress-1.5.jar
MD5: 5e18cfcf472548c2e0b90a4ea1cedf42
SHA1: d2bd2c0bd328f1dabdf33e10b6d223ebcbe93343
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid org.apache.commons Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom parent-artifactid commons-parent Low
Vendor central groupid org.apache.commons Highest
Vendor file name commons-compress High
Vendor Manifest extension-name org.apache.commons.compress Medium
Vendor pom name Commons Compress High
Vendor Manifest bundle-docurl http://commons.apache.org/compress/ Low
Vendor Manifest bundle-symbolicname org.apache.commons.compress Medium
Vendor Manifest implementation-build tags/COMPRESS-1.5_RC1@r1455005; 2013-03-11 07:12:20+0100 Low
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom artifactid commons-compress Low
Vendor manifest Bundle-Description Apache Commons Compress software defines an API for working with compression and archive formats.These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom description
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low
Vendor pom url http://commons.apache.org/compress/ Highest
Vendor pom groupid apache.commons Highest
Product Manifest Implementation-Title Commons Compress High
Product pom parent-artifactid commons-parent Medium
Product pom artifactid commons-compress Highest
Product file name commons-compress High
Product Manifest extension-name org.apache.commons.compress Medium
Product pom name Commons Compress High
Product Manifest bundle-docurl http://commons.apache.org/compress/ Low
Product Manifest bundle-symbolicname org.apache.commons.compress Medium
Product Manifest Bundle-Name Commons Compress Medium
Product central artifactid commons-compress Highest
Product pom parent-groupid org.apache.commons Low
Product Manifest implementation-build tags/COMPRESS-1.5_RC1@r1455005; 2013-03-11 07:12:20+0100 Low
Product Manifest specification-title Commons Compress Medium
Product manifest Bundle-Description Apache Commons Compress software defines an API for working with compression and archive formats.These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low
Product pom groupid apache.commons Low
Product pom description
Apache Commons Compress software defines an API for working with compression and archive formats.
These include: bzip2, gzip, pack200, xz and ar, cpio, jar, tar, zip, dump. Low
Product pom url http://commons.apache.org/compress/ Medium
Version Manifest Implementation-Version 1.5 High
Version central version 1.5 Highest
Version pom version 1.5 Highest
Version file version 1.5 Highest
bcmail-jdk15-1.45.jar
Description: The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs. If the S/MIME API is used, the JavaMail API and the Java activation framework will also be needed.
License:
Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcmail-jdk15/1.45/bcmail-jdk15-1.45.jar
MD5: 13321fc7eff7bcada7b4fedfb592025c
SHA1: 3aed7e642dd8d39dc14ed1dec3ff79e084637148
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid bouncycastle Highest
Vendor central groupid org.bouncycastle Highest
Vendor file name bcmail-jdk15 High
Vendor Manifest Implementation-Vendor-Id org.bouncycastle Medium
Vendor pom name Bouncy Castle CMS and S/MIME API High
Vendor pom groupid org.bouncycastle Highest
Vendor Manifest extension-name org.bouncycastle.bcmail Medium
Vendor pom url http://www.bouncycastle.org/java.html Highest
Vendor Manifest specification-vendor BouncyCastle.org Low
Vendor Manifest Implementation-Vendor BouncyCastle.org High
Vendor pom description The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider ... Low
Vendor pom artifactid bcmail-jdk15 Low
Product pom url http://www.bouncycastle.org/java.html Medium
Product file name bcmail-jdk15 High
Product pom name Bouncy Castle CMS and S/MIME API High
Product pom artifactid bcmail-jdk15 Highest
Product pom description The Bouncy Castle Java CMS and S/MIME APIs for handling the CMS and S/MIME protocols. This jar contains CMS and S/MIME APIs for JDK 1.5. The APIs can be used in conjunction with a JCE/JCA provider ... Low
Product pom groupid bouncycastle Low
Product central artifactid bcmail-jdk15 Highest
Product Manifest extension-name org.bouncycastle.bcmail Medium
Version file version 1.45 Highest
Version central version 1.45 Highest
Version pom version 1.45 Highest
Version Manifest Implementation-Version 1.45.0 High
bcprov-jdk15-1.45.jar
Description: The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5.
License:
Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/ciagent/.m2/repository/org/bouncycastle/bcprov-jdk15/1.45/bcprov-jdk15-1.45.jar
MD5: 2062f8e3d15748443ea60a94b266371c
SHA1: 7741883cb07b4634e8b5fd3337113b6ea770a9bb
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid bouncycastle Highest
Vendor central groupid org.bouncycastle Highest
Vendor Manifest Implementation-Vendor-Id org.bouncycastle Medium
Vendor pom name Bouncy Castle Provider High
Vendor pom groupid org.bouncycastle Highest
Vendor pom description The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Low
Vendor pom url http://www.bouncycastle.org/java.html Highest
Vendor file name bcprov-jdk15 High
Vendor Manifest specification-vendor BouncyCastle.org Low
Vendor Manifest extension-name org.bouncycastle.bcprovider Medium
Vendor pom artifactid bcprov-jdk15 Low
Vendor Manifest Implementation-Vendor BouncyCastle.org High
Product pom artifactid bcprov-jdk15 Highest
Product file name bcprov-jdk15 High
Product pom url http://www.bouncycastle.org/java.html Medium
Product pom name Bouncy Castle Provider High
Product Manifest extension-name org.bouncycastle.bcprovider Medium
Product pom description The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Low
Product central artifactid bcprov-jdk15 Highest
Product pom groupid bouncycastle Low
Version file version 1.45 Highest
Version central version 1.45 Highest
Version pom version 1.45 Highest
Version Manifest Implementation-Version 1.45.0 High
cpe: cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45
Confidence :Low
suppress
maven: org.bouncycastle:bcprov-jdk15:1.45 ✓
Confidence :Highest
cpe: cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45
Confidence :Low
suppress
Published Vulnerabilities
CVE-2015-7940 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Vulnerable Software & Versions: (show all )
tagsoup-1.2.1.jar
Description: TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML.
License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/ccil/cowan/tagsoup/tagsoup/1.2.1/tagsoup-1.2.1.jar
MD5: ae73a52cdcbec10cd61d9ef22fab5936
SHA1: 5584627487e984c03456266d3f8802eb85a9ce97
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML. Low
Vendor file name tagsoup High
Vendor central groupid org.ccil.cowan.tagsoup Highest
Vendor pom name TagSoup High
Vendor pom groupid org.ccil.cowan.tagsoup Highest
Vendor pom url http://home.ccil.org/~cowan/XML/tagsoup/ Highest
Vendor pom groupid ccil.cowan.tagsoup Highest
Vendor pom artifactid tagsoup Low
Product pom description TagSoup is a SAX-compliant parser written in Java that, instead of parsing well-formed or valid XML, parses HTML as it is found in the wild: poor, nasty and brutish, though quite often far from short. TagSoup is designed for people who have to process this stuff using some semblance of a rational application design. By providing a SAX interface, it allows standard XML tools to be applied to even the worst HTML. TagSoup also includes a command-line processor that reads HTML files and can generate either clean HTML or well-formed XML that is a close approximation to XHTML. Low
Product pom artifactid tagsoup Highest
Product file name tagsoup High
Product pom groupid ccil.cowan.tagsoup Low
Product pom name TagSoup High
Product central artifactid tagsoup Highest
Product pom url http://home.ccil.org/~cowan/XML/tagsoup/ Medium
Version central version 1.2.1 Highest
Version pom version 1.2.1 Highest
Version file version 1.2.1 Highest
asm-debug-all-4.1.jar
File Path: /home/ciagent/.m2/repository/org/ow2/asm/asm-debug-all/4.1/asm-debug-all-4.1.jar
MD5: 6c3a8842f484dd3d620002b361e3610e
SHA1: dd6ba5c392d4102458494e29f54f70ac534ec2a2
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name ASM Debug All High
Vendor pom parent-groupid org.ow2.asm Medium
Vendor Manifest Implementation-Vendor France Telecom R&D High
Vendor Manifest bundle-docurl http://asm.objectweb.org Low
Vendor pom artifactid asm-debug-all Low
Vendor pom groupid ow2.asm Highest
Vendor pom groupid org.ow2.asm Highest
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Vendor central groupid org.ow2.asm Highest
Vendor pom parent-artifactid asm-parent Low
Vendor Manifest bundle-symbolicname org.objectweb.asm.all.debug Medium
Vendor file name asm-debug-all High
Product pom name ASM Debug All High
Product pom groupid ow2.asm Low
Product Manifest bundle-docurl http://asm.objectweb.org Low
Product Manifest Implementation-Title ASM all classes with debug info High
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Product pom artifactid asm-debug-all Highest
Product Manifest Bundle-Name ASM all classes with debug info Medium
Product Manifest bundle-symbolicname org.objectweb.asm.all.debug Medium
Product central artifactid asm-debug-all Highest
Product file name asm-debug-all High
Product pom parent-artifactid asm-parent Medium
Product pom parent-groupid org.ow2.asm Low
Version pom version 4.1 Highest
Version file version 4.1 Highest
Version central version 4.1 Highest
Version Manifest Implementation-Version 4.1 High
isoparser-1.0-RC-1.jar
Description: A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)
License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/googlecode/mp4parser/isoparser/1.0-RC-1/isoparser-1.0-RC-1.jar
MD5: b0444fde2290319c9028564c3c3ff1ab
SHA1: 4a5768b1070b9488a433362d736720fd7a7b264f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://code.google.com/p/mp4parser/ Highest
Vendor central groupid com.googlecode.mp4parser Highest
Vendor file name isoparser High
Vendor jar package name iso Low
Vendor pom description A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)
Medium
Vendor jar package name boxes Low
Vendor pom groupid com.googlecode.mp4parser Highest
Vendor pom artifactid isoparser Low
Vendor pom name ISO Parser High
Vendor jar package name coremedia Low
Vendor pom groupid googlecode.mp4parser Highest
Product pom artifactid isoparser Highest
Product file name isoparser High
Product pom url http://code.google.com/p/mp4parser/ Medium
Product jar package name iso Low
Product pom groupid googlecode.mp4parser Low
Product pom description A generic parser and writer for all ISO 14496 based files (MP4, Quicktime, DCF, PDCF, ...)
Medium
Product jar package name boxes Low
Product pom name ISO Parser High
Product central artifactid isoparser Highest
Version central version 1.0-RC-1 Highest
Version file version 1.0 Highest
Version file name isoparser Medium
Version pom version 1.0-RC-1 Highest
Published Vulnerabilities
CVE-2013-0259 suppress
Severity:
Low
CVSS Score: 2.1
(AV:N/AC:H/Au:S/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
Vulnerable Software & Versions: (show all )
xmpcore-5.1.2.jar
Description:
The XMP Library for Java is based on the C++ XMPCore library
and the API is similar.
License:
The BSD License: http://www.adobe.com/devnet/xmp/library/eula-xmp-library-java.html
File Path: /home/ciagent/.m2/repository/com/adobe/xmp/xmpcore/5.1.2/xmpcore-5.1.2.jar
MD5: 0b2cf2a09d32abdedd17de864e93ad25
SHA1: 55615fa2582424e38705487d1d3969af8554f637
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest builddate 2012 Jul 03 11:48:46-CEST Low
Vendor Manifest implementation-engbuild 003 Low
Vendor pom groupid adobe.xmp Highest
Vendor pom artifactid xmpcore Low
Vendor Manifest implementation-micro 1 Low
Vendor pom description
The XMP Library for Java is based on the C++ XMPCore library
and the API is similar.
Medium
Vendor Manifest implementation-major 5 Low
Vendor Manifest Implementation-Vendor Copyright 2006-2009 Adobe Systems Incorporated. All rights reserved High
Vendor file name xmpcore High
Vendor pom url http://www.adobe.com/devnet/xmp.html Highest
Vendor central groupid com.adobe.xmp Highest
Vendor pom name XMP Library for Java High
Vendor Manifest implementation-minor 1 Low
Vendor pom groupid com.adobe.xmp Highest
Product pom groupid adobe.xmp Low
Product pom url http://www.adobe.com/devnet/xmp.html Medium
Product Manifest builddate 2012 Jul 03 11:48:46-CEST Low
Product Manifest implementation-engbuild 003 Low
Product Manifest implementation-micro 1 Low
Product central artifactid xmpcore Highest
Product pom description
The XMP Library for Java is based on the C++ XMPCore library
and the API is similar.
Medium
Product Manifest implementation-major 5 Low
Product pom artifactid xmpcore Highest
Product file name xmpcore High
Product pom name XMP Library for Java High
Product Manifest implementation-minor 1 Low
Product Manifest Implementation-Title Adobe XMP Core High
Version pom version 5.1.2 Highest
Version file version 5.1.2 Highest
Version central version 5.1.2 Highest
metadata-extractor-2.6.2.jar
Description: Java library for reading metadata from image files.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/drewnoakes/metadata-extractor/2.6.2/metadata-extractor-2.6.2.jar
MD5: 8f3acbee87dbd5b0cdfacee3bb3aff8b
SHA1: 13930ff22d3f152bd969a63e88537d2f2adc2cd5
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name metadata Low
Vendor pom groupid drewnoakes Highest
Vendor pom description Java library for reading metadata from image files. Medium
Vendor pom url http://code.google.com/p/metadata-extractor/ Highest
Vendor file name metadata-extractor High
Vendor jar package name drew Low
Vendor central groupid com.drewnoakes Highest
Vendor pom artifactid metadata-extractor Low
Vendor pom name metadata-extractor High
Vendor pom groupid com.drewnoakes Highest
Product jar package name metadata Low
Product pom description Java library for reading metadata from image files. Medium
Product pom artifactid metadata-extractor Highest
Product file name metadata-extractor High
Product pom groupid drewnoakes Low
Product pom url http://code.google.com/p/metadata-extractor/ Medium
Product pom name metadata-extractor High
Product central artifactid metadata-extractor Highest
Version file version 2.6.2 Highest
Version central version 2.6.2 Highest
Version pom version 2.6.2 Highest
vorbis-java-core-0.1.jar
File Path: /home/ciagent/.m2/repository/org/gagravarr/vorbis-java-core/0.1/vorbis-java-core-0.1.jar
MD5: b88115be2754cb6883e652ba68ca46c8
SHA1: 662a02b94701947e6e66e7793d996043f05fad4a
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name vorbis-java-core High
Vendor pom parent-groupid org.gagravarr Medium
Vendor pom parent-artifactid vorbis-java-parent Low
Vendor pom groupid org.gagravarr Highest
Vendor pom groupid gagravarr Highest
Vendor pom url Gagravarr/VorbisJava Highest
Vendor jar package name gagravarr Low
Vendor pom name Ogg and Vorbis for Java, Core High
Vendor pom artifactid vorbis-java-core Low
Vendor central groupid org.gagravarr Highest
Product file name vorbis-java-core High
Product pom parent-groupid org.gagravarr Low
Product pom groupid gagravarr Low
Product pom url Gagravarr/VorbisJava High
Product pom artifactid vorbis-java-core Highest
Product central artifactid vorbis-java-core Highest
Product pom name Ogg and Vorbis for Java, Core High
Product pom parent-artifactid vorbis-java-parent Medium
Version file version 0.1 Highest
Version central version 0.1 Highest
Version pom version 0.1 Highest
juniversalchardet-1.0.3.jar
Description: Java port of universalchardet
License:
Mozilla Public License 1.1 (MPL 1.1): http://www.mozilla.org/MPL/MPL-1.1.html
File Path: /home/ciagent/.m2/repository/com/googlecode/juniversalchardet/juniversalchardet/1.0.3/juniversalchardet-1.0.3.jar
MD5: d9ea0a9a275336c175b343f2e4cd8f27
SHA1: cd49678784c46aa8789c060538e0154013bb421b
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name juniversalchardet High
Vendor pom artifactid juniversalchardet Low
Vendor jar package name mozilla Low
Vendor jar package name universalchardet Low
Vendor pom groupid com.googlecode.juniversalchardet Highest
Vendor pom url http://juniversalchardet.googlecode.com/ Highest
Vendor central groupid com.googlecode.juniversalchardet High
Vendor pom description Java port of universalchardet Medium
Vendor jar package name prober Low
Vendor file name juniversalchardet High
Vendor central groupid org.zenframework.z8.dependencies.commons High
Vendor pom groupid googlecode.juniversalchardet Highest
Product pom name juniversalchardet High
Product pom url http://juniversalchardet.googlecode.com/ Medium
Product pom groupid googlecode.juniversalchardet Low
Product central artifactid juniversalchardet-1.0.3 High
Product jar package name universalchardet Low
Product pom description Java port of universalchardet Medium
Product jar package name prober Low
Product central artifactid juniversalchardet High
Product pom artifactid juniversalchardet Highest
Product file name juniversalchardet High
Version file name juniversalchardet Medium
Version central version 1.0.3 High
Version pom version 1.0.3 Highest
Version central version 2.0 High
Version file version 1.0.3 Highest
jhighlight-1.0.jar
Description:
JHighlight is an embeddable pure Java syntax highlighting
library that supports Java, HTML, XHTML, XML and LZX
languages and outputs to XHTML.
It also supports RIFE templates tags and highlights them
clearly so that you can easily identify the difference
between your RIFE markup and the actual marked up source.
License:
CDDL, v1.0: http://www.opensource.org/licenses/cddl1.php
LGPL, v2.1 or later: http://www.opensource.org/licenses/lgpl-license.php
File Path: /home/ciagent/.m2/repository/com/uwyn/jhighlight/1.0/jhighlight-1.0.jar
MD5: 0ad5cf1bc56657f5e9e327e5e768da0a
SHA1: 0b1774029ee29472df8c25e5ba796431f7689fd6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid com.uwyn Highest
Vendor pom name JHighlight High
Vendor pom url https://jhighlight.dev.java.net/ Highest
Vendor pom artifactid jhighlight Low
Vendor jar package name jhighlight Low
Vendor pom groupid uwyn Highest
Vendor pom organization url http://uwyn.com/ Medium
Vendor jar package name uwyn Low
Vendor pom organization name Uwyn High
Vendor pom description JHighlight is an embeddable pure Java syntax highlighting library that supports Java, HTML, XHTML, XML and LZX languages and outputs to XHTML. It also supports RIFE templates tags and highlights them clearly so that you can easily identify the difference between your RIFE markup and the actual marked up source. Low
Vendor file name jhighlight High
Vendor central groupid com.uwyn Highest
Product pom groupid uwyn Low
Product pom name JHighlight High
Product pom organization url http://uwyn.com/ Low
Product central artifactid jhighlight Highest
Product pom organization name Uwyn Low
Product pom description JHighlight is an embeddable pure Java syntax highlighting library that supports Java, HTML, XHTML, XML and LZX languages and outputs to XHTML. It also supports RIFE templates tags and highlights them clearly so that you can easily identify the difference between your RIFE markup and the actual marked up source. Low
Product pom url https://jhighlight.dev.java.net/ Medium
Product jar package name jhighlight Low
Product pom artifactid jhighlight Highest
Product file name jhighlight High
Version file version 1.0 Highest
Version central version 1.0 Highest
Version pom version 1.0 Highest
xmlbeans-2.6.0.jar
Description: XmlBeans main jar
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/xmlbeans/xmlbeans/2.6.0/xmlbeans-2.6.0.jar
MD5: 6591c08682d613194dacb01e95c78c2c
SHA1: 29e80d2dd51f9dcdef8f9ffaee0d4dc1c9bbfc87
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name XmlBeans High
Vendor pom artifactid xmlbeans Low
Vendor pom organization name XmlBeans High
Vendor pom organization url http://xmlbeans.apache.org/ Medium
Vendor pom url http://xmlbeans.apache.org Highest
Vendor pom groupid org.apache.xmlbeans Highest
Vendor pom description XmlBeans main jar Medium
Vendor manifest: org/apache/xmlbeans/ Implementation-Vendor Apache Software Foundation Medium
Vendor pom groupid apache.xmlbeans Highest
Vendor central groupid org.apache.xmlbeans Highest
Vendor file name xmlbeans High
Product pom name XmlBeans High
Product pom organization name XmlBeans Low
Product pom groupid apache.xmlbeans Low
Product manifest: org/apache/xmlbeans/ Implementation-Title org.apache.xmlbeans Medium
Product central artifactid xmlbeans Highest
Product pom url http://xmlbeans.apache.org Medium
Product pom description XmlBeans main jar Medium
Product pom organization url http://xmlbeans.apache.org/ Low
Product pom artifactid xmlbeans Highest
Product file name xmlbeans High
Version pom version 2.6.0 Highest
Version central version 2.6.0 Highest
Version file version 2.6.0 Highest
exo.core.component.document-5.3.x-SNAPSHOT.jar
Description: Implementation of Document Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.document/5.3.x-SNAPSHOT/exo.core.component.document-5.3.x-SNAPSHOT.jar
MD5: f45710d396a164821cae9d6be2c43dea
SHA1: 3816bb2203bb3f7c818df5a3a3949a093bd74d02
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom name eXo PLF Core :: Component :: Document Service High
Vendor pom description Implementation of Document Service of Exoplatform SAS 'eXo Core' project. Medium
Vendor pom groupid org.exoplatform.core Highest
Vendor file name exo.core.component.document High
Vendor pom parent-artifactid core-parent Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium
Vendor pom artifactid exo.core.component.document Low
Vendor pom groupid exoplatform.core Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-groupid org.exoplatform.core Medium
Product pom artifactid exo.core.component.document Highest
Product pom name eXo PLF Core :: Component :: Document Service High
Product pom parent-groupid org.exoplatform.core Low
Product pom groupid exoplatform.core Low
Product pom parent-artifactid core-parent Medium
Product pom description Implementation of Document Service of Exoplatform SAS 'eXo Core' project. Medium
Product file name exo.core.component.document High
Product Manifest Implementation-Title eXo PLF Core :: Component :: Document Service High
Product Manifest specification-title exo-core Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.document:5.3.x-SNAPSHOT
Confidence :High
exo.core.component.database-5.3.x-SNAPSHOT.jar
Description: Implementation of Database Service of Exoplatform SAS eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.database/5.3.x-SNAPSHOT/exo.core.component.database-5.3.x-SNAPSHOT.jar
MD5: 92c38f5d3a2df6c2b885ad7408b22678
SHA1: 5b5bff26d83127aa80f76883395a4db05c39a4ff
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom artifactid exo.core.component.database Low
Vendor pom groupid org.exoplatform.core Highest
Vendor pom parent-artifactid core-parent Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium
Vendor pom groupid exoplatform.core Highest
Vendor pom name eXo PLF Core :: Component :: Database Service High
Vendor file name exo.core.component.database High
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-groupid org.exoplatform.core Medium
Vendor pom description Implementation of Database Service of Exoplatform SAS eXo Core' project. Medium
Product pom parent-groupid org.exoplatform.core Low
Product pom groupid exoplatform.core Low
Product pom parent-artifactid core-parent Medium
Product Manifest Implementation-Title eXo PLF Core :: Component :: Database Service High
Product pom name eXo PLF Core :: Component :: Database Service High
Product pom artifactid exo.core.component.database Highest
Product file name exo.core.component.database High
Product Manifest specification-title exo-core Medium
Product pom description Implementation of Database Service of Exoplatform SAS eXo Core' project. Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.database:5.3.x-SNAPSHOT
Confidence :High
lucene-core-3.6.2.jar
Description: Apache Lucene Java Core
File Path: /home/ciagent/.m2/repository/org/apache/lucene/lucene-core/3.6.2/lucene-core-3.6.2.jar
MD5: ee396d04f5a35557b424025f5382c815
SHA1: 9ec77e2507f9cc01756964c71d91efd8154a8c47
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid lucene-parent Low
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom description Apache Lucene Java Core Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom groupid apache.lucene Highest
Vendor pom groupid org.apache.lucene Highest
Vendor pom artifactid lucene-core Low
Vendor file name lucene-core High
Vendor Manifest extension-name org.apache.lucene Medium
Vendor central groupid org.apache.lucene Highest
Vendor pom name Lucene Core High
Vendor pom parent-groupid org.apache.lucene Medium
Product pom description Apache Lucene Java Core Medium
Product file name lucene-core High
Product Manifest extension-name org.apache.lucene Medium
Product pom groupid apache.lucene Low
Product Manifest Implementation-Title org.apache.lucene High
Product pom name Lucene Core High
Product pom artifactid lucene-core Highest
Product pom parent-artifactid lucene-parent Medium
Product central artifactid lucene-core Highest
Product pom parent-groupid org.apache.lucene Low
Product Manifest specification-title Lucene Search Engine: core Medium
Version file version 3.6.2 Highest
Version pom version 3.6.2 Highest
Version central version 3.6.2 Highest
lucene-analyzers-3.6.2.jar
Description: Additional Analyzers
File Path: /home/ciagent/.m2/repository/org/apache/lucene/lucene-analyzers/3.6.2/lucene-analyzers-3.6.2.jar
MD5: 13f8241b6991bd1349c05369a7c0f002
SHA1: 3a083510dcb0d0fc67f8456cdac6f48aa0da2993
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid lucene-parent Low
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom description Additional Analyzers Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom groupid apache.lucene Highest
Vendor pom groupid org.apache.lucene Highest
Vendor file name lucene-analyzers High
Vendor Manifest extension-name org.apache.lucene Medium
Vendor pom name Lucene Common Analyzers High
Vendor central groupid org.apache.lucene Highest
Vendor pom artifactid lucene-analyzers Low
Vendor pom parent-groupid org.apache.lucene Medium
Product Manifest specification-title Lucene Search Engine: analyzers Medium
Product pom artifactid lucene-analyzers Highest
Product file name lucene-analyzers High
Product Manifest extension-name org.apache.lucene Medium
Product pom groupid apache.lucene Low
Product pom name Lucene Common Analyzers High
Product Manifest Implementation-Title org.apache.lucene High
Product pom parent-artifactid lucene-parent Medium
Product central artifactid lucene-analyzers Highest
Product pom description Additional Analyzers Medium
Product pom parent-groupid org.apache.lucene Low
Version file version 3.6.2 Highest
Version pom version 3.6.2 Highest
Version central version 3.6.2 Highest
lucene-spellchecker-3.6.2.jar
Description: Spell Checker
File Path: /home/ciagent/.m2/repository/org/apache/lucene/lucene-spellchecker/3.6.2/lucene-spellchecker-3.6.2.jar
MD5: a4b684913f93aea76f5dbd7e479f19c5
SHA1: 15db0c0cfee44e275f15ad046e46b9a05910ad24
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid lucene-parent Low
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom groupid apache.lucene Highest
Vendor pom groupid org.apache.lucene Highest
Vendor file name lucene-spellchecker High
Vendor pom name Lucene Spellchecker High
Vendor pom description Spell Checker Medium
Vendor Manifest extension-name org.apache.lucene Medium
Vendor central groupid org.apache.lucene Highest
Vendor pom parent-groupid org.apache.lucene Medium
Vendor pom artifactid lucene-spellchecker Low
Product Manifest specification-title Lucene Search Engine: spellchecker Medium
Product file name lucene-spellchecker High
Product pom name Lucene Spellchecker High
Product pom description Spell Checker Medium
Product Manifest extension-name org.apache.lucene Medium
Product pom groupid apache.lucene Low
Product Manifest Implementation-Title org.apache.lucene High
Product central artifactid lucene-spellchecker Highest
Product pom parent-artifactid lucene-parent Medium
Product pom artifactid lucene-spellchecker Highest
Product pom parent-groupid org.apache.lucene Low
Version file version 3.6.2 Highest
Version pom version 3.6.2 Highest
Version central version 3.6.2 Highest
jta-1.1.jar
Description:
The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation.
File Path: /home/ciagent/.m2/repository/javax/transaction/jta/1.1/jta-1.1.jar
MD5: 82a10ce714f411b28f13850059de09ee
SHA1: 2ca09f0b36ca7d71b762e14ea2ff09d5eac57558
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest extension-name javax.transaction Medium
Vendor pom description The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation. Low
Vendor pom name Java Transaction API High
Vendor file name jta High
Vendor Manifest specification-vendor Sun Microsystems, Inc. Low
Vendor pom url http://java.sun.com/products/jta Highest
Vendor pom artifactid jta Low
Vendor pom groupid javax.transaction Highest
Vendor central groupid javax.transaction High
Product Manifest extension-name javax.transaction Medium
Product pom description The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation. Low
Product central artifactid transaction-api High
Product pom groupid javax.transaction Low
Product pom name Java Transaction API High
Product Manifest specification-title Java Transaction API Specification Medium
Product pom url http://java.sun.com/products/jta Medium
Product file name jta High
Product central artifactid jta High
Product pom artifactid jta Highest
Version file version 1.1 Highest
Version pom version 1.1 Highest
Version central version 1.1 High
concurrent-1.3.4.jar
License:
Public domain, Sun Microsoystems: >http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html
File Path: /home/ciagent/.m2/repository/concurrent/concurrent/1.3.4/concurrent-1.3.4.jar
MD5: f29b9d930d3426ebc56919eba10fbd4d
SHA1: 1cf394c2a388199db550cda311174a4c6a7d117c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom organization url http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html Medium
Vendor jar package name oswego Low
Vendor file name concurrent High
Vendor jar package name edu Low
Vendor pom name Dough Lea's util.concurrent package High
Vendor pom groupid concurrent Highest
Vendor pom artifactid concurrent Low
Vendor jar package name cs Low
Vendor central groupid concurrent Highest
Vendor pom organization name Dough Lea High
Product pom artifactid concurrent Highest
Product jar package name dl Low
Product jar package name oswego Low
Product file name concurrent High
Product pom groupid concurrent Low
Product pom organization url http://gee.cs.oswego.edu/dl/classes/EDU/oswego/cs/dl/util/concurrent/intro.html Low
Product pom name Dough Lea's util.concurrent package High
Product jar package name cs Low
Product central artifactid concurrent Highest
Product pom organization name Dough Lea Low
Version pom version 1.3.4 Highest
Version central version 1.3.4 Highest
Version file version 1.3.4 Highest
commons-collections-3.2.2.jar
Description: Types that extend and augment the Java Collections Framework.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://commons.apache.org/collections/ Highest
Vendor pom groupid commons-collections Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom artifactid commons-collections Low
Vendor pom parent-artifactid commons-parent Low
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low
Vendor pom description Types that extend and augment the Java Collections Framework. Medium
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom name Apache Commons Collections High
Vendor Manifest bundle-symbolicname org.apache.commons.collections Medium
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor file name commons-collections High
Vendor Manifest implementation-url http://commons.apache.org/collections/ Low
Vendor central groupid commons-collections Highest
Vendor Manifest bundle-docurl http://commons.apache.org/collections/ Low
Vendor manifest Bundle-Description Types that extend and augment the Java Collections Framework. Medium
Product pom parent-artifactid commons-parent Medium
Product Manifest Implementation-Title Apache Commons Collections High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.3))" Low
Product pom parent-groupid org.apache.commons Low
Product Manifest Bundle-Name Apache Commons Collections Medium
Product pom description Types that extend and augment the Java Collections Framework. Medium
Product Manifest implementation-build tags/COLLECTIONS_3_2_2_RC3@r1714131; 2015-11-13 00:09:45+0100 Low
Product pom name Apache Commons Collections High
Product central artifactid commons-collections Highest
Product pom artifactid commons-collections Highest
Product Manifest bundle-symbolicname org.apache.commons.collections Medium
Product Manifest specification-title Apache Commons Collections Medium
Product pom url http://commons.apache.org/collections/ Medium
Product file name commons-collections High
Product Manifest implementation-url http://commons.apache.org/collections/ Low
Product pom groupid commons-collections Low
Product Manifest bundle-docurl http://commons.apache.org/collections/ Low
Product manifest Bundle-Description Types that extend and augment the Java Collections Framework. Medium
Version pom version 3.2.2 Highest
Version Manifest Implementation-Version 3.2.2 High
Version file version 3.2.2 Highest
Version central version 3.2.2 Highest
jgroups-3.6.13.Final.jar
Description:
Reliable cluster communication toolkit
License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/org/jgroups/jgroups/3.6.13.Final/jgroups-3.6.13.Final.jar
MD5: d7a4d1065e9b09e3f48bfa88ab368a0c
SHA1: 1315a8a1aed98dcafc11a850957ced42dc26bf18
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.jgroups Highest
Vendor Manifest bundle-symbolicname org.jgroups Medium
Vendor pom description
Reliable cluster communication toolkit
Medium
Vendor file name jgroups High
Vendor pom groupid org.jgroups Highest
Vendor pom name JGroups High
Vendor pom groupid jgroups Highest
Vendor pom organization name JBoss, a division of Red Hat High
Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low
Vendor pom url http://www.jgroups.org Highest
Vendor pom artifactid jgroups Low
Vendor Manifest bundle-docurl http://www.jboss.org Low
Vendor pom organization url http://www.jboss.org Medium
Vendor manifest Bundle-Description Ant/ivy based build.xml file for JGroups. Needs ant to run Medium
Product pom artifactid jgroups Highest
Product Manifest bundle-symbolicname org.jgroups Medium
Product pom description
Reliable cluster communication toolkit
Medium
Product file name jgroups High
Product pom organization name JBoss, a division of Red Hat Low
Product Manifest Bundle-Name JGroups Medium
Product pom name JGroups High
Product Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low
Product pom groupid jgroups Low
Product pom url http://www.jgroups.org Medium
Product pom organization url http://www.jboss.org Low
Product Manifest bundle-docurl http://www.jboss.org Low
Product manifest Bundle-Description Ant/ivy based build.xml file for JGroups. Needs ant to run Medium
Product central artifactid jgroups Highest
Version central version 3.6.13.Final Highest
Version file version 3.6.13 Highest
Version pom version 3.6.13.Final Highest
Version Manifest Implementation-Version 3.6.13.Final High
jbossjta-4.16.6.Final.jar
Description: JBossTS - JBoss Transaction Service. JTA, JTS and XTS (WS-AT, WS-BA)
License:
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/jboss/jbossts/jbossjta/4.16.6.Final/jbossjta-4.16.6.Final.jar
MD5: 9e3c8d7d93b92ab97489aeb5816370c8
SHA1: 99e79e03ced180bea4e3307511d350eb2b88c91c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest arjuna-properties-file jbossts-properties.xml Low
Vendor pom groupid jboss.jbossts Highest
Vendor pom name JBossTS jbossjta High
Vendor pom description JBossTS - JBoss Transaction Service. JTA, JTS and XTS (WS-AT, WS-BA) Medium
Vendor pom groupid org.jboss.jbossts Highest
Vendor pom artifactid jbossjta Low
Vendor pom url http://www.jboss.org/jbosstm/ Highest
Vendor Manifest arjuna-builder JBoss Inc. [tom] Linux 3.4.11-1.fc16.x86_64 2012/Oct/02 15:05 Low
Vendor central groupid org.jboss.jbossts Highest
Vendor file name jbossjta High
Product Manifest arjuna-properties-file jbossts-properties.xml Low
Product pom name JBossTS jbossjta High
Product pom description JBossTS - JBoss Transaction Service. JTA, JTS and XTS (WS-AT, WS-BA) Medium
Product central artifactid jbossjta Highest
Product pom url http://www.jboss.org/jbosstm/ Medium
Product Manifest arjuna-builder JBoss Inc. [tom] Linux 3.4.11-1.fc16.x86_64 2012/Oct/02 15:05 Low
Product pom artifactid jbossjta Highest
Product file name jbossjta High
Product pom groupid jboss.jbossts Low
Version central version 4.16.6.Final Highest
Version file version 4.16.6 Highest
Version pom version 4.16.6.Final Highest
ws-commons-util-1.0.1.jar
Description: This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/ws/commons/ws-commons-util/1.0.1/ws-commons-util-1.0.1.jar
MD5: 66919d22287ddab742a135da764c2cd6
SHA1: 126e80ff798fece634bc94e61f8be8a8da00be60
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor Apache Software Foundation Low
Vendor file name ws-commons-util High
Vendor Manifest extension-name ws-commons-util Medium
Vendor Manifest Implementation-Vendor Apache Software Foundation High
Vendor pom name Apache WebServices Common Utilities High
Vendor pom organization name Apache Software Foundation High
Vendor pom organization url http://www.apache.org/ Medium
Vendor pom groupid org.apache.ws.commons Highest
Vendor pom artifactid ws-commons-util Low
Vendor central groupid org.apache.ws.commons High
Vendor pom description This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced. Low
Vendor central groupid ws-commons-util High
Vendor pom url http://ws.apache.org/commons/util Highest
Vendor pom groupid apache.ws.commons Highest
Product file name ws-commons-util High
Product Manifest extension-name ws-commons-util Medium
Product pom name Apache WebServices Common Utilities High
Product pom organization url http://www.apache.org/ Low
Product pom groupid apache.ws.commons Low
Product pom description This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced. Low
Product Manifest Implementation-Title ws-commons-util High
Product central artifactid ws-commons-util High
Product pom artifactid ws-commons-util Highest
Product pom url http://ws.apache.org/commons/util Medium
Product Manifest specification-title This is a small collection of utility classes, that allow high performance XML processing based on SAX. Basically, it is assumed, that you are using an JAXP 1.1 compliant XML parser and nothing else. In particular, no dependency on the javax.xml.transform package is introduced. Medium
Product pom organization name Apache Software Foundation Low
Version pom version 1.0.1 Highest
Version Manifest Implementation-Version 1.0.1 High
Version central version 1.0.1 High
Version file version 1.0.1 Highest
Published Vulnerabilities
CVE-2016-10542 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Vulnerable Software & Versions:
jboss-common-core-2.2.22.GA.jar
Description: JBoss Common Core Utility classes
File Path: /home/ciagent/.m2/repository/org/jboss/jboss-common-core/2.2.22.GA/jboss-common-core-2.2.22.GA.jar
MD5: 8c415e1467075a90045a7b0fd19886a3
SHA1: ae1a22412d879c4ac48e35cf00f438bb263d41c3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid jboss-parent Low
Vendor Manifest specification-vendor JBoss, a division of Red Hat, Inc. Low
Vendor pom url http://www.jboss.org/jboss-common Highest
Vendor Manifest Implementation-Vendor JBoss, a division of Red Hat, Inc. High
Vendor file name jboss-common-core High
Vendor pom groupid jboss Highest
Vendor Manifest Implementation-Vendor-Id org.jboss Medium
Vendor pom artifactid jboss-common-core Low
Vendor pom description JBoss Common Core Utility classes Medium
Vendor pom parent-groupid org.jboss Medium
Vendor pom groupid org.jboss Highest
Vendor pom name JBoss Common Classes High
Vendor central groupid org.jboss Highest
Vendor Manifest implementation-url http://www.jboss.org/jboss-common Low
Product Manifest Implementation-Title JBoss Common Classes High
Product pom artifactid jboss-common-core Highest
Product pom groupid jboss Low
Product file name jboss-common-core High
Product pom parent-groupid org.jboss Low
Product Manifest specification-title JBoss Common Classes Medium
Product central artifactid jboss-common-core Highest
Product pom description JBoss Common Core Utility classes Medium
Product pom url http://www.jboss.org/jboss-common Medium
Product pom parent-artifactid jboss-parent Medium
Product pom name JBoss Common Classes High
Product Manifest implementation-url http://www.jboss.org/jboss-common Low
Version Manifest Implementation-Version 2.2.22.GA High
Version central version 2.2.22.GA Highest
Version pom version 2.2.22.GA Highest
Version file version 2.2.22 Highest
stringtemplate-3.2.1.jar
Description: StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output.
StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization.
It evolved over years of effort developing jGuru.com.
StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic
is that unlike other engines, it strictly enforces model-view separation.
Strict separation makes websites and code generators more flexible
and maintainable; it also provides an excellent defense against malicious
template authors.
There are currently about 600 StringTemplate source downloads a month.
License:
BSD licence: http://antlr.org/license.html
File Path: /home/ciagent/.m2/repository/org/antlr/stringtemplate/3.2.1/stringtemplate-3.2.1.jar
MD5: b58ca53e518a92a1991eb63b61917582
SHA1: 59ec8083721eae215c6f3caee944c410d2be34de
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid org.antlr Highest
Vendor pom name ANTLR StringTemplate High
Vendor pom groupid antlr Highest
Vendor pom artifactid stringtemplate Low
Vendor jar package name stringtemplate Low
Vendor jar package name language Low
Vendor file name stringtemplate High
Vendor pom url http://www.stringtemplate.org Highest
Vendor pom description StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output. StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization. It evolved over years of effort developing jGuru.com. StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic is that un... Low
Vendor central groupid org.antlr Highest
Vendor jar package name antlr Low
Product pom artifactid stringtemplate Highest
Product pom groupid antlr Low
Product pom url http://www.stringtemplate.org Medium
Product pom name ANTLR StringTemplate High
Product jar package name language Low
Product jar package name stringtemplate Low
Product central artifactid stringtemplate Highest
Product file name stringtemplate High
Product pom description StringTemplate is a java template engine for generating source code,
web pages, emails, or any other formatted text output. StringTemplate is particularly good at multi-targeted code generators,
multiple site skins, and internationalization/localization. It evolved over years of effort developing jGuru.com. StringTemplate also generates the stringtemplate website: http://www.stringtemplate.org
and powers the ANTLR v3 code generator. Its distinguishing characteristic is that un... Low
Version central version 3.2.1 Highest
Version file version 3.2.1 Highest
Version pom version 3.2.1 Highest
antlr-runtime-3.5.jar
Description: A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions.
File Path: /home/ciagent/.m2/repository/org/antlr/antlr-runtime/3.5/antlr-runtime-3.5.jar
MD5: aa6d7c8b425df59f5f5bc98c58cfd9fc
SHA1: 0baa82bff19059401e90e1b90020beb9c96305d7
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest Implementation-Vendor-Id org.antlr Medium
Vendor pom name ANTLR 3 Runtime High
Vendor pom groupid org.antlr Highest
Vendor pom groupid antlr Highest
Vendor pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low
Vendor Manifest Implementation-Vendor ANTLR High
Vendor pom url http://www.antlr.org Highest
Vendor pom parent-groupid org.antlr Medium
Vendor pom artifactid antlr-runtime Low
Vendor pom parent-artifactid antlr-master Low
Vendor file name antlr-runtime High
Vendor central groupid org.antlr Highest
Product pom artifactid antlr-runtime Highest
Product Manifest Implementation-Title ANTLR 3 Runtime High
Product pom groupid antlr Low
Product pom parent-artifactid antlr-master Medium
Product central artifactid antlr-runtime Highest
Product pom parent-groupid org.antlr Low
Product pom name ANTLR 3 Runtime High
Product file name antlr-runtime High
Product pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low
Product pom url http://www.antlr.org Medium
Version central version 3.5 Highest
Version file version 3.5 Highest
Version Manifest Implementation-Version 3.5 High
Version pom version 3.5 Highest
jboss-logging-3.3.0.Final.jar
Description: The JBoss Logging Framework
License:
Apache License, version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/jboss/logging/jboss-logging/3.3.0.Final/jboss-logging-3.3.0.Final.jar
MD5: bc11af4b8ce7138cdc79b7ba8561638c
SHA1: 3616bb87707910296e2c195dc016287080bba5af
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.jboss.logging Highest
Vendor pom parent-artifactid jboss-parent Low
Vendor Manifest Implementation-Vendor-Id org.jboss.logging Medium
Vendor Manifest originally-created-by Apache Maven Bundle Plugin Low
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom groupid org.jboss.logging Highest
Vendor manifest Bundle-Description The JBoss Logging Framework Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor pom name JBoss Logging 3 High
Vendor Manifest build-timestamp Thu, 28 May 2015 09:49:28 -0700 Low
Vendor Manifest os-name Linux Medium
Vendor pom artifactid jboss-logging Low
Vendor pom url http://www.jboss.org Highest
Vendor pom groupid jboss.logging Highest
Vendor pom parent-groupid org.jboss Medium
Vendor file name jboss-logging High
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor Manifest bundle-symbolicname org.jboss.logging.jboss-logging Medium
Vendor pom description The JBoss Logging Framework Medium
Vendor Manifest implementation-url http://www.jboss.org Low
Vendor Manifest bundle-docurl http://www.jboss.org Low
Product pom url http://www.jboss.org Medium
Product Manifest specification-title JBoss Logging 3 Medium
Product Manifest originally-created-by Apache Maven Bundle Plugin Low
Product manifest Bundle-Description The JBoss Logging Framework Medium
Product pom parent-groupid org.jboss Low
Product pom name JBoss Logging 3 High
Product Manifest Bundle-Name JBoss Logging 3 Medium
Product Manifest build-timestamp Thu, 28 May 2015 09:49:28 -0700 Low
Product central artifactid jboss-logging Highest
Product Manifest Implementation-Title JBoss Logging 3 High
Product Manifest os-name Linux Medium
Product pom parent-artifactid jboss-parent Medium
Product pom artifactid jboss-logging Highest
Product file name jboss-logging High
Product Manifest bundle-symbolicname org.jboss.logging.jboss-logging Medium
Product pom description The JBoss Logging Framework Medium
Product Manifest implementation-url http://www.jboss.org Low
Product Manifest bundle-docurl http://www.jboss.org Low
Product pom groupid jboss.logging Low
Version file version 3.3.0 Highest
Version Manifest Implementation-Version 3.3.0.Final High
Version pom version 3.3.0.Final Highest
Version central version 3.3.0.Final Highest
exo.kernel.component.ext.cache.impl.infinispan.v8-5.3.x-SNAPSHOT.jar
Description: Infinispan Implementation of Cache Service for Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.ext.cache.impl.infinispan.v8/5.3.x-SNAPSHOT/exo.kernel.component.ext.cache.impl.infinispan.v8-5.3.x-SNAPSHOT.jar
MD5: 2bd82588a1d04ea435de3b334321abb1
SHA1: 1008ebec01e1a674843d64dee25fdd0daf31078e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium
Vendor pom parent-groupid org.exoplatform.kernel Medium
Vendor pom groupid org.exoplatform.kernel Highest
Vendor file name exo.kernel.component.ext.cache.impl.infinispan.v8 High
Vendor pom name eXo PLF:: Kernel :: Cache Extension :: Infinispan Implementation High
Vendor pom groupid exoplatform.kernel Highest
Vendor pom description Infinispan Implementation of Cache Service for Exoplatform SAS 'eXo Kernel' project. Medium
Vendor pom artifactid exo.kernel.component.ext.cache.impl.infinispan.v8 Low
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-artifactid kernel-parent Low
Product pom artifactid exo.kernel.component.ext.cache.impl.infinispan.v8 Highest
Product Manifest specification-title exo-kernel Medium
Product file name exo.kernel.component.ext.cache.impl.infinispan.v8 High
Product pom name eXo PLF:: Kernel :: Cache Extension :: Infinispan Implementation High
Product pom parent-artifactid kernel-parent Medium
Product pom description Infinispan Implementation of Cache Service for Exoplatform SAS 'eXo Kernel' project. Medium
Product pom parent-groupid org.exoplatform.kernel Low
Product Manifest Implementation-Title eXo PLF:: Kernel :: Cache Extension :: Infinispan Implementation High
Product pom groupid exoplatform.kernel Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.component.ext.cache.impl.infinispan.v8:5.3.x-SNAPSHOT
Confidence :High
cpe: cpe:/a:infinispan:infinispan:5.3.0
Confidence :Highest
suppress
Published Vulnerabilities
CVE-2016-0750 suppress
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-15089 suppress
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-2638 suppress
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Vulnerable Software & Versions: (show all )
jboss-marshalling-osgi-2.0.0.Beta3.jar
Description: JBoss Marshalling OSGi Bundle with API and implementations
License:
http://repository.jboss.org/licenses/cc0-1.0.txt
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar
MD5: 7652392087f6e70312cf0309ab563a4f
SHA1: a55fe6527a2d50dc48ad3f8b9093bd0cb01302b0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-symbolicname org.jboss.marshalling.jboss-marshalling-osgi Medium
Vendor jar package name marshalling Low
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest implementation-url http://www.jboss.org/jboss-marshalling-parent/jboss-marshalling-osgi Low
Vendor pom groupid org.jboss.marshalling Highest
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest os-name Linux Medium
Vendor Manifest bundle-docurl http://jboss.org/jbossmarshalling Low
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor Manifest Implementation-Vendor-Id org.jboss.marshalling Medium
Vendor file name jboss-marshalling-osgi High
Vendor central groupid org.jboss.marshalling Highest
Vendor jar package name jboss Low
Vendor manifest Bundle-Description JBoss Marshalling OSGi Bundle with API and implementations Medium
Product Manifest bundle-symbolicname org.jboss.marshalling.jboss-marshalling-osgi Medium
Product Manifest Bundle-Name JBoss Marshalling OSGi Bundle Medium
Product jar package name marshalling Low
Product Manifest implementation-url http://www.jboss.org/jboss-marshalling-parent/jboss-marshalling-osgi Low
Product Manifest os-name Linux Medium
Product Manifest bundle-docurl http://jboss.org/jbossmarshalling Low
Product central artifactid jboss-marshalling-osgi Highest
Product file name jboss-marshalling-osgi High
Product pom artifactid jboss-marshalling-osgi Highest
Product Manifest specification-title JBoss Marshalling OSGi Bundle Medium
Product Manifest Implementation-Title JBoss Marshalling OSGi Bundle High
Product manifest Bundle-Description JBoss Marshalling OSGi Bundle with API and implementations Medium
Version central version 2.0.0.Beta3 Highest
Version pom version 2.0.0.Beta3 Highest
Version Manifest Implementation-Version 2.0.0.Beta3 High
infinispan-core-8.2.6.Final.jar
Description: Infinispan core module
License:
http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/ciagent/.m2/repository/org/infinispan/infinispan-core/8.2.6.Final/infinispan-core-8.2.6.Final.jar
MD5: 06371c22b39aef4faf1da8d21b2102cb
SHA1: 84937a866a56760b9c50bfbca10442fa14be6375
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description Infinispan core module Medium
Vendor Manifest bundle-symbolicname org.infinispan.core Medium
Vendor pom artifactid infinispan-core Low
Vendor Manifest Implementation-Vendor-Id org.infinispan Medium
Vendor Manifest specification-vendor JBoss, a division of Red Hat Low
Vendor manifest Bundle-Description Infinispan core module Medium
Vendor pom name Infinispan Core High
Vendor pom groupid infinispan Highest
Vendor Manifest Implementation-Vendor JBoss, a division of Red Hat High
Vendor pom parent-groupid org.infinispan Medium
Vendor pom parent-artifactid infinispan-parent Low
Vendor central groupid org.infinispan Highest
Vendor pom groupid org.infinispan Highest
Vendor file name infinispan-core High
Vendor Manifest bundle-docurl http://www.infinispan.org/ Low
Vendor Manifest bundle-blueprint OSGI-INF/blueprint/blueprint.xml Low
Product pom description Infinispan core module Medium
Product Manifest bundle-symbolicname org.infinispan.core Medium
Product Manifest specification-title Infinispan Core Medium
Product Manifest Implementation-Title Infinispan Core High
Product Manifest Bundle-Name Infinispan Core Medium
Product pom artifactid infinispan-core Highest
Product manifest Bundle-Description Infinispan core module Medium
Product pom name Infinispan Core High
Product pom parent-artifactid infinispan-parent Medium
Product pom parent-groupid org.infinispan Low
Product central artifactid infinispan-core Highest
Product file name infinispan-core High
Product Manifest bundle-docurl http://www.infinispan.org/ Low
Product Manifest bundle-blueprint OSGI-INF/blueprint/blueprint.xml Low
Product pom groupid infinispan Low
Version file version 8.2.6 Highest
Version central version 8.2.6.Final Highest
Version pom version 8.2.6.Final Highest
Version Manifest Implementation-Version 8.2.6.Final High
Related Dependencies
infinispan-cachestore-jdbc-8.2.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/infinispan/infinispan-cachestore-jdbc/8.2.6.Final/infinispan-cachestore-jdbc-8.2.6.Final.jar
SHA1: 1703f2cae7b2cb483158dca831d68ee711f301ab
MD5: 3ca2e9d4e5ed44fc984fe94c2d943bf2
cpe: cpe:/a:infinispan:infinispan:8.2.6
maven: org.infinispan:infinispan-cachestore-jdbc:8.2.6.Final ✓
infinispan-commons-8.2.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/infinispan/infinispan-commons/8.2.6.Final/infinispan-commons-8.2.6.Final.jar
SHA1: 846b3a39de5f793fb11e70fc70662e4374ffc3c2
MD5: 9da9ef6cf978bf024d377180806414db
cpe: cpe:/a:infinispan:infinispan:8.2.6
maven: org.infinispan:infinispan-commons:8.2.6.Final ✓
Published Vulnerabilities
CVE-2016-0750 suppress
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-15089 suppress
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Vulnerable Software & Versions: (show all )
CVE-2017-2638 suppress
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
CWE: CWE-287 Improper Authentication
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Vulnerable Software & Versions: (show all )
exo.jcr.component.core-5.3.x-SNAPSHOT.jar
Description: Implementation of Core Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/jcr/exo.jcr.component.core/5.3.x-SNAPSHOT/exo.jcr.component.core-5.3.x-SNAPSHOT.jar
MD5: 270fed54370dddb7b6f2a0ac0a53fb19
SHA1: 2e610d06ecc8ae00c94f7504cdef11211515dbd3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name exo.jcr.component.core High
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom parent-groupid org.exoplatform.jcr Medium
Vendor pom parent-artifactid jcr-parent Low
Vendor pom name eXo PLF:: JCR :: Component :: Core Service High
Vendor pom description Implementation of Core Service of Exoplatform SAS 'eXo Core' project. Medium
Vendor pom groupid org.exoplatform.jcr Highest
Vendor Manifest Implementation-Vendor-Id org.exoplatform.jcr Medium
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.jcr Highest
Vendor pom artifactid exo.jcr.component.core Low
Product file name exo.jcr.component.core High
Product pom groupid exoplatform.jcr Low
Product pom artifactid exo.jcr.component.core Highest
Product pom name eXo PLF:: JCR :: Component :: Core Service High
Product pom parent-groupid org.exoplatform.jcr Low
Product pom description Implementation of Core Service of Exoplatform SAS 'eXo Core' project. Medium
Product Manifest specification-title exo-jcr Medium
Product Manifest Implementation-Title eXo PLF:: JCR :: Component :: Core Service High
Product pom parent-artifactid jcr-parent Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.jcr:exo.jcr.component.core:5.3.x-SNAPSHOT
Confidence :High
quartz-2.2.2.jar
Description: Enterprise Job Scheduler
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
Apache Software License, Version 2.0
File Path: /home/ciagent/.m2/repository/org/quartz-scheduler/quartz/2.2.2/quartz-2.2.2.jar
MD5: 6acfd6ada2f4ad0abf4de916654dcaea
SHA1: 6fd24da6803ab7c3a08bc519a62219a9bebeb0df
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest buildinfo-host tc-c65-jenkins-slave-001.eur.ad.sag Low
Vendor Manifest buildinfo-revision 2464 Low
Vendor pom description Enterprise Job Scheduler Medium
Vendor pom artifactid quartz Low
Vendor Manifest bundle-symbolicname org.quartz-scheduler.quartz Medium
Vendor central groupid org.quartz-scheduler Highest
Vendor pom parent-groupid org.quartz-scheduler Medium
Vendor file name quartz High
Vendor Manifest terracotta-name quartz Medium
Vendor Manifest buildinfo-timestamp 20151012-045213 Low
Vendor Manifest buildinfo-user jenkins-slave Low
Vendor manifest Bundle-Description Enterprise Job Scheduler Medium
Vendor manifest terracotta-description Enterprise Job Scheduler Medium
Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.6 Low
Vendor Manifest bundle-docurl http://www.terracotta.org Low
Vendor pom groupid org.quartz-scheduler Highest
Vendor pom name quartz High
Vendor pom groupid quartz-scheduler Highest
Vendor pom parent-artifactid quartz-parent Low
Vendor Manifest buildinfo-url https://svn.terracotta.org/repo/quartz/tags/quartz-2.2.2 Low
Product Manifest buildinfo-host tc-c65-jenkins-slave-001.eur.ad.sag Low
Product pom groupid quartz-scheduler Low
Product Manifest buildinfo-revision 2464 Low
Product pom parent-artifactid quartz-parent Medium
Product pom description Enterprise Job Scheduler Medium
Product pom parent-groupid org.quartz-scheduler Low
Product central artifactid quartz Highest
Product Manifest bundle-symbolicname org.quartz-scheduler.quartz Medium
Product pom artifactid quartz Highest
Product file name quartz High
Product Manifest terracotta-name quartz Medium
Product Manifest buildinfo-timestamp 20151012-045213 Low
Product Manifest buildinfo-user jenkins-slave Low
Product manifest Bundle-Description Enterprise Job Scheduler Medium
Product manifest terracotta-description Enterprise Job Scheduler Medium
Product Manifest bundle-requiredexecutionenvironment JavaSE-1.6 Low
Product Manifest bundle-docurl http://www.terracotta.org Low
Product pom name quartz High
Product Manifest Bundle-Name quartz Medium
Product Manifest buildinfo-url https://svn.terracotta.org/repo/quartz/tags/quartz-2.2.2 Low
Version central version 2.2.2 Highest
Version file version 2.2.2 Highest
Version pom version 2.2.2 Highest
mail-1.4.7.jar
Description: JavaMail API (compat)
License:
http://www.sun.com/cddl, https://glassfish.java.net/public/CDDL+GPL_1_1.html
File Path: /home/ciagent/.m2/repository/javax/mail/mail/1.4.7/mail-1.4.7.jar
MD5: 77f53ff0c78ba43c4812ecc9f53e20f8
SHA1: 9add058589d5d85adeb625859bf2c5eeaaedf12d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor Oracle Low
Vendor Manifest originally-created-by 1.7.0_15 (Oracle Corporation) Low
Vendor Manifest bundle-docurl http://www.oracle.com Low
Vendor Manifest Implementation-Vendor Oracle High
Vendor Manifest bundle-symbolicname javax.mail Medium
Vendor pom artifactid mail Low
Vendor pom name JavaMail API (compat) High
Vendor Manifest Implementation-Vendor-Id com.sun Medium
Vendor Manifest extension-name javax.mail Medium
Vendor Manifest probe-provider-xml-file-names META-INF/gfprobe-provider.xml Medium
Vendor manifest Bundle-Description JavaMail API (compat) Medium
Vendor pom parent-groupid com.sun.mail Medium
Vendor central groupid javax.mail High
Vendor Manifest (hint) specification-vendor sun Low
Vendor Manifest (hint) Implementation-Vendor sun High
Vendor pom groupid javax.mail Highest
Vendor file name mail High
Vendor pom parent-artifactid all Low
Vendor central groupid org.zenframework.z8.dependencies.commons High
Product Manifest originally-created-by 1.7.0_15 (Oracle Corporation) Low
Product Manifest Implementation-Title javax.mail High
Product pom artifactid mail Highest
Product Manifest bundle-docurl http://www.oracle.com Low
Product central artifactid mail-1.4.7 High
Product pom groupid javax.mail Low
Product Manifest Bundle-Name JavaMail API (compat) Medium
Product Manifest bundle-symbolicname javax.mail Medium
Product pom name JavaMail API (compat) High
Product Manifest extension-name javax.mail Medium
Product Manifest probe-provider-xml-file-names META-INF/gfprobe-provider.xml Medium
Product manifest Bundle-Description JavaMail API (compat) Medium
Product Manifest specification-title JavaMail(TM) API Design Specification Medium
Product pom parent-groupid com.sun.mail Low
Product file name mail High
Product central artifactid mail High
Product pom parent-artifactid all Medium
Version file version 1.4.7 Highest
Version Manifest Implementation-Version 1.4.7 High
commons-dbcp-1.4.jar
Description: Commons Database Connection Pooling
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-dbcp/commons-dbcp/1.4/commons-dbcp-1.4.jar
MD5: b004158fab904f37f5831860898b3cd9
SHA1: 30be73c965cc990b153a100aaaaafcf239f82d39
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid commons-dbcp Highest
Vendor Manifest bundle-symbolicname org.apache.commons.dbcp Medium
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor file name commons-dbcp High
Vendor pom parent-artifactid commons-parent Low
Vendor pom url http://commons.apache.org/dbcp/ Highest
Vendor pom groupid commons-dbcp Highest
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor manifest Bundle-Description Commons Database Connection Pooling Medium
Vendor pom name Commons DBCP High
Vendor pom description Commons Database Connection Pooling Medium
Vendor Manifest bundle-docurl http://commons.apache.org/dbcp/ Low
Vendor pom artifactid commons-dbcp Low
Product Manifest Implementation-Title Commons DBCP High
Product Manifest bundle-symbolicname org.apache.commons.dbcp Medium
Product pom parent-artifactid commons-parent Medium
Product file name commons-dbcp High
Product pom artifactid commons-dbcp Highest
Product pom parent-groupid org.apache.commons Low
Product Manifest specification-title Commons DBCP Medium
Product pom groupid commons-dbcp Low
Product manifest Bundle-Description Commons Database Connection Pooling Medium
Product Manifest Bundle-Name Commons DBCP Medium
Product pom name Commons DBCP High
Product pom url http://commons.apache.org/dbcp/ Medium
Product pom description Commons Database Connection Pooling Medium
Product central artifactid commons-dbcp Highest
Product Manifest bundle-docurl http://commons.apache.org/dbcp/ Low
Version Manifest Implementation-Version 1.4 High
Version pom version 1.4 Highest
Version central version 1.4 Highest
Version file version 1.4 Highest
commons-pool-1.6.jar
Description: Commons Object Pooling Library
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-pool/commons-pool/1.6/commons-pool-1.6.jar
MD5: 5ca02245c829422176d23fa530e919cc
SHA1: 4572d589699f09d866a226a14b7f4323c6d8f040
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Commons Pool High
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest implementation-build UNKNOWN_BRANCH@r??????; 2012-01-04 10:31:47-0500 Low
Vendor pom parent-artifactid commons-parent Low
Vendor central groupid commons-pool Highest
Vendor file name commons-pool High
Vendor pom parent-groupid org.apache.commons Medium
Vendor pom artifactid commons-pool Low
Vendor pom description Commons Object Pooling Library Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom url http://commons.apache.org/pool/ Highest
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor Manifest bundle-symbolicname org.apache.commons.pool Medium
Vendor Manifest bundle-docurl http://commons.apache.org/pool/ Low
Vendor manifest Bundle-Description Commons Object Pooling Library Medium
Vendor pom groupid commons-pool Highest
Product pom name Commons Pool High
Product Manifest Bundle-Name Commons Pool Medium
Product pom parent-artifactid commons-parent Medium
Product Manifest implementation-build UNKNOWN_BRANCH@r??????; 2012-01-04 10:31:47-0500 Low
Product pom artifactid commons-pool Highest
Product file name commons-pool High
Product Manifest Implementation-Title Commons Pool High
Product Manifest specification-title Commons Pool Medium
Product pom parent-groupid org.apache.commons Low
Product pom url http://commons.apache.org/pool/ Medium
Product central artifactid commons-pool Highest
Product pom description Commons Object Pooling Library Medium
Product pom groupid commons-pool Low
Product Manifest bundle-symbolicname org.apache.commons.pool Medium
Product Manifest bundle-docurl http://commons.apache.org/pool/ Low
Product manifest Bundle-Description Commons Object Pooling Library Medium
Version file version 1.6 Highest
Version central version 1.6 Highest
Version pom version 1.6 Highest
Version Manifest Implementation-Version 1.6 High
exo.kernel.component.common-5.3.x-SNAPSHOT.jar
Description: Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.common/5.3.x-SNAPSHOT/exo.kernel.component.common-5.3.x-SNAPSHOT.jar
MD5: c57430ba3cc88079d9fe4604fed4798c
SHA1: d3f3536bcb0b5ed4306eaf6896f22d022f844899
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom description Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project. Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium
Vendor pom parent-groupid org.exoplatform.kernel Medium
Vendor pom groupid org.exoplatform.kernel Highest
Vendor pom groupid exoplatform.kernel Highest
Vendor pom artifactid exo.kernel.component.common Low
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-artifactid kernel-parent Low
Vendor file name exo.kernel.component.common High
Vendor pom name eXo PLF:: Kernel :: Component :: Common Service High
Product pom description Implementation of Common Service of Exoplatform SAS 'eXo Kernel' project. Medium
Product Manifest Implementation-Title eXo PLF:: Kernel :: Component :: Common Service High
Product Manifest specification-title exo-kernel Medium
Product pom parent-artifactid kernel-parent Medium
Product pom parent-groupid org.exoplatform.kernel Low
Product pom artifactid exo.kernel.component.common Highest
Product file name exo.kernel.component.common High
Product pom groupid exoplatform.kernel Low
Product pom name eXo PLF:: Kernel :: Component :: Common Service High
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.component.common:5.3.x-SNAPSHOT
Confidence :High
xmlpull-1.1.3.1.jar
License:
Public Domain: http://www.xmlpull.org/v1/download/unpacked/LICENSE.txt
File Path: /home/ciagent/.m2/repository/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar
MD5: cc57dacc720eca721a50e78934b822d2
SHA1: 2b8e230d2ab644e4ecaa94db7cdedbc40c805dfa
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid xmlpull Highest
Vendor jar package name xmlpull Low
Vendor pom artifactid xmlpull Low
Vendor pom name XML Pull Parsing API High
Vendor jar package name v1 Low
Vendor pom url http://www.xmlpull.org Highest
Vendor file name xmlpull High
Vendor central groupid xmlpull Highest
Product pom url http://www.xmlpull.org Medium
Product pom name XML Pull Parsing API High
Product central artifactid xmlpull Highest
Product pom groupid xmlpull Low
Product jar package name v1 Low
Product pom artifactid xmlpull Highest
Product file name xmlpull High
Version pom version 1.1.3.1 Highest
Version central version 1.1.3.1 Highest
Version file version 1.1.3.1 Highest
xpp3_min-1.1.4c.jar
Description: MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs such as Hotspot in JDK 1.4+.
License:
Indiana University Extreme! Lab Software License, vesion 1.1.1: http://www.extreme.indiana.edu/viewcvs/~checkout~/XPP3/java/LICENSE.txt
Public Domain: http://creativecommons.org/licenses/publicdomain
File Path: /home/ciagent/.m2/repository/xpp3/xpp3_min/1.1.4c/xpp3_min-1.1.4c.jar
MD5: dcd95bcb84b09897b2b66d4684c040da
SHA1: 19d4e90b43059058f6e056f794f0ea4030d60b86
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name xmlpull Low
Vendor pom url http://www.extreme.indiana.edu/xgws/xsoap/xpp/mxp1/ Highest
Vendor pom organization name Extreme! Lab, Indiana University High
Vendor central groupid xpp3 Highest
Vendor file name xpp3_min High
Vendor pom organization url http://www.extreme.indiana.edu/ Medium
Vendor pom name MXP1: Xml Pull Parser 3rd Edition (XPP3) High
Vendor pom description MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ... Low
Vendor jar package name v1 Low
Vendor pom groupid xpp3 Highest
Vendor pom artifactid xpp3_min Low
Product central artifactid xpp3_min Highest
Product pom artifactid xpp3_min Highest
Product pom url http://www.extreme.indiana.edu/xgws/xsoap/xpp/mxp1/ Medium
Product pom organization name Extreme! Lab, Indiana University Low
Product file name xpp3_min High
Product pom groupid xpp3 Low
Product pom name MXP1: Xml Pull Parser 3rd Edition (XPP3) High
Product pom description MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ... Low
Product jar package name v1 Low
Product pom organization url http://www.extreme.indiana.edu/ Low
Version central version 1.1.4c Highest
Version file version 1.1.4c Highest
Version pom version 1.1.4c Highest
xstream-1.4.10.jar
Description: XStream is a serialization library from Java objects to XML and back.
License:
http://x-stream.github.io/license.html
File Path: /home/ciagent/.m2/repository/com/thoughtworks/xstream/xstream/1.4.10/xstream-1.4.10.jar
MD5: d00eec778910f95b26201395ac64cca0
SHA1: dfecae23647abc9d9fd0416629a4213a3882b101
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-docurl http://x-stream.github.io Low
Vendor Manifest java_1_8_home /opt/oracle-jdk-bin-1.8.0.131 Low
Vendor Manifest java_1_7_home /opt/oracle-jdk-bin-1.7.0.80 Low
Vendor pom name XStream Core High
Vendor Manifest specification-vendor XStream Low
Vendor file name xstream High
Vendor Manifest x-compile-target 1.5 Low
Vendor Manifest x-builder Maven 3.3.9 Low
Vendor pom groupid thoughtworks.xstream Highest
Vendor central groupid com.thoughtworks.xstream Highest
Vendor Manifest java_1_4_home /opt/blackdown-jdk-1.4.2.03 Low
Vendor Manifest x-compile-source 1.5 Low
Vendor Manifest Implementation-Vendor XStream High
Vendor pom groupid com.thoughtworks.xstream Highest
Vendor Manifest java_1_6_home /opt/sun-jdk-1.6.0.45 Low
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low
Vendor Manifest java_1_9_home /opt/oracle-jdk-bin-1.9.0.0_beta167 Low
Vendor Manifest x-build-time 2017-05-23T14:28:02Z Low
Vendor Manifest bundle-symbolicname xstream Medium
Vendor pom parent-groupid com.thoughtworks.xstream Medium
Vendor Manifest java_1_5_home /opt/sun-jdk-1.5.0.22 Low
Vendor pom artifactid xstream Low
Vendor manifest Bundle-Description XStream is a serialization library from Java objects to XML and back. Medium
Vendor pom parent-artifactid xstream-parent Low
Vendor Manifest Implementation-Vendor-Id com.thoughtworks.xstream Medium
Product Manifest bundle-docurl http://x-stream.github.io Low
Product Manifest java_1_8_home /opt/oracle-jdk-bin-1.8.0.131 Low
Product Manifest Bundle-Name XStream Core Medium
Product Manifest java_1_7_home /opt/oracle-jdk-bin-1.7.0.80 Low
Product pom name XStream Core High
Product pom artifactid xstream Highest
Product file name xstream High
Product Manifest specification-title XStream Core Medium
Product Manifest x-compile-target 1.5 Low
Product Manifest x-builder Maven 3.3.9 Low
Product Manifest Implementation-Title XStream Core High
Product Manifest java_1_4_home /opt/blackdown-jdk-1.4.2.03 Low
Product Manifest x-compile-source 1.5 Low
Product Manifest java_1_6_home /opt/sun-jdk-1.6.0.45 Low
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low
Product Manifest java_1_9_home /opt/oracle-jdk-bin-1.9.0.0_beta167 Low
Product Manifest x-build-time 2017-05-23T14:28:02Z Low
Product Manifest bundle-symbolicname xstream Medium
Product pom groupid thoughtworks.xstream Low
Product central artifactid xstream Highest
Product Manifest java_1_5_home /opt/sun-jdk-1.5.0.22 Low
Product pom parent-artifactid xstream-parent Medium
Product manifest Bundle-Description XStream is a serialization library from Java objects to XML and back. Medium
Product pom parent-groupid com.thoughtworks.xstream Low
Version file version 1.4.10 Highest
Version central version 1.4.10 Highest
Version pom version 1.4.10 Highest
Version Manifest Implementation-Version 1.4.10 High
Published Vulnerabilities
CVE-2013-7285 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Vulnerable Software & Versions: (show all )
commons-api-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-api/5.3.x-SNAPSHOT/commons-api-5.3.x-SNAPSHOT.jar
MD5: 2c3b7dfa120a9e5572d3b2c600e4ca02
SHA1: 3405ca34dc1ae7aa88efe1c0c1f2eb4168dd3c60
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor Manifest implementation-url https://projects.exoplatform.org/commons/commons-api Low
Vendor pom parent-groupid org.exoplatform.commons Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.commons Medium
Vendor file name commons-api High
Vendor Manifest date 2019-05-24T09:54:58Z Low
Vendor pom name eXo PLF:: Commons - API High
Vendor pom parent-artifactid commons Low
Vendor pom artifactid commons-api Low
Vendor pom groupid org.exoplatform.commons Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.commons Highest
Product pom artifactid commons-api Highest
Product pom parent-groupid org.exoplatform.commons Low
Product Manifest implementation-url https://projects.exoplatform.org/commons/commons-api Low
Product pom parent-artifactid commons Medium
Product pom name eXo PLF:: Commons - API High
Product Manifest specification-title eXo PLF:: Commons - API Medium
Product pom groupid exoplatform.commons Low
Product file name commons-api High
Product Manifest Implementation-Title eXo PLF:: Commons - API High
Product Manifest date 2019-05-24T09:54:58Z Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.commons:commons-api:5.3.x-SNAPSHOT
Confidence :High
commons-lang-2.6.jar
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low
Vendor pom parent-artifactid commons-parent Low
Vendor pom name Commons Lang High
Vendor pom groupid commons-lang Highest
Vendor pom parent-groupid org.apache.commons Medium
Vendor pom url http://commons.apache.org/lang/ Highest
Vendor central groupid commons-lang High
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor central groupid org.netbeans.external High
Vendor Manifest bundle-docurl http://commons.apache.org/lang/ Low
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor Manifest bundle-symbolicname org.apache.commons.lang Medium
Vendor file name commons-lang High
Vendor pom artifactid commons-lang Low
Product manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low
Product Manifest Bundle-Name Commons Lang Medium
Product pom parent-artifactid commons-parent Medium
Product pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low
Product pom artifactid commons-lang Highest
Product pom name Commons Lang High
Product central artifactid org-apache-commons-lang High
Product pom parent-groupid org.apache.commons Low
Product pom url http://commons.apache.org/lang/ Medium
Product Manifest bundle-docurl http://commons.apache.org/lang/ Low
Product Manifest bundle-symbolicname org.apache.commons.lang Medium
Product file name commons-lang High
Product Manifest specification-title Commons Lang Medium
Product central artifactid commons-lang High
Product Manifest Implementation-Title Commons Lang High
Product pom groupid commons-lang Low
Version central version RELEASE110 High
Version central version RELEASE90 High
Version central version RELEASE100 High
Version file version 2.6 Highest
Version central version 2.6 High
Version Manifest Implementation-Version 2.6 High
Version pom version 2.6 Highest
jcr-1.0.1.jar
Description: Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation.
License:
Day License: http://www.day.com/maven/jsr170/licenses/day-spec-license.htm
File Path: /home/ciagent/.m2/repository/javax/jcr/jcr/1.0.1/jcr-1.0.1.jar
MD5: 4639c7b994528948dab1a4feb1f68d6f
SHA1: 567ee103cf7592e3cf036e1bf4e2e06b9f08e1a1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name jcr High
Vendor pom artifactid jcr Low
Vendor pom name Content Repository for Java Technology API High
Vendor pom groupid javax.jcr Highest
Vendor Manifest extension-name jcr Medium
Vendor pom organization name Day Software Management AG High
Vendor pom description Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation. Low
Vendor pom url http://www.jcp.org/en/jsr/detail?id=170 Highest
Vendor Manifest Implementation-Vendor Day Software Management AG High
Vendor Manifest specification-vendor Day Software Management AG Low
Vendor pom organization url http://www.day.com/ Medium
Product file name jcr High
Product Manifest Implementation-Title javax.jcr High
Product pom groupid javax.jcr Low
Product pom organization name Day Software Management AG Low
Product pom organization url http://www.day.com/ Low
Product pom name Content Repository for Java Technology API High
Product Manifest extension-name jcr Medium
Product Manifest specification-title Content Repository for Java Technology API Medium
Product pom description Content Repository for Java technology API. Specifies a standard API to access content repositories in JavaTM 2 independently of implementation. Low
Product pom artifactid jcr Highest
Product pom url http://www.jcp.org/en/jsr/detail?id=170 Medium
Version pom version 1.0.1 Highest
Version Manifest Implementation-Version 1.0.1 High
Version file version 1.0.1 Highest
cpe: cpe:/a:content_project:content:1.0.1
Confidence :Low
suppress
maven: javax.jcr:jcr:1.0.1
Confidence :High
Published Vulnerabilities
CVE-2017-16111 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.
Vulnerable Software & Versions:
chromattic.api-1.3.0.jar
Description: Chromattic Framework API
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.api/1.3.0/chromattic.api-1.3.0.jar
MD5: 11f2df6e3a3b4451719710c0f4c08103
SHA1: 4f60a9585bd6e68833eaaea1f1a615c682adbe27
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom description Chromattic Framework API Medium
Vendor file name chromattic.api High
Vendor pom parent-artifactid chromattic.parent Low
Vendor central groupid org.chromattic Highest
Vendor pom artifactid chromattic.api Low
Vendor pom parent-groupid org.chromattic Medium
Vendor pom name Chromattic Framework API High
Vendor jar package name api Low
Product pom parent-artifactid chromattic.parent Medium
Product central artifactid chromattic.api Highest
Product pom description Chromattic Framework API Medium
Product pom parent-groupid org.chromattic Low
Product file name chromattic.api High
Product pom groupid chromattic Low
Product pom artifactid chromattic.api Highest
Product pom name Chromattic Framework API High
Product jar package name api Low
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
antlr-2.7.7.jar
Description:
A framework for constructing recognizers, compilers,
and translators from grammatical descriptions containing
Java, C#, C++, or Python actions.
License:
BSD License: http://www.antlr.org/license.html
File Path: /home/ciagent/.m2/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar
MD5: f8f1352c52a4c6a500b597596501fc64
SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low
Vendor pom name AntLR Parser Generator High
Vendor pom url http://www.antlr.org/ Highest
Vendor pom artifactid antlr Low
Vendor pom groupid antlr Highest
Vendor central groupid antlr Highest
Vendor file name antlr High
Vendor jar package name antlr Low
Product pom artifactid antlr Highest
Product pom groupid antlr Low
Product pom url http://www.antlr.org/ Medium
Product pom description A framework for constructing recognizers, compilers, and translators from grammatical descriptions containing Java, C#, C++, or Python actions. Low
Product pom name AntLR Parser Generator High
Product central artifactid antlr Highest
Product file name antlr High
Version pom version 2.7.7 Highest
Version file version 2.7.7 Highest
Version central version 2.7.7 Highest
dom4j-1.6.1.jar
Description: dom4j: the flexible XML framework for Java
File Path: /home/ciagent/.m2/repository/dom4j/dom4j/1.6.1/dom4j-1.6.1.jar
MD5: 4d8f51d3fe3900efc6e395be48030d6d
SHA1: 5d3ccc056b6f056dbf0dddfdf43894b9065a8f94
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest extension-name dom4j Medium
Vendor pom description dom4j: the flexible XML framework for Java Medium
Vendor pom groupid dom4j Highest
Vendor Manifest specification-vendor MetaStuff Ltd. Low
Vendor pom artifactid dom4j Low
Vendor file name dom4j High
Vendor pom organization name MetaStuff Ltd. High
Vendor Manifest Implementation-Vendor MetaStuff Ltd. High
Vendor pom organization url http://sourceforge.net/projects/dom4j Medium
Vendor pom url http://dom4j.org Highest
Vendor central groupid dom4j High
Vendor pom name dom4j High
Vendor central groupid org.zenframework.z8.dependencies.commons High
Product Manifest extension-name dom4j Medium
Product pom description dom4j: the flexible XML framework for Java Medium
Product pom url http://dom4j.org Medium
Product file name dom4j High
Product central artifactid dom4j High
Product pom groupid dom4j Low
Product pom organization url http://sourceforge.net/projects/dom4j Low
Product pom artifactid dom4j Highest
Product central artifactid dom4j-1.6.1 High
Product Manifest Implementation-Title org.dom4j High
Product pom organization name MetaStuff Ltd. Low
Product Manifest specification-title dom4j : XML framework for Java Medium
Product pom name dom4j High
Version Manifest Implementation-Version 1.6.1 High
Version file version 1.6.1 Highest
Published Vulnerabilities
CVE-2018-1000632 suppress
Severity:
Medium
CVSS Score: 6.4
(AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-91 XML Injection (aka Blind XPath Injection)
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Vulnerable Software & Versions: (show all )
hibernate-jpa-2.0-api-1.0.1.Final.jar
Description:
Hibernate definition of the Java Persistence 2.0 (JSR 317) API.
License:
license.txt
File Path: /home/ciagent/.m2/repository/org/hibernate/javax/persistence/hibernate-jpa-2.0-api/1.0.1.Final/hibernate-jpa-2.0-api-1.0.1.Final.jar
MD5: d7e7d8f60fc44a127ba702d43e71abec
SHA1: 3306a165afa81938fc3d8a0948e891de9f6b192b
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://hibernate.org Highest
Vendor Manifest Implementation-Vendor hibernate.org High
Vendor central groupid org.hibernate.javax.persistence Highest
Vendor file name hibernate-jpa-2.0-api-1.0.1.Final High
Vendor pom artifactid hibernate-jpa-2.0-api Low
Vendor Manifest specification-vendor Sun Microsystems, Inc. Low
Vendor pom description
Hibernate definition of the Java Persistence 2.0 (JSR 317) API.
Medium
Vendor pom organization url http://hibernate.org Medium
Vendor pom groupid hibernate.javax.persistence Highest
Vendor pom name JPA 2.0 API High
Vendor pom organization name Hibernate.org High
Vendor pom groupid org.hibernate.javax.persistence Highest
Product pom description
Hibernate definition of the Java Persistence 2.0 (JSR 317) API.
Medium
Product pom groupid hibernate.javax.persistence Low
Product Manifest Implementation-Title JPA API High
Product pom organization name Hibernate.org Low
Product pom organization url http://hibernate.org Low
Product pom artifactid hibernate-jpa-2.0-api Highest
Product file name hibernate-jpa-2.0-api-1.0.1.Final High
Product pom name JPA 2.0 API High
Product Manifest specification-title Java Persistence API, Version 2.0 Medium
Product pom url http://hibernate.org Medium
Product central artifactid hibernate-jpa-2.0-api Highest
Version central version 1.0.1.Final Highest
Version pom version 1.0.1.Final Highest
Version Manifest Implementation-Version 1.0.1.Final High
jboss-logging-annotations-1.2.0.Beta1.jar
File Path: /home/ciagent/.m2/repository/org/jboss/logging/jboss-logging-annotations/1.2.0.Beta1/jboss-logging-annotations-1.2.0.Beta1.jar
MD5: 938e552e319015a8863dd91284aada54
SHA1: 2f437f37bb265d9f8f1392823dbca12d2bec06d6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.jboss.logging Highest
Vendor pom artifactid jboss-logging-annotations Low
Vendor Manifest Implementation-Vendor-Id org.jboss.logging Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom groupid org.jboss.logging Highest
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest os-name Linux Medium
Vendor pom name JBoss Logging I18n Annotations High
Vendor pom groupid jboss.logging Highest
Vendor Manifest build-timestamp Tue, 18 Jun 2013 18:41:43 -0500 Low
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor file name jboss-logging-annotations High
Vendor Manifest implementation-url http://www.jboss.org/jboss-logging-tools-parent/jboss-logging-annotations Low
Vendor pom parent-groupid org.jboss.logging Medium
Vendor pom parent-artifactid jboss-logging-tools-parent Low
Product Manifest specification-title JBoss Logging I18n Annotations Medium
Product Manifest Implementation-Title JBoss Logging I18n Annotations High
Product Manifest os-name Linux Medium
Product pom artifactid jboss-logging-annotations Highest
Product central artifactid jboss-logging-annotations Highest
Product pom name JBoss Logging I18n Annotations High
Product Manifest build-timestamp Tue, 18 Jun 2013 18:41:43 -0500 Low
Product pom parent-groupid org.jboss.logging Low
Product file name jboss-logging-annotations High
Product Manifest implementation-url http://www.jboss.org/jboss-logging-tools-parent/jboss-logging-annotations Low
Product pom parent-artifactid jboss-logging-tools-parent Medium
Product pom groupid jboss.logging Low
Version pom version 1.2.0.Beta1 Highest
Version central version 1.2.0.Beta1 Highest
Version Manifest Implementation-Version 1.2.0.Beta1 High
hibernate-commons-annotations-4.0.5.Final.jar
Description: Common reflection code used in support of annotation processing
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/hibernate/common/hibernate-commons-annotations/4.0.5.Final/hibernate-commons-annotations-4.0.5.Final.jar
MD5: 5dadbafd7c7bc1168c10a2ba87e927a2
SHA1: 2a581b9edb8168e45060d8bad8b7f46712d2c52c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://hibernate.org Highest
Vendor pom name Hibernate Commons Annotations High
Vendor Manifest bundle-symbolicname org.hibernate.common.hibernate-commons-annotations Medium
Vendor Manifest Implementation-Vendor Hibernate.org High
Vendor pom groupid org.hibernate.common Highest
Vendor pom artifactid hibernate-commons-annotations Low
Vendor pom groupid hibernate.common Highest
Vendor file name hibernate-commons-annotations High
Vendor Manifest Implementation-Vendor-Id org.hibernate Medium
Vendor central groupid org.hibernate.common Highest
Vendor pom organization url http://hibernate.org Medium
Vendor Manifest implementation-url http://hibernate.org Low
Vendor pom organization name Hibernate.org High
Vendor pom description Common reflection code used in support of annotation processing Medium
Product pom name Hibernate Commons Annotations High
Product pom groupid hibernate.common Low
Product pom organization url http://hibernate.org Low
Product Manifest bundle-symbolicname org.hibernate.common.hibernate-commons-annotations Medium
Product central artifactid hibernate-commons-annotations Highest
Product file name hibernate-commons-annotations High
Product pom artifactid hibernate-commons-annotations Highest
Product pom organization name Hibernate.org Low
Product Manifest implementation-url http://hibernate.org Low
Product Manifest Bundle-Name hibernate-commons-annotations Medium
Product pom description Common reflection code used in support of annotation processing Medium
Product pom url http://hibernate.org Medium
Version Manifest Implementation-Version 4.0.5.Final High
Version pom version 4.0.5.Final Highest
Version central version 4.0.5.Final Highest
Version file version 4.0.5 Highest
hibernate-core-4.2.21.Final.jar
Description: A module of the Hibernate O/RM project
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/hibernate/hibernate-core/4.2.21.Final/hibernate-core-4.2.21.Final.jar
MD5: 492567c1f36fb3a5968ca2d3c452edaf
SHA1: bb587d00287c13d9e4324bc76c13abbd493efa81
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://hibernate.org Highest
Vendor pom groupid hibernate Highest
Vendor Manifest bundle-symbolicname org.hibernate.core Medium
Vendor Manifest Implementation-Vendor Hibernate.org High
Vendor pom name A Hibernate O/RM Module High
Vendor pom groupid org.hibernate Highest
Vendor Manifest Implementation-Vendor-Id org.hibernate Medium
Vendor manifest Bundle-Description Hibernate ORM Core Medium
Vendor pom artifactid hibernate-core Low
Vendor pom organization url http://hibernate.org Medium
Vendor file name hibernate-core High
Vendor central groupid org.hibernate Highest
Vendor Manifest implementation-url http://hibernate.org Low
Vendor pom organization name Hibernate.org High
Vendor pom description A module of the Hibernate O/RM project Medium
Product pom organization url http://hibernate.org Low
Product Manifest bundle-symbolicname org.hibernate.core Medium
Product pom artifactid hibernate-core Highest
Product pom groupid hibernate Low
Product pom name A Hibernate O/RM Module High
Product central artifactid hibernate-core Highest
Product manifest Bundle-Description Hibernate ORM Core Medium
Product Manifest Bundle-Name hibernate-core Medium
Product pom organization name Hibernate.org Low
Product file name hibernate-core High
Product Manifest implementation-url http://hibernate.org Low
Product pom description A module of the Hibernate O/RM project Medium
Product pom url http://hibernate.org Medium
Version central version 4.2.21.Final Highest
Version file version 4.2.21 Highest
Version pom version 4.2.21.Final Highest
Version Manifest Implementation-Version 4.2.21.Final High
jakarta-regexp-1.4.jar
File Path: /home/ciagent/.m2/repository/jakarta-regexp/jakarta-regexp/1.4/jakarta-regexp-1.4.jar
MD5: 5d8b8c601c21b37aa6142d38f45c0297
SHA1: 0ea514a179ac1dd7e81c7e6594468b9b9910d298
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid jakarta-regexp Highest
Vendor jar package name regexp Low
Vendor central groupid jakarta-regexp Highest
Vendor file name jakarta-regexp High
Vendor pom artifactid jakarta-regexp Low
Vendor jar package name apache Low
Product central artifactid jakarta-regexp Highest
Product pom artifactid jakarta-regexp Highest
Product pom groupid jakarta-regexp Low
Product jar package name regexp Low
Product file name jakarta-regexp High
Version pom version 1.4 Highest
Version central version 1.4 Highest
Version file version 1.4 Highest
xpp3-1.1.6.jar
Description: XML Pull parser library developed by Extreme Computing Lab, Indiana University
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/ogce/xpp3/1.1.6/xpp3-1.1.6.jar
MD5: 626a429318310e92e3466151e050bdc5
SHA1: dc87e00ddb69341b46a3eb1c331c6fcebf6c8546
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name xmlpull Low
Vendor pom groupid org.ogce Highest
Vendor jar package name builder Low
Vendor file name xpp3 High
Vendor pom description XML Pull parser library developed by Extreme Computing Lab, Indiana University Medium
Vendor pom url http://www.extreme.indiana.edu/xpp/ Highest
Vendor jar package name v1 Low
Vendor pom groupid ogce Highest
Vendor pom artifactid xpp3 Low
Vendor central groupid org.ogce Highest
Vendor pom name XPP3 High
Product pom artifactid xpp3 Highest
Product pom groupid ogce Low
Product pom url http://www.extreme.indiana.edu/xpp/ Medium
Product jar package name builder Low
Product file name xpp3 High
Product jar package name xpath Low
Product pom description XML Pull parser library developed by Extreme Computing Lab, Indiana University Medium
Product jar package name v1 Low
Product central artifactid xpp3 Highest
Product pom name XPP3 High
Version pom version 1.1.6 Highest
Version central version 1.1.6 Highest
Version file version 1.1.6 Highest
exo.core.component.organization.api-5.3.x-SNAPSHOT.jar
Description: API of Organization Service of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.organization.api/5.3.x-SNAPSHOT/exo.core.component.organization.api-5.3.x-SNAPSHOT.jar
MD5: dac80c845342c757a54f5b1c780c52d6
SHA1: a07f68213aab5a6dd25dfcc8780e4162c59a7673
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom description API of Organization Service of Exoplatform SAS 'eXo Core' project. Medium
Vendor pom name eXo PLF Core :: Component :: Organization Service API High
Vendor pom groupid org.exoplatform.core Highest
Vendor pom parent-artifactid core-parent Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium
Vendor pom artifactid exo.core.component.organization.api Low
Vendor pom groupid exoplatform.core Highest
Vendor file name exo.core.component.organization.api High
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-groupid org.exoplatform.core Medium
Product pom description API of Organization Service of Exoplatform SAS 'eXo Core' project. Medium
Product pom parent-groupid org.exoplatform.core Low
Product pom groupid exoplatform.core Low
Product pom parent-artifactid core-parent Medium
Product pom name eXo PLF Core :: Component :: Organization Service API High
Product Manifest Implementation-Title eXo PLF Core :: Component :: Organization Service API High
Product pom artifactid exo.core.component.organization.api Highest
Product file name exo.core.component.organization.api High
Product Manifest specification-title exo-core Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
cpe: cpe:/a:api-platform:core:5.3
Confidence :Low
suppress
maven: org.exoplatform.core:exo.core.component.organization.api:5.3.x-SNAPSHOT
Confidence :High
mime-util-2.1.3.jar
Description: mime-util is a simple to use, small, light weight and fast open source java utility library that can detect
MIME types from files, input streams, URL's and byte arrays.
Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/eu/medsea/mimeutil/mime-util/2.1.3/mime-util-2.1.3.jar
MD5: 3d4f3e1a96eb79683197f1c8b182f4a6
SHA1: 0c9cfae15c74f62491d4f28def0dff1dabe52a47
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest Bundle-Description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low
Vendor Manifest bundle-docurl http://www.medsea.eu Low
Vendor pom url http://www.medsea.eu/mime-util/ Highest
Vendor central groupid eu.medsea.mimeutil Highest
Vendor pom description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low
Vendor pom name Mime Detection Utility High
Vendor pom organization url http://www.medsea.eu Medium
Vendor Manifest bundle-symbolicname eu.medsea.mimeutil.mime-util Medium
Vendor pom artifactid mime-util Low
Vendor file name mime-util High
Vendor pom organization name Medsea Business Solutions S.L. High
Vendor pom groupid eu.medsea.mimeutil Highest
Vendor Manifest url http://www.medsea.eu/mime-util/ Low
Product manifest Bundle-Description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low
Product Manifest bundle-docurl http://www.medsea.eu Low
Product Manifest Bundle-Name Mime Detection Utility Medium
Product central artifactid mime-util Highest
Product pom organization name Medsea Business Solutions S.L. Low
Product pom groupid eu.medsea.mimeutil Low
Product pom description mime-util is a simple to use, small, light weight and fast open source java utility library that can detect MIME types from files, input streams, URL's and byte arrays. Due to the use of regular expressions and the java.nio packages it requires at least Java 1.4. Low
Product pom name Mime Detection Utility High
Product Manifest bundle-symbolicname eu.medsea.mimeutil.mime-util Medium
Product pom organization url http://www.medsea.eu Low
Product file name mime-util High
Product pom artifactid mime-util Highest
Product pom url http://www.medsea.eu/mime-util/ Medium
Product Manifest url http://www.medsea.eu/mime-util/ Low
Version central version 2.1.3 Highest
Version file version 2.1.3 Highest
Version pom version 2.1.3 Highest
jcl-over-slf4j-1.7.18.jar
Description: JCL 1.1.1 implemented over SLF4J
File Path: /home/ciagent/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.18/jcl-over-slf4j-1.7.18.jar
MD5: 86c8f80da62e4640564effb9dff7e003
SHA1: eca71be00af2579564e9f3a23ce0b245ca79ee5d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid jcl-over-slf4j Low
Vendor pom url http://www.slf4j.org Highest
Vendor pom description JCL 1.1.1 implemented over SLF4J Medium
Vendor pom parent-groupid org.slf4j Medium
Vendor pom groupid slf4j Highest
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Vendor Manifest bundle-symbolicname jcl.over.slf4j Medium
Vendor manifest Bundle-Description JCL 1.1.1 implemented over SLF4J Medium
Vendor pom name JCL 1.1.1 implemented over SLF4J High
Vendor central groupid org.slf4j Highest
Vendor pom groupid org.slf4j Highest
Vendor file name jcl-over-slf4j High
Vendor pom parent-artifactid slf4j-parent Low
Product Manifest Bundle-Name jcl-over-slf4j Medium
Product pom description JCL 1.1.1 implemented over SLF4J Medium
Product Manifest Implementation-Title jcl-over-slf4j High
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Product pom parent-groupid org.slf4j Low
Product pom parent-artifactid slf4j-parent Medium
Product Manifest bundle-symbolicname jcl.over.slf4j Medium
Product pom url http://www.slf4j.org Medium
Product manifest Bundle-Description JCL 1.1.1 implemented over SLF4J Medium
Product central artifactid jcl-over-slf4j Highest
Product pom name JCL 1.1.1 implemented over SLF4J High
Product pom groupid slf4j Low
Product pom artifactid jcl-over-slf4j Highest
Product file name jcl-over-slf4j High
Version central version 1.7.18 Highest
Version pom version 1.7.18 Highest
Version Manifest Implementation-Version 1.7.18 High
Version file version 1.7.18 Highest
exo.kernel.commons-5.3.x-SNAPSHOT.jar
Description: Implementation of Commons Utils of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.commons/5.3.x-SNAPSHOT/exo.kernel.commons-5.3.x-SNAPSHOT.jar
MD5: e45922985af7344ecbcca4bae3fc09ab
SHA1: c338e8e2fb4598959349acdf407306be46246113
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor file name exo.kernel.commons High
Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium
Vendor pom parent-groupid org.exoplatform.kernel Medium
Vendor pom name eXo PLF:: Kernel :: Commons Utils High
Vendor pom artifactid exo.kernel.commons Low
Vendor pom groupid org.exoplatform.kernel Highest
Vendor pom groupid exoplatform.kernel Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-artifactid kernel-parent Low
Vendor pom description Implementation of Commons Utils of Exoplatform SAS 'eXo Kernel' project. Medium
Product file name exo.kernel.commons High
Product Manifest specification-title exo-kernel Medium
Product pom name eXo PLF:: Kernel :: Commons Utils High
Product pom parent-artifactid kernel-parent Medium
Product Manifest Implementation-Title eXo PLF:: Kernel :: Commons Utils High
Product pom parent-groupid org.exoplatform.kernel Low
Product pom artifactid exo.kernel.commons Highest
Product pom groupid exoplatform.kernel Low
Product pom description Implementation of Commons Utils of Exoplatform SAS 'eXo Kernel' project. Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.commons:5.3.x-SNAPSHOT
Confidence :High
commons-beanutils-1.8.3.jar
Description: BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-beanutils/commons-beanutils/1.8.3/commons-beanutils-1.8.3.jar
MD5: b45be74134796c89db7126083129532f
SHA1: 686ef3410bcf4ab8ce7fd0b899e832aaba5facf7
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Commons BeanUtils High
Vendor pom description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium
Vendor file name commons-beanutils High
Vendor central groupid commons-beanutils Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom parent-artifactid commons-parent Low
Vendor pom url http://commons.apache.org/beanutils/ Highest
Vendor pom artifactid commons-beanutils Low
Vendor Manifest bundle-symbolicname org.apache.commons.beanutils Medium
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor manifest Bundle-Description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom groupid commons-beanutils Highest
Vendor Manifest bundle-docurl http://commons.apache.org/beanutils/ Low
Product pom name Commons BeanUtils High
Product pom description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium
Product file name commons-beanutils High
Product Manifest Bundle-Name Commons BeanUtils Medium
Product pom parent-artifactid commons-parent Medium
Product pom artifactid commons-beanutils Highest
Product pom url http://commons.apache.org/beanutils/ Medium
Product Manifest Implementation-Title Commons BeanUtils High
Product central artifactid commons-beanutils Highest
Product pom parent-groupid org.apache.commons Low
Product Manifest bundle-symbolicname org.apache.commons.beanutils Medium
Product Manifest specification-title Commons BeanUtils Medium
Product manifest Bundle-Description BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection. Medium
Product pom groupid commons-beanutils Low
Product Manifest bundle-docurl http://commons.apache.org/beanutils/ Low
Version Manifest Implementation-Version 1.8.3 High
Version central version 1.8.3 Highest
Version pom version 1.8.3 Highest
Version file version 1.8.3 Highest
Published Vulnerabilities
CVE-2014-0114 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Vulnerable Software & Versions: (show all )
wci-wci-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/wci/wci-wci/5.3.x-SNAPSHOT/wci-wci-5.3.x-SNAPSHOT.jar
MD5: 2ab001252fa543ff2b30839d5d8b60ec
SHA1: 70f414374362f77fa7ec7a35797e32395bbf36ee
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid org.exoplatform.gatein.wci Medium
Vendor pom groupid org.exoplatform.gatein.wci Highest
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor pom groupid exoplatform.gatein.wci Highest
Vendor Manifest os-name Linux Medium
Vendor file name wci-wci High
Vendor Manifest implementation-url www.gatein.org/wci-parent/wci-wci/ Low
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor pom parent-artifactid wci-parent Low
Vendor Manifest build-timestamp Thu, 23 May 2019 09:57:20 +0000 Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.wci Medium
Vendor pom artifactid wci-wci Low
Vendor pom name GateIn - Web Container Integration component (wci) High
Product file name wci-wci High
Product pom groupid exoplatform.gatein.wci Low
Product Manifest implementation-url www.gatein.org/wci-parent/wci-wci/ Low
Product pom artifactid wci-wci Highest
Product Manifest Implementation-Title GateIn - Web Container Integration component (wci) High
Product Manifest specification-title GateIn - Web Container Integration component (wci) Medium
Product pom parent-groupid org.exoplatform.gatein.wci Low
Product Manifest build-timestamp Thu, 23 May 2019 09:57:20 +0000 Low
Product pom parent-artifactid wci-parent Medium
Product Manifest os-name Linux Medium
Product pom name GateIn - Web Container Integration component (wci) High
Version file version 5.3 Highest
Version pom version 5.3.x-20190523.095728-1 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.gatein.wci:wci-wci:5.3.x-SNAPSHOT
Confidence :High
jibx-run-1.2.6.jar
Description: JiBX runtime code
License:
http://jibx.sourceforge.net/jibx-license.html
File Path: /home/ciagent/.m2/repository/org/jibx/jibx-run/1.2.6/jibx-run-1.2.6.jar
MD5: 4ef53e4279c8440aff2d16c0af024231
SHA1: 544f3ac7887d7eed20ca0420ee1963df6c7ecebb
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-symbolicname jibx-run Medium
Vendor pom name jibx-run - JiBX runtime High
Vendor pom artifactid jibx-run Low
Vendor file name jibx-run High
Vendor pom groupid jibx Highest
Vendor pom description JiBX runtime code Medium
Vendor pom groupid org.jibx Highest
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Vendor central groupid org.jibx Highest
Vendor Manifest bundle-docurl http://www.jibx.org Low
Vendor pom parent-artifactid main-reactor Low
Vendor manifest Bundle-Description JiBX runtime code Medium
Vendor pom parent-groupid org.jibx.config Medium
Product Manifest bundle-symbolicname jibx-run Medium
Product Manifest Bundle-Name jibx-run - JiBX runtime Medium
Product pom name jibx-run - JiBX runtime High
Product pom parent-artifactid main-reactor Medium
Product pom parent-groupid org.jibx.config Low
Product file name jibx-run High
Product pom description JiBX runtime code Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Product Manifest bundle-docurl http://www.jibx.org Low
Product manifest Bundle-Description JiBX runtime code Medium
Product central artifactid jibx-run Highest
Product pom artifactid jibx-run Highest
Product pom groupid jibx Low
Version central version 1.2.6 Highest
Version pom version 1.2.6 Highest
Version file version 1.2.6 Highest
javax.inject-1.jar
Description: The javax.inject API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description The javax.inject API Medium
Vendor pom name javax.inject High
Vendor pom artifactid javax.inject Low
Vendor pom groupid javax.inject Highest
Vendor file name javax.inject-1 High
Vendor central groupid javax.inject Highest
Vendor pom url http://code.google.com/p/atinject/ Highest
Vendor jar package name javax Low
Vendor jar package name inject Low
Product pom description The javax.inject API Medium
Product central artifactid javax.inject Highest
Product pom name javax.inject High
Product file name javax.inject-1 High
Product pom url http://code.google.com/p/atinject/ Medium
Product pom groupid javax.inject Low
Product pom artifactid javax.inject Highest
Product jar package name inject Low
Version pom version 1 Highest
Version file version 1 Medium
Version central version 1 Highest
cdi-api-1.0-SP4.jar
Description: APIs for JSR-299: Contexts and Dependency Injection for Java EE
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/javax/enterprise/cdi-api/1.0-SP4/cdi-api-1.0-SP4.jar
MD5: 6c1e2b4036d64b6ba1a1136a00c7cdaa
SHA1: 6e38490033eb8b36c4cf1f7605163424a574dcf0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid org.jboss.weld Medium
Vendor pom artifactid cdi-api Low
Vendor central groupid javax.enterprise Highest
Vendor pom parent-artifactid weld-parent Low
Vendor pom groupid javax.enterprise Highest
Vendor Manifest specification-vendor Seam Framework Low
Vendor pom url http://www.seamframework.org/Weld Highest
Vendor Manifest Implementation-Vendor Seam Framework High
Vendor Manifest implementation-url http://www.seamframework.org/Weld Low
Vendor pom organization name Seam Framework High
Vendor file name cdi-api High
Vendor pom name CDI APIs High
Vendor pom organization url http://seamframework.org Medium
Vendor pom description APIs for JSR-299: Contexts and Dependency Injection for Java EE Medium
Product pom organization name Seam Framework Low
Product Manifest specification-title CDI APIs Medium
Product pom url http://www.seamframework.org/Weld Medium
Product central artifactid cdi-api Highest
Product pom parent-artifactid weld-parent Medium
Product Manifest implementation-url http://www.seamframework.org/Weld Low
Product pom groupid javax.enterprise Low
Product Manifest Implementation-Title CDI APIs High
Product pom organization url http://seamframework.org Low
Product pom artifactid cdi-api Highest
Product file name cdi-api High
Product pom name CDI APIs High
Product pom parent-groupid org.jboss.weld Low
Product pom description APIs for JSR-299: Contexts and Dependency Injection for Java EE Medium
Version pom version 1.0-SP4 Highest
Version central version 1.0-SP4 Highest
Version file version 1.0.sp4 Highest
exo.kernel.container-5.3.x-SNAPSHOT.jar
Description: Implementation of Container for Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.container/5.3.x-SNAPSHOT/exo.kernel.container-5.3.x-SNAPSHOT.jar
MD5: e3a9fd28ca075c2222bbeed39e55297d
SHA1: 6a171b6b0e06e09151f08de470d69b3b5358489a
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom description Implementation of Container for Exoplatform SAS 'eXo Kernel' project. Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium
Vendor pom parent-groupid org.exoplatform.kernel Medium
Vendor pom groupid org.exoplatform.kernel Highest
Vendor pom artifactid exo.kernel.container Low
Vendor pom groupid exoplatform.kernel Highest
Vendor pom name eXo PLF:: Kernel :: Container High
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-artifactid kernel-parent Low
Vendor file name exo.kernel.container High
Product Manifest Implementation-Title eXo PLF:: Kernel :: Container High
Product pom description Implementation of Container for Exoplatform SAS 'eXo Kernel' project. Medium
Product Manifest specification-title exo-kernel Medium
Product pom parent-artifactid kernel-parent Medium
Product pom name eXo PLF:: Kernel :: Container High
Product pom parent-groupid org.exoplatform.kernel Low
Product pom groupid exoplatform.kernel Low
Product pom artifactid exo.kernel.container Highest
Product file name exo.kernel.container High
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.container:5.3.x-SNAPSHOT
Confidence :High
pc-api-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-api/5.3.x-SNAPSHOT/pc-api-5.3.x-SNAPSHOT.jar
MD5: e995d3069d7ca3308034dcb2ccd06d09
SHA1: 7c15dad670317a24d7e12ff353aa252eb170165b
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid pc-api Low
Vendor pom name GateIn - Portlet Container (api) High
Vendor file name pc-api High
Vendor pom parent-groupid org.exoplatform.gatein.pc Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Vendor Manifest specification-vendor GateIn Low
Vendor pom parent-artifactid pc-parent Low
Vendor pom groupid org.exoplatform.gatein.pc Highest
Vendor Manifest os-name Linux Medium
Vendor Manifest Implementation-Vendor GateIn High
Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-api Low
Vendor pom groupid exoplatform.gatein.pc Highest
Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium
Product pom name GateIn - Portlet Container (api) High
Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-api Low
Product pom groupid exoplatform.gatein.pc Low
Product pom artifactid pc-api Highest
Product file name pc-api High
Product pom parent-artifactid pc-parent Medium
Product Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Product Manifest specification-title GateIn - Portlet Container (api) Medium
Product Manifest os-name Linux Medium
Product Manifest Implementation-Title GateIn - Portlet Container (api) High
Product pom parent-groupid org.exoplatform.gatein.pc Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.gatein.pc:pc-api:5.3.x-SNAPSHOT
Confidence :High
jsr250-api-1.0.jar
Description: JSR-250 Reference Implementation by Glassfish
License:
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html
File Path: /home/ciagent/.m2/repository/javax/annotation/jsr250-api/1.0/jsr250-api-1.0.jar
MD5: 4cd56b2e4977e541186de69f5126b4a6
SHA1: 5025422767732a1ab45d93abfea846513d742dcf
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description JSR-250 Reference Implementation by Glassfish Medium
Vendor pom name JSR-250 Common Annotations for the JavaTM Platform High
Vendor jar package name annotation Low
Vendor file name jsr250-api High
Vendor pom url http://jcp.org/aboutJava/communityprocess/final/jsr250/index.html Highest
Vendor central groupid javax.annotation Highest
Vendor pom groupid javax.annotation Highest
Vendor pom artifactid jsr250-api Low
Vendor jar package name javax Low
Product pom description JSR-250 Reference Implementation by Glassfish Medium
Product pom name JSR-250 Common Annotations for the JavaTM Platform High
Product central artifactid jsr250-api Highest
Product pom artifactid jsr250-api Highest
Product pom groupid javax.annotation Low
Product jar package name annotation Low
Product pom url http://jcp.org/aboutJava/communityprocess/final/jsr250/index.html Medium
Product file name jsr250-api High
Version file version 1.0 Highest
Version central version 1.0 Highest
Version pom version 1.0 Highest
jsr311-api-1.1.1.jar
License:
CDDL License
: http://www.opensource.org/licenses/cddl1.php
File Path: /home/ciagent/.m2/repository/javax/ws/rs/jsr311-api/1.1.1/jsr311-api-1.1.1.jar
MD5: c9803468299ec255c047a280ddec510f
SHA1: 59033da2a1afd56af1ac576750a8d0b1830d59e6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest extension-name javax.ws.rs Medium
Vendor pom organization name Sun Microsystems, Inc High
Vendor pom url https://jsr311.dev.java.net Highest
Vendor central groupid javax.ws.rs Highest
Vendor Manifest specification-vendor Sun Microsystems, Inc. Low
Vendor pom name jsr311-api High
Vendor Manifest bundle-docurl http://www.sun.com/ Low
Vendor pom groupid javax.ws.rs Highest
Vendor file name jsr311-api High
Vendor Manifest bundle-symbolicname javax.ws.rs.jsr311-api Medium
Vendor pom organization url http://www.sun.com/ Medium
Vendor pom artifactid jsr311-api Low
Product Manifest extension-name javax.ws.rs Medium
Product Manifest specification-title JAX-RS: Java API for RESTful Web Services Medium
Product Manifest Bundle-Name jsr311-api Medium
Product pom name jsr311-api High
Product Manifest bundle-docurl http://www.sun.com/ Low
Product pom organization url http://www.sun.com/ Low
Product pom artifactid jsr311-api Highest
Product pom organization name Sun Microsystems, Inc Low
Product file name jsr311-api High
Product pom url https://jsr311.dev.java.net Medium
Product central artifactid jsr311-api Highest
Product Manifest bundle-symbolicname javax.ws.rs.jsr311-api Medium
Product pom groupid javax.ws.rs Low
Version pom version 1.1.1 Highest
Version central version 1.1.1 Highest
Version file version 1.1.1 Highest
exo.ws.commons-5.3.x-SNAPSHOT.jar
Description: Implementation of Commons Utils for Exoplatform SAS 'Web Services' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.commons/5.3.x-SNAPSHOT/exo.ws.commons-5.3.x-SNAPSHOT.jar
MD5: 916508b41039c72e9c729da2a0093689
SHA1: e3f538d0cc5bcf6360c9e00a0a4a4faabaf4ec6f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name exo.ws.commons High
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom parent-artifactid ws-parent Low
Vendor pom groupid exoplatform.ws Highest
Vendor pom groupid org.exoplatform.ws Highest
Vendor Manifest Implementation-Vendor-Id org.exoplatform.ws Medium
Vendor pom name eXo PLF:: WS :: Commons Utils High
Vendor pom parent-groupid org.exoplatform.ws Medium
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom artifactid exo.ws.commons Low
Vendor pom description Implementation of Commons Utils for Exoplatform SAS 'Web Services' project. Medium
Product file name exo.ws.commons High
Product pom parent-groupid org.exoplatform.ws Low
Product Manifest specification-title exo-ws Medium
Product pom groupid exoplatform.ws Low
Product pom name eXo PLF:: WS :: Commons Utils High
Product pom parent-artifactid ws-parent Medium
Product pom artifactid exo.ws.commons Highest
Product Manifest Implementation-Title eXo PLF:: WS :: Commons Utils High
Product pom description Implementation of Commons Utils for Exoplatform SAS 'Web Services' project. Medium
Version pom version 5.3.x-20190523.140736-3 Highest
Version file version 5.3 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
cpe: cpe:/a:ws_project:ws:5.3.20190523
Confidence :Low
suppress
maven: org.exoplatform.ws:exo.ws.commons:5.3.x-SNAPSHOT
Confidence :High
bayeux-api-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/bayeux-api/3.0.8/bayeux-api-3.0.8.jar
MD5: a09842b7f274cefffa408299b5fc8dd0
SHA1: d5aceb0e7fef4a140f7e95be48338b97723d3163
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor pom name CometD :: Bayeux API High
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/bayeux-api Low
Vendor Manifest bundle-symbolicname bayeux-api Medium
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom artifactid bayeux-api Low
Vendor pom parent-artifactid cometd-java Low
Vendor file name bayeux-api High
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product central artifactid bayeux-api Highest
Product Manifest Bundle-Name CometD :: Bayeux API Medium
Product pom name CometD :: Bayeux API High
Product pom groupid cometd.java Low
Product pom parent-groupid org.cometd.java Low
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/bayeux-api Low
Product Manifest bundle-symbolicname bayeux-api Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product file name bayeux-api High
Product pom parent-artifactid cometd-java Medium
Product pom artifactid bayeux-api Highest
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-common-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-common/3.0.8/cometd-java-common-3.0.8.jar
MD5: 70c7cc13ecc20634a6b357e33134d551
SHA1: 5e2134a1b3bc6e03b7e1666a74e9993d0bb52a7d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor pom name CometD :: Java :: Bayeux Common High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom parent-artifactid cometd-java Low
Vendor pom artifactid cometd-java-common Low
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-common Low
Vendor Manifest bundle-symbolicname cometd-java-common Medium
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Vendor file name cometd-java-common High
Product Manifest bundle-docurl http://docs.cometd.org Low
Product central artifactid cometd-java-common Highest
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product pom groupid cometd.java Low
Product pom parent-groupid org.cometd.java Low
Product Manifest Bundle-Name CometD :: Java :: Bayeux Common Medium
Product pom name CometD :: Java :: Bayeux Common High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-common Low
Product Manifest bundle-symbolicname cometd-java-common Medium
Product file name cometd-java-common High
Product pom parent-artifactid cometd-java Medium
Product pom artifactid cometd-java-common Highest
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-websocket-javax-server-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-javax-server/3.0.8/cometd-java-websocket-javax-server-3.0.8.jar
MD5: afa5e80138d48292a6f93b708257d2fc
SHA1: 353860f809886a58c181dd9e273ee7b79e133277
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name cometd-java-websocket-javax-server High
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-javax-server Low
Vendor Manifest bundle-symbolicname cometd-java-websocket-javax-server Medium
Vendor pom artifactid cometd-java-websocket-javax-server Low
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom parent-artifactid cometd-java-websocket Low
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Vendor pom name CometD :: Java :: WebSocket :: JSR 356 Server High
Product file name cometd-java-websocket-javax-server High
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product pom artifactid cometd-java-websocket-javax-server Highest
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-javax-server Low
Product pom groupid cometd.java Low
Product central artifactid cometd-java-websocket-javax-server Highest
Product Manifest bundle-symbolicname cometd-java-websocket-javax-server Medium
Product pom parent-artifactid cometd-java-websocket Medium
Product pom parent-groupid org.cometd.java Low
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product Manifest Bundle-Name CometD :: Java :: WebSocket :: JSR 356 Server Medium
Product pom name CometD :: Java :: WebSocket :: JSR 356 Server High
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-websocket-common-server-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-common-server/3.0.8/cometd-java-websocket-common-server-3.0.8.jar
MD5: 5772b2360cec4ff610e62151fb4deb62
SHA1: 61538a1231b700bf045fa197514f63509960985e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid cometd-java-websocket-common-server Low
Vendor Manifest bundle-symbolicname cometd-java-websocket-common-server Medium
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor file name cometd-java-websocket-common-server High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom parent-artifactid cometd-java-websocket Low
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-common-server Low
Vendor pom name CometD :: Java :: WebSocket :: Common Server High
Product Manifest bundle-symbolicname cometd-java-websocket-common-server Medium
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product file name cometd-java-websocket-common-server High
Product pom groupid cometd.java Low
Product pom artifactid cometd-java-websocket-common-server Highest
Product pom parent-artifactid cometd-java-websocket Medium
Product pom parent-groupid org.cometd.java Low
Product central artifactid cometd-java-websocket-common-server Highest
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-common-server Low
Product Manifest Bundle-Name CometD :: Java :: WebSocket :: Common Server Medium
Product pom name CometD :: Java :: WebSocket :: Common Server High
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-annotations-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-annotations/3.0.8/cometd-java-annotations-3.0.8.jar
MD5: 98b60697675562cf957655c3239a1ad3
SHA1: 5b56875b2ac024b5666633596abb90702ec35e81
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name cometd-java-annotations High
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor pom name CometD :: Java :: Annotations High
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-annotations Low
Vendor Manifest bundle-symbolicname cometd-java-annotations Medium
Vendor pom artifactid cometd-java-annotations Low
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom parent-artifactid cometd-java Low
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Product file name cometd-java-annotations High
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product pom name CometD :: Java :: Annotations High
Product pom artifactid cometd-java-annotations Highest
Product Manifest Bundle-Name CometD :: Java :: Annotations Medium
Product pom groupid cometd.java Low
Product central artifactid cometd-java-annotations Highest
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-annotations Low
Product Manifest bundle-symbolicname cometd-java-annotations Medium
Product pom parent-groupid org.cometd.java Low
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product pom parent-artifactid cometd-java Medium
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
jetty-io-9.2.14.v20151106.jar
Description: Administrative parent pom for Jetty modules
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-io/9.2.14.v20151106/jetty-io-9.2.14.v20151106.jar
MD5: 94d0e857144c7615b6fd65019cd32b59
SHA1: dfa4137371a3f08769820138ca1a2184dacda267
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-copyright Copyright (c) 2008-2014 Mort Bay Consulting Pty. Ltd. Low
Vendor Manifest bundle-docurl http://www.eclipse.org/jetty Low
Vendor manifest Bundle-Description Administrative parent pom for Jetty modules Medium
Vendor pom groupid eclipse.jetty Highest
Vendor pom artifactid jetty-io Low
Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low
Vendor Manifest url http://www.eclipse.org/jetty Low
Vendor pom groupid org.eclipse.jetty Highest
Vendor file name jetty-io High
Vendor Manifest bundle-symbolicname org.eclipse.jetty.io Medium
Vendor pom name Jetty :: IO Utility High
Vendor pom parent-groupid org.eclipse.jetty Medium
Vendor central groupid org.eclipse.jetty Highest
Vendor pom parent-artifactid jetty-project Low
Vendor Manifest Implementation-Vendor Eclipse.org - Jetty High
Vendor pom url http://www.eclipse.org/jetty Highest
Product Manifest bundle-copyright Copyright (c) 2008-2014 Mort Bay Consulting Pty. Ltd. Low
Product pom url http://www.eclipse.org/jetty Medium
Product Manifest bundle-docurl http://www.eclipse.org/jetty Low
Product manifest Bundle-Description Administrative parent pom for Jetty modules Medium
Product pom artifactid jetty-io Highest
Product Manifest Bundle-Name Jetty :: IO Utility Medium
Product central artifactid jetty-io Highest
Product pom parent-groupid org.eclipse.jetty Low
Product Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low
Product Manifest url http://www.eclipse.org/jetty Low
Product pom parent-artifactid jetty-project Medium
Product file name jetty-io High
Product Manifest bundle-symbolicname org.eclipse.jetty.io Medium
Product pom name Jetty :: IO Utility High
Product pom groupid eclipse.jetty Low
Version file version 9.2.14.v20151106 Highest
Version central version 9.2.14.v20151106 Highest
Version pom version 9.2.14.v20151106 Highest
Version Manifest Implementation-Version 9.2.14.v20151106 High
cometd-java-client-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-client/3.0.8/cometd-java-client-3.0.8.jar
MD5: 24f1367fb4d96fe70a3f07a1f48e447e
SHA1: 826d4ae9402e7c48cc98fe287389788134e4986f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-client Low
Vendor pom name CometD :: Java :: Bayeux Client High
Vendor file name cometd-java-client High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom parent-artifactid cometd-java Low
Vendor pom parent-groupid org.cometd.java Medium
Vendor Manifest bundle-symbolicname cometd-java-client Medium
Vendor pom groupid org.cometd.java Highest
Vendor pom artifactid cometd-java-client Low
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product Manifest Bundle-Name CometD :: Java :: Bayeux Client Medium
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-client Low
Product pom name CometD :: Java :: Bayeux Client High
Product pom groupid cometd.java Low
Product pom parent-groupid org.cometd.java Low
Product pom artifactid cometd-java-client Highest
Product file name cometd-java-client High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product central artifactid cometd-java-client Highest
Product Manifest bundle-symbolicname cometd-java-client Medium
Product pom parent-artifactid cometd-java Medium
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-websocket-common-client-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-common-client/3.0.8/cometd-java-websocket-common-client-3.0.8.jar
MD5: c17616c290c54ffc4a70dda2b901919a
SHA1: 8b75f11de5bba306d0bcb20a6c1bed89675579cd
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-common-client Low
Vendor file name cometd-java-websocket-common-client High
Vendor pom name CometD :: Java :: WebSocket :: Common Client High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom artifactid cometd-java-websocket-common-client Low
Vendor pom parent-artifactid cometd-java-websocket Low
Vendor Manifest bundle-symbolicname cometd-java-websocket-common-client Medium
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Product Manifest bundle-docurl http://docs.cometd.org Low
Product central artifactid cometd-java-websocket-common-client Highest
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-common-client Low
Product pom groupid cometd.java Low
Product file name cometd-java-websocket-common-client High
Product pom parent-artifactid cometd-java-websocket Medium
Product pom artifactid cometd-java-websocket-common-client Highest
Product pom parent-groupid org.cometd.java Low
Product pom name CometD :: Java :: WebSocket :: Common Client High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product Manifest Bundle-Name CometD :: Java :: WebSocket :: Common Client Medium
Product Manifest bundle-symbolicname cometd-java-websocket-common-client Medium
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-websocket-javax-client-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-websocket-javax-client/3.0.8/cometd-java-websocket-javax-client-3.0.8.jar
MD5: 433dd449f689697bbe1a75b0ed2788f8
SHA1: b44bcf098667f0112301d75f73adb5ba3295699d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor Manifest bundle-symbolicname cometd-java-websocket-javax-client Medium
Vendor pom artifactid cometd-java-websocket-javax-client Low
Vendor file name cometd-java-websocket-javax-client High
Vendor pom parent-artifactid cometd-java-websocket Low
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-javax-client Low
Vendor pom name CometD :: Java :: WebSocket :: JSR 356 Client High
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product pom artifactid cometd-java-websocket-javax-client Highest
Product pom groupid cometd.java Low
Product pom parent-artifactid cometd-java-websocket Medium
Product central artifactid cometd-java-websocket-javax-client Highest
Product pom parent-groupid org.cometd.java Low
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product Manifest bundle-symbolicname cometd-java-websocket-javax-client Medium
Product file name cometd-java-websocket-javax-client High
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-websocket/cometd-java-websocket-javax-client Low
Product pom name CometD :: Java :: WebSocket :: JSR 356 Client High
Product Manifest Bundle-Name CometD :: Java :: WebSocket :: JSR 356 Client Medium
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
cometd-java-oort-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-oort/3.0.8/cometd-java-oort-3.0.8.jar
MD5: 62dbbecedab27927495fc9c9e0b70505
SHA1: a72695546e010c250ba65519fc91867b208fc8f9
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-oort Low
Vendor file name cometd-java-oort High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom parent-artifactid cometd-java Low
Vendor pom artifactid cometd-java-oort Low
Vendor pom parent-groupid org.cometd.java Medium
Vendor pom groupid org.cometd.java Highest
Vendor Manifest bundle-symbolicname cometd-java-oort Medium
Vendor pom name CometD :: Java :: Oort High
Product central artifactid cometd-java-oort Highest
Product Manifest bundle-docurl http://docs.cometd.org Low
Product Manifest Bundle-Name CometD :: Java :: Oort Medium
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-oort Low
Product file name cometd-java-oort High
Product pom groupid cometd.java Low
Product pom artifactid cometd-java-oort Highest
Product pom parent-groupid org.cometd.java Low
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product pom parent-artifactid cometd-java Medium
Product Manifest bundle-symbolicname cometd-java-oort Medium
Product pom name CometD :: Java :: Oort High
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
jetty-jmx-9.2.14.v20151106.jar
Description: JMX management artifact for jetty.
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-jmx/9.2.14.v20151106/jetty-jmx-9.2.14.v20151106.jar
MD5: 5eccc25d22921cb4787812d0687a2978
SHA1: 617edc5e966b4149737811ef8b289cd94b831bab
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-copyright Copyright (c) 2008-2014 Mort Bay Consulting Pty. Ltd. Low
Vendor Manifest bundle-docurl http://www.eclipse.org/jetty Low
Vendor file name jetty-jmx High
Vendor pom name Jetty :: JMX Management High
Vendor pom artifactid jetty-jmx Low
Vendor manifest Bundle-Description JMX management artifact for jetty. Medium
Vendor pom groupid eclipse.jetty Highest
Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low
Vendor Manifest url http://www.eclipse.org/jetty Low
Vendor pom groupid org.eclipse.jetty Highest
Vendor Manifest bundle-symbolicname org.eclipse.jetty.jmx Medium
Vendor pom parent-groupid org.eclipse.jetty Medium
Vendor central groupid org.eclipse.jetty Highest
Vendor pom parent-artifactid jetty-project Low
Vendor Manifest Implementation-Vendor Eclipse.org - Jetty High
Vendor pom description JMX management artifact for jetty. Medium
Vendor pom url http://www.eclipse.org/jetty Highest
Product Manifest bundle-copyright Copyright (c) 2008-2014 Mort Bay Consulting Pty. Ltd. Low
Product Manifest Bundle-Name Jetty :: JMX Management Medium
Product pom url http://www.eclipse.org/jetty Medium
Product Manifest bundle-docurl http://www.eclipse.org/jetty Low
Product pom artifactid jetty-jmx Highest
Product file name jetty-jmx High
Product pom name Jetty :: JMX Management High
Product manifest Bundle-Description JMX management artifact for jetty. Medium
Product central artifactid jetty-jmx Highest
Product pom parent-groupid org.eclipse.jetty Low
Product Manifest bundle-requiredexecutionenvironment JavaSE-1.7 Low
Product Manifest url http://www.eclipse.org/jetty Low
Product pom parent-artifactid jetty-project Medium
Product Manifest bundle-symbolicname org.eclipse.jetty.jmx Medium
Product pom groupid eclipse.jetty Low
Product pom description JMX management artifact for jetty. Medium
Version file version 9.2.14.v20151106 Highest
Version central version 9.2.14.v20151106 Highest
Version pom version 9.2.14.v20151106 Highest
Version Manifest Implementation-Version 9.2.14.v20151106 High
Related Dependencies
jetty-util-ajax-9.2.14.v20151106.jar
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-util-ajax/9.2.14.v20151106/jetty-util-ajax-9.2.14.v20151106.jar
SHA1: 13470555681de54a10cfed3ab15b1554765d1171
MD5: 1623fc2d77b1bd864a2416e2da15cd9b
maven: org.eclipse.jetty:jetty-util-ajax:9.2.14.v20151106 ✓
jetty-http-9.2.14.v20151106.jar
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-http/9.2.14.v20151106/jetty-http-9.2.14.v20151106.jar
SHA1: 699ad1f2fa6fb0717e1b308a8c9e1b8c69d81ef6
MD5: 2e42ff59b2a5e8525f0fa1b55351d161
maven: org.eclipse.jetty:jetty-http:9.2.14.v20151106 ✓
jetty-client-9.2.14.v20151106.jar
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-client/9.2.14.v20151106/jetty-client-9.2.14.v20151106.jar
SHA1: d02985c3a5bd974dacbb4c3d7cf71169135a8e7a
MD5: c400f74ab61fc17fafd19144b548bede
maven: org.eclipse.jetty:jetty-client:9.2.14.v20151106 ✓
jetty-util-9.2.14.v20151106.jar
File Path: /home/ciagent/.m2/repository/org/eclipse/jetty/jetty-util/9.2.14.v20151106/jetty-util-9.2.14.v20151106.jar
SHA1: 0057e00b912ae0c35859ac81594a996007706a0b
MD5: 15eae2dc1689fa8c72652b156d2619d3
maven: org.eclipse.jetty:jetty-util:9.2.14.v20151106 ✓
Published Vulnerabilities
CVE-2017-7656 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-284 Improper Access Control
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Vulnerable Software & Versions: (show all )
CVE-2017-7657 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-190 Integer Overflow or Wraparound
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Vulnerable Software & Versions: (show all )
CVE-2017-7658 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-19 Data Handling
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Vulnerable Software & Versions: (show all )
CVE-2017-9735 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Vulnerable Software & Versions:
cometd-java-server-3.0.8.jar
Description: The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.opensource.org/licenses/bsd-license.html, http://opensource-definition.org/licenses/afl-2.1.html
File Path: /home/ciagent/.m2/repository/org/cometd/java/cometd-java-server/3.0.8/cometd-java-server-3.0.8.jar
MD5: c55eb617762fad72683da9de856e008c
SHA1: 11d535c657bdb491abc2ccd820118f9d6a8f44e0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid cometd.java Highest
Vendor Manifest bundle-docurl http://docs.cometd.org Low
Vendor central groupid org.cometd.java Highest
Vendor manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Vendor file name cometd-java-server High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Vendor pom artifactid cometd-java-server Low
Vendor pom parent-artifactid cometd-java Low
Vendor pom name CometD :: Java :: Bayeux Server High
Vendor Manifest bundle-symbolicname cometd-java-server Medium
Vendor pom parent-groupid org.cometd.java Medium
Vendor Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-server Low
Vendor pom groupid org.cometd.java Highest
Product central artifactid cometd-java-server Highest
Product Manifest bundle-docurl http://docs.cometd.org Low
Product manifest Bundle-Description The CometD project is a scalable web messaging bus that uses WebSocketand HTTP AJAX push technology patterns known as "Comet" techniques Low
Product pom groupid cometd.java Low
Product pom artifactid cometd-java-server Highest
Product file name cometd-java-server High
Product pom parent-groupid org.cometd.java Low
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low
Product pom name CometD :: Java :: Bayeux Server High
Product Manifest bundle-symbolicname cometd-java-server Medium
Product Manifest bundle-contactaddress http://cometd.org/cometd-java/cometd-java-server Low
Product pom parent-artifactid cometd-java Medium
Product Manifest Bundle-Name CometD :: Java :: Bayeux Server Medium
Version central version 3.0.8 Highest
Version file version 3.0.8 Highest
Version pom version 3.0.8 Highest
commons-comet-service-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-comet-service/5.3.x-SNAPSHOT/commons-comet-service-5.3.x-SNAPSHOT.jar
MD5: 7c020a92d3114dc217efa8f161b3738a
SHA1: 24540f023fd116f3ccf2ef430b9dffb38a1b90ed
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom parent-groupid org.exoplatform.commons Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.commons Medium
Vendor Manifest date 2019-05-24T09:54:58Z Low
Vendor pom parent-artifactid commons Low
Vendor pom name eXo PLF:: Commons - Comet Services High
Vendor pom artifactid commons-comet-service Low
Vendor pom groupid org.exoplatform.commons Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor Manifest implementation-url https://projects.exoplatform.org/commons/commons-comet-service Low
Vendor file name commons-comet-service High
Vendor pom groupid exoplatform.commons Highest
Product pom artifactid commons-comet-service Highest
Product pom parent-groupid org.exoplatform.commons Low
Product pom parent-artifactid commons Medium
Product pom name eXo PLF:: Commons - Comet Services High
Product pom groupid exoplatform.commons Low
Product Manifest Implementation-Title eXo PLF:: Commons - Comet Services High
Product Manifest implementation-url https://projects.exoplatform.org/commons/commons-comet-service Low
Product file name commons-comet-service High
Product Manifest date 2019-05-24T09:54:58Z Low
Product Manifest specification-title eXo PLF:: Commons - Comet Services Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.commons:commons-comet-service:5.3.x-SNAPSHOT
Confidence :High
commons-fileupload-1.3.3.jar
Description:
The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar
MD5: dd77e787b7b5dc56f6a1cb658716d55d
SHA1: 04ff14d809195b711fd6bcc87e6777f886730ca1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://commons.apache.org/proper/commons-fileupload/ Highest
Vendor Manifest bundle-symbolicname org.apache.commons.fileupload Medium
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom parent-artifactid commons-parent Low
Vendor pom groupid commons-fileupload Highest
Vendor Manifest implementation-build UNKNOWN@r18734e9f77a267ebc82ff2ffce6d96e82a34260f; 2017-06-09 22:59:50+0000 Low
Vendor pom artifactid commons-fileupload Low
Vendor file name commons-fileupload High
Vendor central groupid commons-fileupload Highest
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-fileupload/ Low
Vendor Manifest implementation-url http://commons.apache.org/proper/commons-fileupload/ Low
Vendor manifest Bundle-Description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low
Vendor pom name Apache Commons FileUpload High
Vendor pom description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low
Product Manifest bundle-symbolicname org.apache.commons.fileupload Medium
Product pom parent-artifactid commons-parent Medium
Product Manifest specification-title Apache Commons FileUpload Medium
Product Manifest implementation-build UNKNOWN@r18734e9f77a267ebc82ff2ffce6d96e82a34260f; 2017-06-09 22:59:50+0000 Low
Product file name commons-fileupload High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Product pom parent-groupid org.apache.commons Low
Product pom artifactid commons-fileupload Highest
Product pom groupid commons-fileupload Low
Product pom url http://commons.apache.org/proper/commons-fileupload/ Medium
Product central artifactid commons-fileupload Highest
Product Manifest bundle-docurl http://commons.apache.org/proper/commons-fileupload/ Low
Product Manifest Implementation-Title Apache Commons FileUpload High
Product Manifest implementation-url http://commons.apache.org/proper/commons-fileupload/ Low
Product Manifest Bundle-Name Apache Commons FileUpload Medium
Product manifest Bundle-Description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low
Product pom name Apache Commons FileUpload High
Product pom description The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Low
Version pom version 1.3.3 Highest
Version Manifest Implementation-Version 1.3.3 High
Version file version 1.3.3 Highest
Version central version 1.3.3 Highest
exo.ws.rest.core-5.3.x-SNAPSHOT.jar
Description: Implementation of REST Core for Exoplatform SAS 'Web Services' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.rest.core/5.3.x-SNAPSHOT/exo.ws.rest.core-5.3.x-SNAPSHOT.jar
MD5: 44bf545ee3d289362f22532c0760547b
SHA1: 03ac20ae6703e58212d45e4e153056957e97d413
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom parent-artifactid ws-parent Low
Vendor pom groupid exoplatform.ws Highest
Vendor pom groupid org.exoplatform.ws Highest
Vendor file name exo.ws.rest.core High
Vendor Manifest Implementation-Vendor-Id org.exoplatform.ws Medium
Vendor pom parent-groupid org.exoplatform.ws Medium
Vendor pom artifactid exo.ws.rest.core Low
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom description Implementation of REST Core for Exoplatform SAS 'Web Services' project. Medium
Vendor pom name eXo PLF:: WS :: REST :: Core High
Product pom parent-groupid org.exoplatform.ws Low
Product pom artifactid exo.ws.rest.core Highest
Product file name exo.ws.rest.core High
Product Manifest Implementation-Title eXo PLF:: WS :: REST :: Core High
Product Manifest specification-title exo-ws Medium
Product pom groupid exoplatform.ws Low
Product pom parent-artifactid ws-parent Medium
Product pom description Implementation of REST Core for Exoplatform SAS 'Web Services' project. Medium
Product pom name eXo PLF:: WS :: REST :: Core High
Version file version 5.3 Highest
Version pom version 5.3.x-20190523.140933-3 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
Related Dependencies
exo.ws.frameworks.json-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.frameworks.json/5.3.x-SNAPSHOT/exo.ws.frameworks.json-5.3.x-SNAPSHOT.jar
SHA1: df209c8abb20a199ff8f2565e38bba1377c83823
MD5: c303411215db30445ba0f14bef9d6e66
exo.ws.rest.ext-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/ws/exo.ws.rest.ext/5.3.x-SNAPSHOT/exo.ws.rest.ext-5.3.x-SNAPSHOT.jar
SHA1: 88042104a09fa910f5bb1adb127d1920006a2c70
MD5: a6475d4ab27f39f470a8f262c7d59c56
maven: org.exoplatform.ws:exo.ws.rest.core:5.3.x-SNAPSHOT
Confidence :High
cpe: cpe:/a:ws_project:ws:5.3
Confidence :Low
suppress
aspectjrt-1.8.8.jar
Description: The runtime needed to execute a program using AspectJ
License:
Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/ciagent/.m2/repository/org/aspectj/aspectjrt/1.8.8/aspectjrt-1.8.8.jar
MD5: 2e448cd7ae0bdc357cb2b6e892ba9c9d
SHA1: 7c5b26f24375685e34a50c2d765ebc40a96a5280
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest: org/aspectj/lang/ Implementation-Vendor aspectj.org Medium
Vendor pom name AspectJ runtime High
Vendor pom description The runtime needed to execute a program using AspectJ Medium
Vendor central groupid org.aspectj Highest
Vendor pom url http://www.aspectj.org Highest
Vendor pom artifactid aspectjrt Low
Vendor pom groupid aspectj Highest
Vendor file name aspectjrt High
Vendor pom groupid org.aspectj Highest
Product pom groupid aspectj Low
Product pom name AspectJ runtime High
Product pom description The runtime needed to execute a program using AspectJ Medium
Product pom url http://www.aspectj.org Medium
Product central artifactid aspectjrt Highest
Product manifest: org/aspectj/lang/ Implementation-Title org.aspectj.tools Medium
Product pom artifactid aspectjrt Highest
Product manifest: org/aspectj/lang/ Specification-Title AspectJ Runtime Classes Medium
Product file name aspectjrt High
Version pom version 1.8.8 Highest
Version central version 1.8.8 Highest
Version file version 1.8.8 Highest
hamcrest-core-1.3.jar
Description:
This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations.
File Path: /home/ciagent/.m2/repository/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
MD5: 6393363b47ddcbba82321110c3e07519
SHA1: 42a25dc3219429f0e5d060061f71acb49bf010a0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid hamcrest-parent Low
Vendor pom groupid hamcrest Highest
Vendor pom name Hamcrest Core High
Vendor pom parent-groupid org.hamcrest Medium
Vendor file name hamcrest-core High
Vendor pom groupid org.hamcrest Highest
Vendor Manifest built-date 2012-07-09 19:49:34 Low
Vendor Manifest Implementation-Vendor hamcrest.org High
Vendor central groupid org.hamcrest Highest
Vendor pom artifactid hamcrest-core Low
Vendor pom description This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations. Low
Product pom name Hamcrest Core High
Product central artifactid hamcrest-core Highest
Product pom artifactid hamcrest-core Highest
Product pom parent-groupid org.hamcrest Low
Product pom groupid hamcrest Low
Product file name hamcrest-core High
Product pom parent-artifactid hamcrest-parent Medium
Product Manifest Implementation-Title hamcrest-core High
Product Manifest built-date 2012-07-09 19:49:34 Low
Product pom description This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations. Low
Version pom version 1.3 Highest
Version Manifest Implementation-Version 1.3 High
Version file version 1.3 Highest
Version central version 1.3 Highest
junit-4.12.jar
Description: JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.
License:
Eclipse Public License 1.0: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/ciagent/.m2/repository/junit/junit/4.12/junit-4.12.jar
MD5: 5b38c40c97fbd0adee29f91e60405584
SHA1: 2973d150c0dc1fefe998f834810d68f278ea58ec
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name junit High
Vendor pom organization url http://www.junit.org Medium
Vendor pom description JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck. Medium
Vendor central groupid junit Highest
Vendor pom groupid junit Highest
Vendor Manifest Implementation-Vendor-Id junit Medium
Vendor pom artifactid junit Low
Vendor pom name JUnit High
Vendor pom url http://junit.org Highest
Vendor pom organization name JUnit High
Vendor Manifest Implementation-Vendor JUnit High
Product file name junit High
Product Manifest Implementation-Title JUnit High
Product pom description JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck. Medium
Product pom organization url http://www.junit.org Low
Product central artifactid junit Highest
Product pom organization name JUnit Low
Product pom name JUnit High
Product pom url http://junit.org Medium
Product pom artifactid junit Highest
Product pom groupid junit Low
Version Manifest Implementation-Version 4.12 High
Version file version 4.12 Highest
Version central version 4.12 Highest
Version pom version 4.12 Highest
jmock-1.0.1.jar
File Path: /home/ciagent/.m2/repository/jmock/jmock/1.0.1/jmock-1.0.1.jar
MD5: d45c5ca4c1063d508ca8df00538decc1
SHA1: 87a39d1a62ea94be5453ecdbb97cd81c978622d3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name jmock Low
Vendor jar package name core Low
Vendor pom groupid jmock Highest
Vendor pom artifactid jmock Low
Vendor file name jmock High
Vendor central groupid jmock Highest
Product jar package name core Low
Product central artifactid jmock Highest
Product pom artifactid jmock Highest
Product file name jmock High
Product pom groupid jmock Low
Version pom version 1.0.1 Highest
Version file version 1.0.1 Highest
Version central version 1.0.1 Highest
xpp3-1.1.4c.jar
Description: MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs such as Hotspot in JDK 1.4+.
License:
Indiana University Extreme! Lab Software License, vesion 1.1.1: http://www.extreme.indiana.edu/viewcvs/~checkout~/XPP3/java/LICENSE.txt
Public Domain: http://creativecommons.org/licenses/publicdomain
Apache Software License, version 1.1: http://www.apache.org/licenses/LICENSE-1.1
File Path: /home/ciagent/.m2/repository/xpp3/xpp3/1.1.4c/xpp3-1.1.4c.jar
MD5: 6e3c39f391e4994888b7d0030f775804
SHA1: 9b988ea84b9e4e9f1874e390ce099b8ac12cfff5
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name xmlpull Low
Vendor pom url http://www.extreme.indiana.edu/xgws/xsoap/xpp/mxp1/ Highest
Vendor pom organization name Extreme! Lab, Indiana University High
Vendor pom description MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ... Low
Vendor pom groupid xpp3 Highest
Vendor jar package name builder Low
Vendor central groupid xpp3 Highest
Vendor file name xpp3 High
Vendor pom organization url http://www.extreme.indiana.edu/ Medium
Vendor pom name MXP1: Xml Pull Parser 3rd Edition (XPP3) High
Vendor jar package name v1 Low
Vendor pom artifactid xpp3 Low
Product pom artifactid xpp3 Highest
Product pom url http://www.extreme.indiana.edu/xgws/xsoap/xpp/mxp1/ Medium
Product pom organization name Extreme! Lab, Indiana University Low
Product jar package name builder Low
Product file name xpp3 High
Product pom groupid xpp3 Low
Product pom name MXP1: Xml Pull Parser 3rd Edition (XPP3) High
Product pom description MXP1 is a stable XmlPull parsing engine that is based on ideas from XPP and in particular XPP2 but completely revised and rewritten to take the best advantage of latest JIT JVMs ... Low
Product jar package name v1 Low
Product pom organization url http://www.extreme.indiana.edu/ Low
Product central artifactid xpp3 Highest
Version central version 1.1.4c Highest
Version file version 1.1.4c Highest
Version pom version 1.1.4c Highest
picocontainer-1.1.jar
Description: Please refer to the main website for documentation.
File Path: /home/ciagent/.m2/repository/picocontainer/picocontainer/1.1/picocontainer-1.1.jar
MD5: 98f476491eed3b106b9a015f15bf5fda
SHA1: a2babe80a3af3a3672095341625e4a9ba4278c1b
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://www.picocontainer.org/ Highest
Vendor Manifest extension-name picocontainer Medium
Vendor pom name PicoContainer High
Vendor pom groupid picocontainer Highest
Vendor pom organization name Codehaus High
Vendor Manifest Implementation-Vendor Codehaus High
Vendor pom organization url http://codehaus.org/ Medium
Vendor file name picocontainer High
Vendor central groupid picocontainer Highest
Vendor pom description Please refer to the main website for documentation. Medium
Vendor pom artifactid picocontainer Low
Vendor Manifest specification-vendor Codehaus Low
Product Manifest Implementation-Title org.picocontainer High
Product Manifest extension-name picocontainer Medium
Product pom groupid picocontainer Low
Product pom organization name Codehaus Low
Product pom name PicoContainer High
Product Manifest specification-title Small footprint Dependency Injection container Medium
Product pom artifactid picocontainer Highest
Product pom url http://www.picocontainer.org/ Medium
Product file name picocontainer High
Product pom description Please refer to the main website for documentation. Medium
Product pom organization url http://codehaus.org/ Low
Product central artifactid picocontainer Highest
Version central version 1.1 Highest
Version file version 1.1 Highest
Version Manifest Implementation-Version 1.1 High
Version pom version 1.1 Highest
owasp-java-html-sanitizer-20160413.1.jar
File Path: /home/ciagent/.m2/repository/com/googlecode/owasp-java-html-sanitizer/owasp-java-html-sanitizer/20160413.1/owasp-java-html-sanitizer-20160413.1.jar
MD5: f2dbfedbd7bea844cedc1fc1e95fca80
SHA1: 61780b5d65c39013d733b70b2d2968f72f83aa0a
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid googlecode.owasp-java-html-sanitizer Highest
Vendor jar package name owasp Low
Vendor pom parent-groupid com.googlecode.owasp-java-html-sanitizer Medium
Vendor pom artifactid owasp-java-html-sanitizer Low
Vendor pom parent-artifactid parent Low
Vendor pom groupid com.googlecode.owasp-java-html-sanitizer Highest
Vendor pom name OWASP Java HTML Sanitizer High
Vendor jar package name html Low
Vendor central groupid com.googlecode.owasp-java-html-sanitizer Highest
Vendor file name owasp-java-html-sanitizer High
Product pom parent-groupid com.googlecode.owasp-java-html-sanitizer Low
Product pom groupid googlecode.owasp-java-html-sanitizer Low
Product central artifactid owasp-java-html-sanitizer Highest
Product pom name OWASP Java HTML Sanitizer High
Product jar package name html Low
Product pom parent-artifactid parent Medium
Product pom artifactid owasp-java-html-sanitizer Highest
Product file name owasp-java-html-sanitizer High
Version pom version 20160413.1 Highest
Version central version 20160413.1 Highest
Version file version 20160413.1 Highest
jrcs.diff-0.4.2.jar
File Path: /home/ciagent/.m2/repository/org/suigeneris/jrcs.diff/0.4.2/jrcs.diff-0.4.2.jar
MD5: a05e71b59b7099da7844fd3b5f38e299
SHA1: 6e8eea2281426cd791a64b348c0932c88b966f39
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid suigeneris Highest
Vendor jar package name suigeneris Low
Vendor pom groupid org.suigeneris Highest
Vendor central groupid org.jvnet.hudson Highest
Vendor jar package name jrcs Low
Vendor file name jrcs.diff High
Vendor jar package name diff Low
Vendor pom artifactid jrcs.diff Low
Product pom artifactid jrcs.diff Highest
Product jar package name jrcs Low
Product central artifactid org.suigeneris.jrcs.diff Highest
Product file name jrcs.diff High
Product pom groupid suigeneris Low
Product jar package name diff Low
Version file version 0.4.2 Highest
Version central version 0.4.2 Highest
Version pom version 0.4.2 Highest
ecs-1.4.2.jar
File Path: /home/ciagent/.m2/repository/ecs/ecs/1.4.2/ecs-1.4.2.jar
MD5: 62d53be190ca9cbfe01bec9fc3396934
SHA1: f9bc5fdde56d60876c1785087ce2a301b4e4a676
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name ecs Low
Vendor pom artifactid ecs Low
Vendor pom groupid ecs Highest
Vendor central groupid ecs Highest
Vendor file name ecs High
Vendor jar package name apache Low
Product central artifactid ecs Highest
Product jar package name ecs Low
Product file name ecs High
Product pom artifactid ecs Highest
Product pom groupid ecs Low
Version pom version 1.4.2 Highest
Version file version 1.4.2 Highest
Version central version 1.4.2 Highest
liquibase-core-3.4.2.jar
File Path: /home/ciagent/.m2/repository/org/liquibase/liquibase-core/3.4.2/liquibase-core-3.4.2.jar
MD5: d4ad6d5f7958b69b8fbd01a5564ae45b
SHA1: c91ccf342466857251cf6795b0cecc42509206f2
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid org.liquibase Medium
Vendor central groupid org.liquibase Highest
Vendor pom parent-artifactid liquibase-parent Low
Vendor pom groupid liquibase Highest
Vendor pom name Liquibase Core High
Vendor file name liquibase-core High
Vendor pom groupid org.liquibase Highest
Vendor jar package name liquibase Low
Vendor pom artifactid liquibase-core Low
Product pom artifactid liquibase-core Highest
Product pom parent-artifactid liquibase-parent Medium
Product pom name Liquibase Core High
Product file name liquibase-core High
Product pom parent-groupid org.liquibase Low
Product pom groupid liquibase Low
Product central artifactid liquibase-core Highest
Version central version 3.4.2 Highest
Version file version 3.4.2 Highest
Version pom version 3.4.2 Highest
javassist-3.20.0-GA.jar
Description:
Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation
simple. It is a class library for editing bytecodes in Java.
License:
MPL 1.1: http://www.mozilla.org/MPL/MPL-1.1.html
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Apache License 2.0: http://www.apache.org/licenses/
File Path: /home/ciagent/.m2/repository/org/javassist/javassist/3.20.0-GA/javassist-3.20.0-GA.jar
MD5: a89dd7907d76e061ec2c07e762a74256
SHA1: a9cbcdfb7e9f86fbc74d3afae65f2248bfbf82a0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor Shigeru Chiba, www.javassist.org Low
Vendor manifest Bundle-Description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low
Vendor central groupid org.javassist Highest
Vendor pom groupid org.javassist Highest
Vendor pom groupid javassist Highest
Vendor pom description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low
Vendor file name javassist High
Vendor Manifest bundle-symbolicname javassist Medium
Vendor pom name Javassist High
Vendor pom organization name Shigeru Chiba, www.javassist.org High
Vendor pom artifactid javassist Low
Vendor pom url http://www.javassist.org/ Highest
Product pom groupid javassist Low
Product manifest Bundle-Description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low
Product pom organization name Shigeru Chiba, www.javassist.org Low
Product pom description Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java. Low
Product pom artifactid javassist Highest
Product file name javassist High
Product Manifest specification-title Javassist Medium
Product Manifest bundle-symbolicname javassist Medium
Product pom name Javassist High
Product central artifactid javassist Highest
Product pom url http://www.javassist.org/ Medium
Product Manifest Bundle-Name Javassist Medium
Version file version 3.20.0 Highest
Version central version 3.20.0-GA Highest
Version pom version 3.20.0-GA Highest
hibernate-entitymanager-4.2.21.Final.jar
Description: A module of the Hibernate O/RM project
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/org/hibernate/hibernate-entitymanager/4.2.21.Final/hibernate-entitymanager-4.2.21.Final.jar
MD5: 2c1a3f1c7bb83b730ab3db1fe588904e
SHA1: a6675070b4c7bb843d74d6ab3bc9440fd315dbb3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://hibernate.org Highest
Vendor pom groupid hibernate Highest
Vendor pom artifactid hibernate-entitymanager Low
Vendor Manifest Implementation-Vendor Hibernate.org High
Vendor manifest Bundle-Description Hibernate ORM JPA Entity Manager Medium
Vendor pom name A Hibernate O/RM Module High
Vendor pom groupid org.hibernate Highest
Vendor Manifest Implementation-Vendor-Id org.hibernate Medium
Vendor Manifest bundle-symbolicname org.hibernate.entitymanager Medium
Vendor pom organization url http://hibernate.org Medium
Vendor central groupid org.hibernate Highest
Vendor Manifest implementation-url http://hibernate.org Low
Vendor pom organization name Hibernate.org High
Vendor pom description A module of the Hibernate O/RM project Medium
Vendor file name hibernate-entitymanager High
Product Manifest Bundle-Name hibernate-entitymanager Medium
Product pom organization url http://hibernate.org Low
Product manifest Bundle-Description Hibernate ORM JPA Entity Manager Medium
Product pom groupid hibernate Low
Product pom name A Hibernate O/RM Module High
Product Manifest bundle-symbolicname org.hibernate.entitymanager Medium
Product central artifactid hibernate-entitymanager Highest
Product pom organization name Hibernate.org Low
Product Manifest implementation-url http://hibernate.org Low
Product pom description A module of the Hibernate O/RM project Medium
Product pom artifactid hibernate-entitymanager Highest
Product file name hibernate-entitymanager High
Product pom url http://hibernate.org Medium
Version central version 4.2.21.Final Highest
Version file version 4.2.21 Highest
Version pom version 4.2.21.Final Highest
Version Manifest Implementation-Version 4.2.21.Final High
stax2-api-3.1.4.jar
Description: tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API.
License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php
File Path: /home/ciagent/.m2/repository/org/codehaus/woodstox/stax2-api/3.1.4/stax2-api-3.1.4.jar
MD5: c08e89de601b0a78f941b2c29db565c3
SHA1: ac19014b1e6a7c08aad07fe114af792676b685b7
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.codehaus.woodstox Highest
Vendor Manifest bundle-symbolicname stax2-api Medium
Vendor pom groupid codehaus.woodstox Highest
Vendor pom artifactid stax2-api Low
Vendor manifest Bundle-Description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low
Vendor Manifest bundle-docurl http://fasterxml.com Low
Vendor pom url http://wiki.fasterxml.com/WoodstoxStax2 Highest
Vendor pom organization url http://fasterxml.com Medium
Vendor pom organization name fasterxml.com High
Vendor pom name Stax2 API High
Vendor pom description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low
Vendor file name stax2-api High
Vendor pom groupid org.codehaus.woodstox Highest
Product pom artifactid stax2-api Highest
Product pom groupid codehaus.woodstox Low
Product pom url http://wiki.fasterxml.com/WoodstoxStax2 Medium
Product central artifactid stax2-api Highest
Product Manifest bundle-symbolicname stax2-api Medium
Product pom organization url http://fasterxml.com Low
Product manifest Bundle-Description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low
Product pom organization name fasterxml.com Low
Product Manifest bundle-docurl http://fasterxml.com Low
Product pom name Stax2 API High
Product pom description tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API. Low
Product file name stax2-api High
Product Manifest Bundle-Name Stax2 API Medium
Version pom version 3.1.4 Highest
Version central version 3.1.4 Highest
Version file version 3.1.4 Highest
jackson-dataformat-xml-2.4.2.jar
Description: Data format extension for Jackson (http://jackson.codehaus.org) to offer
alternative support for serializing POJOs as XML and deserializing XML as pojos.
Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types like JsonGenerator, JsonParser and JsonFactory.
Some data-binding types overridden as well (ObjectMapper sub-classed as XmlMapper).
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-xml/2.4.2/jackson-dataformat-xml-2.4.2.jar
MD5: 1fa55358af6a1364e72e24d9ca4d58e7
SHA1: 02f2d96f68b2d3475452d95dde7a3fbee225f6ae
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Highest
Vendor pom artifactid jackson-dataformat-xml Low
Vendor Manifest bundle-symbolicname com.fasterxml.jackson.dataformat.jackson-dataformat-xml Medium
Vendor manifest Bundle-Description Data format extension for Jackson (http://jackson.codehaus.org) to offeralternative support for serializing POJOs as XML and deserializing XML as pojos.Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low
Vendor central groupid com.fasterxml.jackson.dataformat Highest
Vendor file name jackson-dataformat-xml High
Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.dataformat Medium
Vendor Manifest implementation-build-date 2014-08-15 18:38:26-0700 Low
Vendor pom description Data format extension for Jackson (http://jackson.codehaus.org) to offer
alternative support for serializing POJOs as XML and deserializing XML as pojos.
Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low
Vendor Manifest Implementation-Vendor FasterXML High
Vendor pom groupid com.fasterxml.jackson.dataformat Highest
Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Low
Vendor pom groupid fasterxml.jackson.dataformat Highest
Vendor Manifest specification-vendor FasterXML Low
Vendor pom parent-artifactid jackson-parent Low
Vendor pom name Jackson-dataformat-XML High
Vendor pom parent-groupid com.fasterxml.jackson Medium
Product Manifest Bundle-Name Jackson-dataformat-XML Medium
Product pom parent-artifactid jackson-parent Medium
Product Manifest bundle-symbolicname com.fasterxml.jackson.dataformat.jackson-dataformat-xml Medium
Product manifest Bundle-Description Data format extension for Jackson (http://jackson.codehaus.org) to offeralternative support for serializing POJOs as XML and deserializing XML as pojos.Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low
Product file name jackson-dataformat-xml High
Product pom groupid fasterxml.jackson.dataformat Low
Product pom parent-groupid com.fasterxml.jackson Low
Product Manifest implementation-build-date 2014-08-15 18:38:26-0700 Low
Product pom description Data format extension for Jackson (http://jackson.codehaus.org) to offer
alternative support for serializing POJOs as XML and deserializing XML as pojos.
Support implemented on top of Stax API (javax.xml.stream), by implementing core Jackson Streaming API types ... Low
Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Low
Product pom name Jackson-dataformat-XML High
Product pom url http://wiki.fasterxml.com/JacksonExtensionXmlDataBinding Medium
Product Manifest Implementation-Title Jackson-dataformat-XML High
Product pom artifactid jackson-dataformat-xml Highest
Product Manifest specification-title Jackson-dataformat-XML Medium
Product central artifactid jackson-dataformat-xml Highest
Version pom version 2.4.2 Highest
Version Manifest Implementation-Version 2.4.2 High
Version central version 2.4.2 Highest
Version file version 2.4.2 Highest
Published Vulnerabilities
CVE-2016-3720 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
Vulnerable Software & Versions:
CVE-2016-7051 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-918 Server-Side Request Forgery (SSRF)
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
Vulnerable Software & Versions: (show all )
CVE-2017-15095 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Vulnerable Software & Versions: (show all )
CVE-2017-17485 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
CVE-2017-7525 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
BID - 99623
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1462702
CONFIRM - https://cwiki.apache.org/confluence/display/WW/S2-055
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1599
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1723
CONFIRM - https://security.netapp.com/advisory/ntap-20171214-0002/
CONFIRM - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
CONFIRM - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
DEBIAN - DSA-4004
MISC - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
MLIST - [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
REDHAT - RHSA-2017:1834
REDHAT - RHSA-2017:1835
REDHAT - RHSA-2017:1836
REDHAT - RHSA-2017:1837
REDHAT - RHSA-2017:1839
REDHAT - RHSA-2017:1840
REDHAT - RHSA-2017:2477
REDHAT - RHSA-2017:2546
REDHAT - RHSA-2017:2547
REDHAT - RHSA-2017:2633
REDHAT - RHSA-2017:2635
REDHAT - RHSA-2017:2636
REDHAT - RHSA-2017:2637
REDHAT - RHSA-2017:2638
REDHAT - RHSA-2017:3141
REDHAT - RHSA-2017:3454
REDHAT - RHSA-2017:3455
REDHAT - RHSA-2017:3456
REDHAT - RHSA-2017:3458
REDHAT - RHSA-2018:0294
REDHAT - RHSA-2018:0342
REDHAT - RHSA-2018:1449
REDHAT - RHSA-2018:1450
REDHAT - RHSA-2019:0910
SECTRACK - 1039744
SECTRACK - 1039947
SECTRACK - 1040360
Vulnerable Software & Versions: (show all )
CVE-2018-1000873 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Vulnerable Software & Versions: (show all )
CVE-2018-14719 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14720 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14721 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-918 Server-Side Request Forgery (SSRF)
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19360 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19361 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19362 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2019-12086 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Vulnerable Software & Versions: (show all )
swagger-annotations-1.5.0.jar
Description: Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/
License:
http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/io/swagger/swagger-annotations/1.5.0/swagger-annotations-1.5.0.jar
MD5: c16eb2bdd9f90e97849950178c4c543d
SHA1: f7497f7887e65277c0dab1da1148cf211083f3d4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name swagger-annotations High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Vendor pom groupid io.swagger Highest
Vendor Manifest bundle-symbolicname io.swagger.annotations Medium
Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-annotations Low
Vendor file name swagger-annotations High
Vendor pom parent-artifactid swagger-project Low
Vendor central groupid io.swagger Highest
Vendor manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium
Vendor pom artifactid swagger-annotations Low
Product central artifactid swagger-annotations Highest
Product pom parent-artifactid swagger-project Medium
Product pom name swagger-annotations High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Product Manifest Bundle-Name swagger-annotations Medium
Product pom artifactid swagger-annotations Highest
Product Manifest bundle-symbolicname io.swagger.annotations Medium
Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-annotations Low
Product file name swagger-annotations High
Product manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium
Product pom groupid io.swagger Low
Version file version 1.5.0 Highest
Version pom version 1.5.0 Highest
Version central version 1.5.0 Highest
swagger-models-1.5.0.jar
Description: Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/
License:
http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/io/swagger/swagger-models/1.5.0/swagger-models-1.5.0.jar
MD5: 5c3d553535fddea14a4e7e87c5fc59fa
SHA1: d2566bfc270073a559b342089f54086ee64ca5b1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-symbolicname io.swagger.models Medium
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Vendor pom name swagger-models High
Vendor pom groupid io.swagger Highest
Vendor pom artifactid swagger-models Low
Vendor pom parent-artifactid swagger-project Low
Vendor central groupid io.swagger Highest
Vendor manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium
Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-models Low
Vendor file name swagger-models High
Product Manifest bundle-symbolicname io.swagger.models Medium
Product pom parent-artifactid swagger-project Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Product pom name swagger-models High
Product central artifactid swagger-models Highest
Product manifest Bundle-Description Sonatype helps open source projects to set up Maven repositories on https://oss.sonatype.org/ Medium
Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-models Low
Product Manifest Bundle-Name swagger-models Medium
Product pom artifactid swagger-models Highest
Product file name swagger-models High
Product pom groupid io.swagger Low
Version file version 1.5.0 Highest
Version pom version 1.5.0 Highest
Version central version 1.5.0 Highest
validation-api-1.1.0.Final.jar
Description:
Bean Validation API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/javax/validation/validation-api/1.1.0.Final/validation-api-1.1.0.Final.jar
MD5: 4c257f52462860b62ab3cdab45f53082
SHA1: 8613ae82954779d518631e05daa73a6a954817d5
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Bean Validation API High
Vendor central groupid javax.validation Highest
Vendor pom description
Bean Validation API
Medium
Vendor manifest Bundle-Description Bean Validation API Medium
Vendor file name validation-api High
Vendor pom url http://beanvalidation.org Highest
Vendor Manifest bundle-symbolicname javax.validation.api Medium
Vendor pom groupid javax.validation Highest
Vendor pom artifactid validation-api Low
Product pom name Bean Validation API High
Product central artifactid validation-api Highest
Product pom artifactid validation-api Highest
Product pom groupid javax.validation Low
Product Manifest Bundle-Name Bean Validation API Medium
Product pom description
Bean Validation API
Medium
Product manifest Bundle-Description Bean Validation API Medium
Product file name validation-api High
Product pom url http://beanvalidation.org Medium
Product Manifest bundle-symbolicname javax.validation.api Medium
Version pom version 1.1.0.Final Highest
Version file version 1.1.0 Highest
Version central version 1.1.0.Final Highest
swagger-core-1.5.0.jar
File Path: /home/ciagent/.m2/repository/io/swagger/swagger-core/1.5.0/swagger-core-1.5.0.jar
MD5: abc2015d9e823cb96abfa7e2937b43fb
SHA1: 09d5cfb8188ac316bad3a7b38c46bac0568c60e4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid swagger-core Low
Vendor pom name swagger-core High
Vendor pom groupid io.swagger Highest
Vendor pom parent-artifactid swagger-project Low
Vendor central groupid io.swagger Highest
Vendor file name swagger-core High
Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-core Low
Product pom name swagger-core High
Product central artifactid swagger-core Highest
Product pom parent-artifactid swagger-project Medium
Product pom artifactid swagger-core Highest
Product file name swagger-core High
Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-core Low
Product pom groupid io.swagger Low
Version file version 1.5.0 Highest
Version pom version 1.5.0 Highest
Version central version 1.5.0 Highest
annotations-2.0.1.jar
Description: Annotation supports the FindBugs tool
License:
GNU Lesser Public License: http://www.gnu.org/licenses/lgpl.html
File Path: /home/ciagent/.m2/repository/com/google/code/findbugs/annotations/2.0.1/annotations-2.0.1.jar
MD5: 35ef911c85603829ded63f211feb2d68
SHA1: 9ef6656259841cebfb9fb0697bb122ada4485498
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid annotations Low
Vendor pom groupid google.code.findbugs Highest
Vendor pom description Annotation supports the FindBugs tool Medium
Vendor pom url http://findbugs.sourceforge.net/ Highest
Vendor pom groupid com.google.code.findbugs Highest
Vendor pom name FindBugs-Annotations High
Vendor Manifest bundle-symbolicname findbugsAnnotations Medium
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Vendor file name annotations High
Vendor central groupid com.google.code.findbugs Highest
Product pom description Annotation supports the FindBugs tool Medium
Product Manifest Bundle-Name FindbugsAnnotations Medium
Product pom url http://findbugs.sourceforge.net/ Medium
Product central artifactid annotations Highest
Product pom name FindBugs-Annotations High
Product Manifest bundle-symbolicname findbugsAnnotations Medium
Product pom groupid google.code.findbugs Low
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Product pom artifactid annotations Highest
Product file name annotations High
Version pom version 2.0.1 Highest
Version file version 2.0.1 Highest
Version central version 2.0.1 Highest
reflections-0.9.9.jar
Description: Reflections - a Java runtime metadata analysis
License:
WTFPL: http://www.wtfpl.net/
The New BSD License: http://www.opensource.org/licenses/bsd-license.html
File Path: /home/ciagent/.m2/repository/org/reflections/reflections/0.9.9/reflections-0.9.9.jar
MD5: 5f13944b355f927f956b6298136ad959
SHA1: 0296d8adb2f22a38025f44b45cac89835ff0bbaf
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.reflections Highest
Vendor pom url http://github.com/ronmamo/reflections Highest
Vendor pom groupid reflections Highest
Vendor pom artifactid reflections Low
Vendor jar package name reflections Low
Vendor pom groupid org.reflections Highest
Vendor file name reflections High
Vendor pom name Reflections High
Vendor pom description Reflections - a Java runtime metadata analysis Medium
Product central artifactid reflections Highest
Product pom artifactid reflections Highest
Product file name reflections High
Product pom groupid reflections Low
Product pom name Reflections High
Product pom url http://github.com/ronmamo/reflections Medium
Product pom description Reflections - a Java runtime metadata analysis Medium
Version file version 0.9.9 Highest
Version central version 0.9.9 Highest
Version pom version 0.9.9 Highest
jackson-jaxrs-base-2.4.2.jar
Description: Pile of code that is shared by all Jackson-based JAX-RS
providers.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/jaxrs/jackson-jaxrs-base/2.4.2/jackson-jaxrs-base-2.4.2.jar
MD5: 2764d307011e399f6cfde3d931325366
SHA1: 304e6e60d495095bdae65f80462afc26d76dded4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid jackson-jaxrs-base Low
Vendor pom name Jackson-JAXRS-base High
Vendor pom parent-groupid com.fasterxml.jackson.jaxrs Medium
Vendor pom description Pile of code that is shared by all Jackson-based JAX-RS
providers.
Medium
Vendor Manifest Implementation-Vendor FasterXML High
Vendor file name jackson-jaxrs-base High
Vendor Manifest specification-vendor FasterXML Low
Vendor manifest Bundle-Description Pile of code that is shared by all Jackson-based JAX-RSproviders. Medium
Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.jaxrs Medium
Vendor pom parent-artifactid jackson-jaxrs-providers Low
Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome/jackson-jaxrs-base Low
Vendor Manifest implementation-build-date 2014-08-15 18:44:48-0700 Low
Vendor central groupid com.fasterxml.jackson.jaxrs Highest
Vendor Manifest bundle-symbolicname com.fasterxml.jackson.jaxrs.jackson-jaxrs-base Medium
Vendor pom groupid com.fasterxml.jackson.jaxrs Highest
Vendor pom groupid fasterxml.jackson.jaxrs Highest
Product Manifest Bundle-Name Jackson-JAXRS-base Medium
Product pom name Jackson-JAXRS-base High
Product pom description Pile of code that is shared by all Jackson-based JAX-RS
providers.
Medium
Product pom parent-groupid com.fasterxml.jackson.jaxrs Low
Product pom artifactid jackson-jaxrs-base Highest
Product file name jackson-jaxrs-base High
Product manifest Bundle-Description Pile of code that is shared by all Jackson-based JAX-RSproviders. Medium
Product pom groupid fasterxml.jackson.jaxrs Low
Product central artifactid jackson-jaxrs-base Highest
Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome/jackson-jaxrs-base Low
Product Manifest implementation-build-date 2014-08-15 18:44:48-0700 Low
Product Manifest bundle-symbolicname com.fasterxml.jackson.jaxrs.jackson-jaxrs-base Medium
Product Manifest Implementation-Title Jackson-JAXRS-base High
Product pom parent-artifactid jackson-jaxrs-providers Medium
Product Manifest specification-title Jackson-JAXRS-base Medium
Version pom version 2.4.2 Highest
Version Manifest Implementation-Version 2.4.2 High
Version central version 2.4.2 Highest
Version file version 2.4.2 Highest
Related Dependencies
jackson-dataformat-yaml-2.4.2.jar
jackson-jaxrs-json-provider-2.4.2.jar
jackson-datatype-joda-2.4.2.jar
jackson-module-jaxb-annotations-2.4.2.jar
swagger-jaxrs-1.5.0.jar
File Path: /home/ciagent/.m2/repository/io/swagger/swagger-jaxrs/1.5.0/swagger-jaxrs-1.5.0.jar
MD5: a09d96c899411ac57a479c6635829600
SHA1: 04a77f3f95bfec3073d9d20660c16f54886dfc9f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name swagger-jaxrs High
Vendor pom groupid io.swagger Highest
Vendor pom artifactid swagger-jaxrs Low
Vendor pom parent-artifactid swagger-project Low
Vendor central groupid io.swagger Highest
Vendor Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-jaxrs Low
Vendor file name swagger-jaxrs High
Product pom name swagger-jaxrs High
Product central artifactid swagger-jaxrs Highest
Product pom parent-artifactid swagger-project Medium
Product Manifest url https://github.com/swagger-api/swagger-core/modules/swagger-jaxrs Low
Product pom artifactid swagger-jaxrs Highest
Product file name swagger-jaxrs High
Product pom groupid io.swagger Low
Version file version 1.5.0 Highest
Version pom version 1.5.0 Highest
Version central version 1.5.0 Highest
commons-component-common-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-component-common/5.3.x-SNAPSHOT/commons-component-common-5.3.x-SNAPSHOT.jar
MD5: 68e71cc3a18338cdd93d6eb873ec340a
SHA1: e177099769562ebf444b664181284a611c0a1ea7
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor file name commons-component-common High
Vendor pom parent-groupid org.exoplatform.commons Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.commons Medium
Vendor Manifest date 2019-05-24T09:54:58Z Low
Vendor pom parent-artifactid commons Low
Vendor Manifest implementation-url https://projects.exoplatform.org/commons/commons-component-common Low
Vendor pom name eXo PLF:: Commons - Common Services High
Vendor pom groupid org.exoplatform.commons Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.commons Highest
Vendor pom artifactid commons-component-common Low
Product pom parent-groupid org.exoplatform.commons Low
Product pom parent-artifactid commons Medium
Product file name commons-component-common High
Product Manifest implementation-url https://projects.exoplatform.org/commons/commons-component-common Low
Product pom groupid exoplatform.commons Low
Product pom name eXo PLF:: Commons - Common Services High
Product pom artifactid commons-component-common Highest
Product Manifest specification-title eXo PLF:: Commons - Common Services Medium
Product Manifest Implementation-Title eXo PLF:: Commons - Common Services High
Product Manifest date 2019-05-24T09:54:58Z Low
Version file version 5.3 Highest
Version pom version 5.3.x-20190524.100456-53 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.commons:commons-component-common:5.3.x-SNAPSHOT
Confidence :High
staxnav.core-0.9.8.jar
File Path: /home/ciagent/.m2/repository/org/staxnav/staxnav.core/0.9.8/staxnav.core-0.9.8.jar
MD5: 0f786e5be21df9fbe8753175564564c7
SHA1: 27bd12d4d74b0851e38de79f8299462d93ba3d7f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid staxnav.parent Low
Vendor pom parent-groupid org.staxnav Medium
Vendor pom groupid org.staxnav Highest
Vendor pom groupid staxnav Highest
Vendor pom artifactid staxnav.core Low
Vendor jar package name staxnav Low
Vendor file name staxnav.core High
Vendor pom name Staxnav - Core High
Vendor central groupid org.staxnav Highest
Product pom groupid staxnav Low
Product central artifactid staxnav.core Highest
Product pom parent-groupid org.staxnav Low
Product file name staxnav.core High
Product pom name Staxnav - Core High
Product pom parent-artifactid staxnav.parent Medium
Product pom artifactid staxnav.core Highest
Version pom version 0.9.8 Highest
Version central version 0.9.8 Highest
Version file version 0.9.8 Highest
commons-lang3-3.3.2.jar
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/commons/commons-lang3/3.3.2/commons-lang3-3.3.2.jar
MD5: 3128bf75a2549ebe38663401191bacab
SHA1: 90a3822c38ec8c996e84c16a3477ef632cbc87a3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom url http://commons.apache.org/proper/commons-lang/ Highest
Vendor pom groupid org.apache.commons Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom parent-artifactid commons-parent Low
Vendor pom description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Vendor central groupid org.apache.commons Highest
Vendor manifest Bundle-Description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low
Vendor pom artifactid commons-lang3 Low
Vendor pom name Apache Commons Lang High
Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor Manifest implementation-build tags/LANG_3_3_2_RC1@r1585295; 2014-04-06 14:18:52+0200 Low
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom groupid apache.commons Highest
Vendor Manifest bundle-symbolicname org.apache.commons.lang3 Medium
Vendor file name commons-lang3 High
Product pom parent-artifactid commons-parent Medium
Product pom description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Low
Product Manifest specification-title Apache Commons Lang Medium
Product manifest Bundle-Description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Low
Product pom parent-groupid org.apache.commons Low
Product Manifest Implementation-Title Apache Commons Lang High
Product pom name Apache Commons Lang High
Product Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low
Product Manifest Bundle-Name Apache Commons Lang Medium
Product pom url http://commons.apache.org/proper/commons-lang/ Medium
Product pom groupid apache.commons Low
Product Manifest implementation-build tags/LANG_3_3_2_RC1@r1585295; 2014-04-06 14:18:52+0200 Low
Product central artifactid commons-lang3 Highest
Product Manifest bundle-symbolicname org.apache.commons.lang3 Medium
Product pom artifactid commons-lang3 Highest
Product file name commons-lang3 High
Version pom version 3.3.2 Highest
Version central version 3.3.2 Highest
Version Manifest Implementation-Version 3.3.2 High
Version file version 3.3.2 Highest
json-20070829.jar
Description:
JSON (JavaScript Object Notation) is a lightweight data-interchange format.
It is easy for humans to read and write. It is easy for machines to parse and generate.
It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition
- December 1999. JSON is a text format that is completely language independent but uses
conventions that are familiar to programmers of the C-family of languages, including C, C++, C#,
Java, JavaScript, Perl, Python, and many others.
These properties make JSON an ideal data-interchange language.
File Path: /home/ciagent/.m2/repository/org/json/json/20070829/json-20070829.jar
MD5: 4a913140f9099519dfc0212fa5d9a457
SHA1: 89190ff77b57203c3417555f32226998da97ff38
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom organization url http://json.org/ Medium
Vendor pom groupid json Highest
Vendor pom artifactid json Low
Vendor pom url http://www.json.org/java/index.html Highest
Vendor pom groupid org.json Highest
Vendor pom name JSON (JavaScript Object Notation) High
Vendor file name json-20070829 High
Vendor jar package name json Low
Vendor pom organization name JSON High
Vendor pom description JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but... Low
Vendor central groupid org.json Highest
Product central artifactid json Highest
Product pom organization name JSON Low
Product pom artifactid json Highest
Product pom name JSON (JavaScript Object Notation) High
Product pom url http://www.json.org/java/index.html Medium
Product file name json-20070829 High
Product pom organization url http://json.org/ Low
Product pom groupid json Low
Product pom description JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but... Low
Version file version 20070829 Medium
Version central version 20070829 Highest
Version pom version 20070829 Highest
social-component-common-5.3.x-SNAPSHOT.jar
Description: eXo Social Common Component
File Path: /srv/ciagent/workspace/PLF/social-develop-site/sources/component/common/target/social-component-common-5.3.x-SNAPSHOT.jar
MD5: 9802924e92e36868a38a4ba44ef23e52
SHA1: aba26d9005fde6f040d7e2afc93cf287b17b830c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom name eXo PLF:: Social Common Component High
Vendor pom description eXo Social Common Component Medium
Vendor pom groupid org.exoplatform.social Highest
Vendor pom groupid exoplatform.social Highest
Vendor file name social-component-common High
Vendor pom artifactid social-component-common Low
Vendor pom parent-artifactid social-component Low
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-common Low
Vendor pom parent-groupid org.exoplatform.social Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.social Medium
Vendor Manifest date 2019-05-26T07:45:21Z Low
Product pom parent-groupid org.exoplatform.social Low
Product file name social-component-common High
Product pom name eXo PLF:: Social Common Component High
Product Manifest specification-title eXo PLF:: Social Common Component Medium
Product pom description eXo Social Common Component Medium
Product pom groupid exoplatform.social Low
Product pom artifactid social-component-common Highest
Product Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-common Low
Product Manifest Implementation-Title eXo PLF:: Social Common Component High
Product pom parent-artifactid social-component Medium
Product Manifest date 2019-05-26T07:45:21Z Low
Version file version 5.3 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.social:social-component-common:5.3.x-SNAPSHOT
Confidence :High
icu4j-56.1.jar
Description:
International Component for Unicode for Java (ICU4J) is a mature, widely used Java library
providing Unicode and Globalization support
License:
ICU License: http://source.icu-project.org/repos/icu/icu/trunk/license.html
File Path: /home/ciagent/.m2/repository/com/ibm/icu/icu4j/56.1/icu4j-56.1.jar
MD5: 7bd1a7a1295868726f991c7593dce442
SHA1: 8dd6671f52165a0419e6de5e1016400875a90fa9
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid ibm.icu Highest
Vendor pom name ICU4J High
Vendor manifest Bundle-Description International Components for Unicode for Java Medium
Vendor file name icu4j High
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Vendor central groupid com.ibm.icu Highest
Vendor pom groupid com.ibm.icu Highest
Vendor Manifest Implementation-Vendor-Id com.ibm Medium
Vendor Manifest bundle-symbolicname com.ibm.icu Medium
Vendor Manifest bundle-copyright Copyright 2000-2015, International Business Machines Corporation and others. All Rights Reserved. Low
Vendor Manifest specification-vendor icu-project.org Low
Vendor pom artifactid icu4j Low
Vendor pom description International Component for Unicode for Java (ICU4J) is a mature, widely used Java library providing Unicode and Globalization support Low
Vendor Manifest Implementation-Vendor IBM Corporation High
Vendor pom url http://icu-project.org/ Highest
Product pom name ICU4J High
Product Manifest Bundle-Name ICU4J Medium
Product manifest Bundle-Description International Components for Unicode for Java Medium
Product file name icu4j High
Product pom groupid ibm.icu Low
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low
Product central artifactid icu4j Highest
Product pom artifactid icu4j Highest
Product Manifest bundle-symbolicname com.ibm.icu Medium
Product Manifest specification-title International Components for Unicode for Java Medium
Product Manifest bundle-copyright Copyright 2000-2015, International Business Machines Corporation and others. All Rights Reserved. Low
Product Manifest Implementation-Title International Components for Unicode for Java High
Product pom url http://icu-project.org/ Medium
Product pom description International Component for Unicode for Java (ICU4J) is a mature, widely used Java library providing Unicode and Globalization support Low
Version Manifest Implementation-Version 56.1 High
Version central version 56.1 Highest
Version file version 56.1 Highest
Version pom version 56.1 Highest
Published Vulnerabilities
CVE-2016-6293 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
Vulnerable Software & Versions:
CVE-2016-7415 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string.
Vulnerable Software & Versions:
CVE-2017-14952 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-415 Double Free
Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a "redundant UVector entry clean up function call" issue.
Vulnerable Software & Versions:
CVE-2017-15396 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Vulnerable Software & Versions: (show all )
CVE-2017-15422 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-190 Integer Overflow or Wraparound
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Vulnerable Software & Versions: (show all )
CVE-2017-17484 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.
Vulnerable Software & Versions:
CVE-2017-7867 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-787 Out-of-bounds Write
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.
Vulnerable Software & Versions:
CVE-2017-7868 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-787 Out-of-bounds Write
International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.
Vulnerable Software & Versions:
portlet-api-2.0.jar
Description: The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group.
File Path: /home/ciagent/.m2/repository/javax/portlet/portlet-api/2.0/portlet-api-2.0.jar
MD5: 0ec08593cda1df33985391919996c740
SHA1: 1cd72f2a37fcf8ab9893a9468d7ba71c85fe2653
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name portlet-api High
Vendor pom description The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group. Medium
Vendor pom name Java Portlet Specification V2.0 High
Vendor pom url http://www.jcp.org/en/jsr/detail?id=286 Highest
Vendor central groupid javax.portlet Highest
Vendor pom groupid javax.portlet Highest
Vendor Manifest bundle-docurl http://www.jcp.org/en/jsr/detail?id=286 Low
Vendor pom artifactid portlet-api Low
Vendor Manifest bundle-symbolicname javax.portlet Medium
Product file name portlet-api High
Product pom artifactid portlet-api Highest
Product pom description The Java Portlet API version 2.0 developed by the Java Community Process JSR-286 Expert Group. Medium
Product pom groupid javax.portlet Low
Product pom name Java Portlet Specification V2.0 High
Product pom url http://www.jcp.org/en/jsr/detail?id=286 Medium
Product Manifest Bundle-Name JSR 286 Medium
Product Manifest bundle-docurl http://www.jcp.org/en/jsr/detail?id=286 Low
Product Manifest bundle-symbolicname javax.portlet Medium
Product central artifactid portlet-api Highest
Version file version 2.0 Highest
Version central version 2.0 Highest
Version pom version 2.0 Highest
javaparser-1.0.8.jar
Description: A Java 1.5 Parser with AST generation and visitor support. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code.
License:
GNU Lesser General Public License: http://www.gnu.org/licenses/lgpl.html
File Path: /home/ciagent/.m2/repository/com/google/code/javaparser/javaparser/1.0.8/javaparser-1.0.8.jar
MD5: 32228e53ef6cc2ebe515bc40d7c9a4f9
SHA1: 9ca2f8ef2233babc53a8c2b6bb21869d94f5fcc1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Java 1.5 Parser and AST High
Vendor pom artifactid javaparser Low
Vendor pom url http://code.google.com/p/javaparser/ Highest
Vendor jar package name japa Low
Vendor jar package name ast Low
Vendor file name javaparser High
Vendor jar package name parser Low
Vendor pom description A Java 1.5 Parser with AST generation and visitor support. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code. Low
Vendor pom groupid google.code.javaparser Highest
Vendor pom groupid com.google.code.javaparser Highest
Product pom name Java 1.5 Parser and AST High
Product pom groupid google.code.javaparser Low
Product pom url http://code.google.com/p/javaparser/ Medium
Product jar package name ast Low
Product pom artifactid javaparser Highest
Product file name javaparser High
Product jar package name parser Low
Product pom description A Java 1.5 Parser with AST generation and visitor support. The AST records the source code structure, javadoc and comments. It is also possible to change the AST nodes or create new ones to modify the source code. Low
Version pom version 1.0.8 Highest
Version file version 1.0.8 Highest
maven: com.google.code.javaparser:javaparser:1.0.8
Confidence :High
chromattic.testgenerator-1.3.0.jar
Description: Chromattic Framework generator
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.testgenerator/1.3.0/chromattic.testgenerator-1.3.0.jar
MD5: 971802dfdfdc6500f1ff0e583a7659a1
SHA1: e725269db29a0fc8c982df481e5ce09b84e5d6a8
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name chromattic.testgenerator High
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom name Chromattic Framework Test generator High
Vendor pom artifactid chromattic.testgenerator Low
Vendor pom parent-artifactid chromattic.parent Low
Vendor central groupid org.chromattic Highest
Vendor jar package name testgenerator Low
Vendor pom parent-groupid org.chromattic Medium
Vendor pom description Chromattic Framework generator Medium
Product file name chromattic.testgenerator High
Product pom parent-artifactid chromattic.parent Medium
Product pom name Chromattic Framework Test generator High
Product pom parent-groupid org.chromattic Low
Product central artifactid chromattic.testgenerator Highest
Product pom groupid chromattic Low
Product pom artifactid chromattic.testgenerator Highest
Product jar package name testgenerator Low
Product pom description Chromattic Framework generator Medium
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
chromattic.metamodel-1.3.0.jar
Description: Chromattic Framework Metamodel
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.metamodel/1.3.0/chromattic.metamodel-1.3.0.jar
MD5: 0d534975c688ebabbc232601c6bc13da
SHA1: fbaa10037faf34a2d4d8eeb4e6b5ce28c95a9455
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor pom name Chromattic Framework Metamodel High
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom artifactid chromattic.metamodel Low
Vendor pom description Chromattic Framework Metamodel Medium
Vendor jar package name metamodel Low
Vendor pom parent-artifactid chromattic.parent Low
Vendor central groupid org.chromattic Highest
Vendor file name chromattic.metamodel High
Vendor pom parent-groupid org.chromattic Medium
Product pom parent-artifactid chromattic.parent Medium
Product pom name Chromattic Framework Metamodel High
Product pom parent-groupid org.chromattic Low
Product pom description Chromattic Framework Metamodel Medium
Product jar package name metamodel Low
Product central artifactid chromattic.metamodel Highest
Product pom groupid chromattic Low
Product pom artifactid chromattic.metamodel Highest
Product file name chromattic.metamodel High
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
chromattic.common-1.3.0.jar
Description: Chromattic Framework Common
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.common/1.3.0/chromattic.common-1.3.0.jar
MD5: 15bfb4cc0312aefffb25952cdf18b2cd
SHA1: 55470175c1ba46a917504acf97018e6ef2932659
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom description Chromattic Framework Common Medium
Vendor file name chromattic.common High
Vendor jar package name common Low
Vendor jar package name collection Low
Vendor pom name Chromattic Framework Common High
Vendor pom artifactid chromattic.common Low
Vendor pom parent-artifactid chromattic.parent Low
Vendor central groupid org.chromattic Highest
Vendor pom parent-groupid org.chromattic Medium
Product pom artifactid chromattic.common Highest
Product pom parent-artifactid chromattic.parent Medium
Product pom description Chromattic Framework Common Medium
Product file name chromattic.common High
Product pom parent-groupid org.chromattic Low
Product pom name Chromattic Framework Common High
Product jar package name common Low
Product pom groupid chromattic Low
Product jar package name collection Low
Product central artifactid chromattic.common Highest
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
reflext.api-1.1.0.jar
Description: The Reflext Framework API
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.api/1.1.0/reflext.api-1.1.0.jar
MD5: fe732172fa2fb5ae4b63866ef15da41f
SHA1: 28374c509099736aeedc52fef3d7b8e78238c2a0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid reflext.parent Low
Vendor file name reflext.api High
Vendor pom artifactid reflext.api Low
Vendor pom parent-groupid org.reflext Medium
Vendor central groupid org.reflext Highest
Vendor pom description The Reflext Framework API Medium
Vendor pom name Reflext Framework API High
Vendor jar package name reflext Low
Vendor pom groupid reflext Highest
Vendor pom groupid org.reflext Highest
Vendor jar package name api Low
Product pom groupid reflext Low
Product pom parent-artifactid reflext.parent Medium
Product pom artifactid reflext.api Highest
Product file name reflext.api High
Product pom description The Reflext Framework API Medium
Product pom name Reflext Framework API High
Product central artifactid reflext.api Highest
Product pom parent-groupid org.reflext Low
Product jar package name api Low
Version pom version 1.1.0 Highest
Version file version 1.1.0 Highest
Version central version 1.1.0 Highest
reflext.core-1.1.0.jar
Description: The Reflect Framework Core
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.core/1.1.0/reflext.core-1.1.0.jar
MD5: cc65231f60a70dec43a57ccba5adce81
SHA1: 56316a714b99d7ac85d23d0f1a4680149c3273d6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Reflext Framework Core High
Vendor jar package name core Low
Vendor pom parent-artifactid reflext.parent Low
Vendor pom parent-groupid org.reflext Medium
Vendor central groupid org.reflext Highest
Vendor pom artifactid reflext.core Low
Vendor jar package name reflext Low
Vendor file name reflext.core High
Vendor pom groupid reflext Highest
Vendor pom groupid org.reflext Highest
Vendor pom description The Reflect Framework Core Medium
Product pom artifactid reflext.core Highest
Product pom name Reflext Framework Core High
Product jar package name core Low
Product pom groupid reflext Low
Product pom parent-artifactid reflext.parent Medium
Product central artifactid reflext.core Highest
Product file name reflext.core High
Product pom description The Reflect Framework Core Medium
Product pom parent-groupid org.reflext Low
Version pom version 1.1.0 Highest
Version file version 1.1.0 Highest
Version central version 1.1.0 Highest
reflext.spi-1.1.0.jar
Description: The Reflext Framework SPI
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.spi/1.1.0/reflext.spi-1.1.0.jar
MD5: 2c967ae0c3078d23b615f8825377f304
SHA1: 4df0428c39922079c53955602bce66735f9d20a8
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description The Reflext Framework SPI Medium
Vendor pom parent-artifactid reflext.parent Low
Vendor pom artifactid reflext.spi Low
Vendor jar package name spi Low
Vendor pom parent-groupid org.reflext Medium
Vendor jar package name reflext Low
Vendor file name reflext.spi High
Vendor central groupid org.reflext Highest
Vendor jar package name model Low
Vendor pom name Reflext Framework SPI High
Vendor pom groupid reflext Highest
Vendor pom groupid org.reflext Highest
Product pom description The Reflext Framework SPI Medium
Product pom groupid reflext Low
Product pom parent-artifactid reflext.parent Medium
Product central artifactid reflext.spi Highest
Product jar package name spi Low
Product jar package name model Low
Product pom name Reflext Framework SPI High
Product pom artifactid reflext.spi Highest
Product file name reflext.spi High
Product pom parent-groupid org.reflext Low
Version pom version 1.1.0 Highest
Version file version 1.1.0 Highest
Version central version 1.1.0 Highest
reflext.jlr-1.1.0.jar
Description: The Reflext Framework Java Lang Reflect Plugin
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.jlr/1.1.0/reflext.jlr-1.1.0.jar
MD5: 1103f3b1ed3762e0bd100cbee6e7f345
SHA1: 79ad1a5053213cbb350d37ff12d5f767243c8c46
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Reflext Framework Java Lang Reflect Plugin High
Vendor jar package name jlr Low
Vendor pom parent-artifactid reflext.parent Low
Vendor pom artifactid reflext.jlr Low
Vendor pom parent-groupid org.reflext Medium
Vendor central groupid org.reflext Highest
Vendor file name reflext.jlr High
Vendor pom description The Reflext Framework Java Lang Reflect Plugin Medium
Vendor jar package name reflext Low
Vendor pom groupid reflext Highest
Vendor pom groupid org.reflext Highest
Product pom name Reflext Framework Java Lang Reflect Plugin High
Product jar package name jlr Low
Product central artifactid reflext.jlr Highest
Product pom groupid reflext Low
Product pom parent-artifactid reflext.parent Medium
Product file name reflext.jlr High
Product pom description The Reflext Framework Java Lang Reflect Plugin Medium
Product pom artifactid reflext.jlr Highest
Product pom parent-groupid org.reflext Low
Version pom version 1.1.0 Highest
Version file version 1.1.0 Highest
Version central version 1.1.0 Highest
chromattic.core-1.3.0.jar
Description: Chromattic Framework Core
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.core/1.3.0/chromattic.core-1.3.0.jar
MD5: 9ece56be0e1e1b3289bbe177e8e1b4ab
SHA1: 1bc4ebc89d7b47af394b920f44a0b51409343034
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom name Chromattic Framework Core High
Vendor pom artifactid chromattic.core Low
Vendor jar package name core Low
Vendor pom parent-artifactid chromattic.parent Low
Vendor file name chromattic.core High
Vendor central groupid org.chromattic Highest
Vendor pom description Chromattic Framework Core Medium
Vendor pom parent-groupid org.chromattic Medium
Product pom parent-artifactid chromattic.parent Medium
Product pom name Chromattic Framework Core High
Product central artifactid chromattic.core Highest
Product jar package name core Low
Product pom parent-groupid org.chromattic Low
Product pom groupid chromattic Low
Product pom artifactid chromattic.core Highest
Product file name chromattic.core High
Product pom description Chromattic Framework Core Medium
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
reflext.apt-1.1.0.jar
Description: The Reflext Framework Annotation Processing Tool Plugin
File Path: /home/ciagent/.m2/repository/org/reflext/reflext.apt/1.1.0/reflext.apt-1.1.0.jar
MD5: e6bb0195d6cdd15b618939c78999ea4e
SHA1: 093ab21e03197c1c7a2d2d20da4d3dd34a60ac24
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Reflext Framework Annotation Processing Tool Plugin High
Vendor pom description The Reflext Framework Annotation Processing Tool Plugin Medium
Vendor pom parent-artifactid reflext.parent Low
Vendor file name reflext.apt High
Vendor pom parent-groupid org.reflext Medium
Vendor central groupid org.reflext Highest
Vendor jar package name reflext Low
Vendor pom groupid reflext Highest
Vendor pom groupid org.reflext Highest
Vendor jar package name apt Low
Vendor pom artifactid reflext.apt Low
Product pom name Reflext Framework Annotation Processing Tool Plugin High
Product pom description The Reflext Framework Annotation Processing Tool Plugin Medium
Product pom groupid reflext Low
Product pom parent-artifactid reflext.parent Medium
Product pom artifactid reflext.apt Highest
Product file name reflext.apt High
Product central artifactid reflext.apt Highest
Product jar package name apt Low
Product pom parent-groupid org.reflext Low
Version pom version 1.1.0 Highest
Version file version 1.1.0 Highest
Version central version 1.1.0 Highest
Published Vulnerabilities
CVE-2018-1000840 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
Vulnerable Software & Versions:
chromattic.apt-1.3.0.jar
Description: Chromattic Framework APT Plugin
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.apt/1.3.0/chromattic.apt-1.3.0.jar
MD5: 5f51682435a2e2014a9bd9c5936a5cc5
SHA1: f2e219c2b8e13983a26b4c3f4e8eb54d71730b4d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom name Chromattic Framework APT Plugin High
Vendor pom parent-artifactid chromattic.parent Low
Vendor pom description Chromattic Framework APT Plugin Medium
Vendor file name chromattic.apt High
Vendor central groupid org.chromattic Highest
Vendor pom artifactid chromattic.apt Low
Vendor pom parent-groupid org.chromattic Medium
Vendor jar package name apt Low
Product pom parent-artifactid chromattic.parent Medium
Product pom name Chromattic Framework APT Plugin High
Product pom parent-groupid org.chromattic Low
Product central artifactid chromattic.apt Highest
Product pom groupid chromattic Low
Product pom description Chromattic Framework APT Plugin Medium
Product file name chromattic.apt High
Product pom artifactid chromattic.apt Highest
Product jar package name apt Low
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
chromattic.ext-1.3.0.jar
Description: Chromattic Framework Extensions
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.ext/1.3.0/chromattic.ext-1.3.0.jar
MD5: a8482bb9fe7572e77a58627251740ee1
SHA1: ea3bd25892c827d9b830aea768de69e200a93165
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom name Chromattic Framework Extensions High
Vendor pom description Chromattic Framework Extensions Medium
Vendor jar package name ext Low
Vendor jar package name ntdef Low
Vendor pom parent-artifactid chromattic.parent Low
Vendor file name chromattic.ext High
Vendor central groupid org.chromattic Highest
Vendor pom artifactid chromattic.ext Low
Vendor pom parent-groupid org.chromattic Medium
Product pom parent-artifactid chromattic.parent Medium
Product pom artifactid chromattic.ext Highest
Product pom name Chromattic Framework Extensions High
Product pom description Chromattic Framework Extensions Medium
Product pom parent-groupid org.chromattic Low
Product jar package name ext Low
Product pom groupid chromattic Low
Product file name chromattic.ext High
Product jar package name ntdef Low
Product central artifactid chromattic.ext Highest
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
chromattic.spi-1.3.0.jar
Description: Chromattic Framework SPI
File Path: /home/ciagent/.m2/repository/org/chromattic/chromattic.spi/1.3.0/chromattic.spi-1.3.0.jar
MD5: e440e3f5a8e5ad38720975546ab7f06d
SHA1: 64c36f826b832acab48fea793b7c70b019a46181
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid chromattic Highest
Vendor jar package name chromattic Low
Vendor pom groupid org.chromattic Highest
Vendor pom name Chromattic Framework SPI High
Vendor jar package name spi Low
Vendor pom artifactid chromattic.spi Low
Vendor pom description Chromattic Framework SPI Medium
Vendor file name chromattic.spi High
Vendor jar package name type Low
Vendor pom parent-artifactid chromattic.parent Low
Vendor central groupid org.chromattic Highest
Vendor pom parent-groupid org.chromattic Medium
Product pom parent-artifactid chromattic.parent Medium
Product pom description Chromattic Framework SPI Medium
Product pom artifactid chromattic.spi Highest
Product file name chromattic.spi High
Product jar package name type Low
Product pom parent-groupid org.chromattic Low
Product pom name Chromattic Framework SPI High
Product jar package name spi Low
Product pom groupid chromattic Low
Product central artifactid chromattic.spi Highest
Version central version 1.3.0 Highest
Version file version 1.3.0 Highest
Version pom version 1.3.0 Highest
commons-component-product-5.3.x-SNAPSHOT.jar
Description: Product informations: version, revision and build numbers
File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-component-product/5.3.x-SNAPSHOT/commons-component-product-5.3.x-SNAPSHOT.jar
MD5: b8901f4806b4b15c95950919ab4e22cc
SHA1: 18deee3c16a7fbe462e1ffe37e4317fe89a9d24c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom name eXo PLF:: Commons - Product Informations High
Vendor pom parent-groupid org.exoplatform.commons Medium
Vendor Manifest implementation-url https://projects.exoplatform.org/commons/commons-component-product Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.commons Medium
Vendor pom description Product informations: version, revision and build numbers Medium
Vendor Manifest date 2019-05-24T09:54:58Z Low
Vendor pom artifactid commons-component-product Low
Vendor file name commons-component-product High
Vendor pom parent-artifactid commons Low
Vendor pom groupid org.exoplatform.commons Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.commons Highest
Product pom name eXo PLF:: Commons - Product Informations High
Product file name commons-component-product High
Product pom parent-groupid org.exoplatform.commons Low
Product pom parent-artifactid commons Medium
Product pom artifactid commons-component-product Highest
Product Manifest specification-title eXo PLF:: Commons - Product Informations Medium
Product pom groupid exoplatform.commons Low
Product Manifest Implementation-Title eXo PLF:: Commons - Product Informations High
Product Manifest implementation-url https://projects.exoplatform.org/commons/commons-component-product Low
Product pom description Product informations: version, revision and build numbers Medium
Product Manifest date 2019-05-24T09:54:58Z Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.commons:commons-component-product:5.3.x-SNAPSHOT
Confidence :High
commons-component-upgrade-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/commons/commons-component-upgrade/5.3.x-SNAPSHOT/commons-component-upgrade-5.3.x-SNAPSHOT.jar
MD5: dec94676448b6445d4b46241496bdc51
SHA1: 8a096fb70e071ea70a19721012cd6e425cdd3ff4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom artifactid commons-component-upgrade Low
Vendor file name commons-component-upgrade High
Vendor pom parent-groupid org.exoplatform.commons Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.commons Medium
Vendor Manifest date 2019-05-24T09:54:58Z Low
Vendor pom name eXo PLF:: Commons - Transparent Upgrade Framework High
Vendor Manifest implementation-url https://projects.exoplatform.org/commons/commons-component-upgrade Low
Vendor pom parent-artifactid commons Low
Vendor pom groupid org.exoplatform.commons Highest
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom groupid exoplatform.commons Highest
Product pom parent-groupid org.exoplatform.commons Low
Product pom name eXo PLF:: Commons - Transparent Upgrade Framework High
Product file name commons-component-upgrade High
Product pom parent-artifactid commons Medium
Product Manifest implementation-url https://projects.exoplatform.org/commons/commons-component-upgrade Low
Product pom groupid exoplatform.commons Low
Product Manifest specification-title eXo PLF:: Commons - Transparent Upgrade Framework Medium
Product Manifest Implementation-Title eXo PLF:: Commons - Transparent Upgrade Framework High
Product pom artifactid commons-component-upgrade Highest
Product Manifest date 2019-05-24T09:54:58Z Low
Version file version 5.3 Highest
Version pom version 5.3.x-20190524.100501-53 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.commons:commons-component-upgrade:5.3.x-SNAPSHOT
Confidence :High
exo.core.component.security.core-5.3.x-SNAPSHOT.jar
Description: Implementation of 'eXo Security' component of Exoplatform SAS 'eXo Core' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/core/exo.core.component.security.core/5.3.x-SNAPSHOT/exo.core.component.security.core-5.3.x-SNAPSHOT.jar
MD5: 488f425f279a0c228294112bce69f54a
SHA1: 851b19507264b0f4a9f19d3752df3b127276ce2a
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom groupid org.exoplatform.core Highest
Vendor pom parent-artifactid core-parent Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.core Medium
Vendor pom artifactid exo.core.component.security.core Low
Vendor pom groupid exoplatform.core Highest
Vendor pom description Implementation of 'eXo Security' component of Exoplatform SAS 'eXo Core' project. Medium
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor file name exo.core.component.security.core High
Vendor pom parent-groupid org.exoplatform.core Medium
Vendor pom name eXo PLF Core :: Component :: Security Service High
Product Manifest Implementation-Title eXo PLF Core :: Component :: Security Service High
Product pom parent-groupid org.exoplatform.core Low
Product pom groupid exoplatform.core Low
Product pom parent-artifactid core-parent Medium
Product pom artifactid exo.core.component.security.core Highest
Product pom description Implementation of 'eXo Security' component of Exoplatform SAS 'eXo Core' project. Medium
Product file name exo.core.component.security.core High
Product Manifest specification-title exo-core Medium
Product pom name eXo PLF Core :: Component :: Security Service High
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.core:exo.core.component.security.core:5.3.x-SNAPSHOT
Confidence :High
exo.kernel.component.cache-5.3.x-SNAPSHOT.jar
Description: Implementation of Cache Service of Exoplatform SAS 'eXo Kernel' project.
File Path: /home/ciagent/.m2/repository/org/exoplatform/kernel/exo.kernel.component.cache/5.3.x-SNAPSHOT/exo.kernel.component.cache-5.3.x-SNAPSHOT.jar
MD5: 6a322bdcc585dcf7bb26e4b7554adf3c
SHA1: 249eab6c763268ea4c6bcc15a6b53bf38c49fb6e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor file name exo.kernel.component.cache High
Vendor Manifest Implementation-Vendor-Id org.exoplatform.kernel Medium
Vendor pom parent-groupid org.exoplatform.kernel Medium
Vendor pom groupid org.exoplatform.kernel Highest
Vendor pom groupid exoplatform.kernel Highest
Vendor pom name eXo PLF:: Kernel :: Component :: Cache Service High
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom description Implementation of Cache Service of Exoplatform SAS 'eXo Kernel' project. Medium
Vendor pom parent-artifactid kernel-parent Low
Vendor pom artifactid exo.kernel.component.cache Low
Product file name exo.kernel.component.cache High
Product Manifest specification-title exo-kernel Medium
Product pom artifactid exo.kernel.component.cache Highest
Product pom parent-artifactid kernel-parent Medium
Product pom name eXo PLF:: Kernel :: Component :: Cache Service High
Product Manifest Implementation-Title eXo PLF:: Kernel :: Component :: Cache Service High
Product pom parent-groupid org.exoplatform.kernel Low
Product pom description Implementation of Cache Service of Exoplatform SAS 'eXo Kernel' project. Medium
Product pom groupid exoplatform.kernel Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.kernel:exo.kernel.component.cache:5.3.x-SNAPSHOT
Confidence :High
common-common-2.2.2.Final.jar
File Path: /home/ciagent/.m2/repository/org/gatein/common/common-common/2.2.2.Final/common-common-2.2.2.Final.jar
MD5: 8ce16b5e3991285cd27e553740d09d1f
SHA1: 44522d899e31a5a10dbd70f7b0ca2fe5a614f740
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid common-parent Low
Vendor file name common-common High
Vendor Manifest implementation-url www.gatein.org/common-parent/common-common/ Low
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom name GateIn - Common component (common) High
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor pom parent-groupid org.gatein.common Medium
Vendor Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low
Vendor Manifest os-name Linux Medium
Vendor pom artifactid common-common Low
Vendor central groupid org.gatein.common Highest
Vendor pom groupid gatein.common Highest
Vendor Manifest Implementation-Vendor-Id org.gatein.common Medium
Vendor pom groupid org.gatein.common Highest
Vendor Manifest specification-vendor JBoss by Red Hat Low
Product Manifest Implementation-Title GateIn - Common component (common) High
Product pom artifactid common-common Highest
Product file name common-common High
Product Manifest implementation-url www.gatein.org/common-parent/common-common/ Low
Product pom name GateIn - Common component (common) High
Product pom groupid gatein.common Low
Product central artifactid common-common Highest
Product Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low
Product Manifest os-name Linux Medium
Product pom parent-artifactid common-parent Medium
Product pom parent-groupid org.gatein.common Low
Product Manifest specification-title GateIn - Common component (common) Medium
Version Manifest Implementation-Version 2.2.2.Final High
Version pom version 2.2.2.Final Highest
Version file version 2.2.2 Highest
Version central version 2.2.2.Final Highest
common-logging-2.2.2.Final.jar
File Path: /home/ciagent/.m2/repository/org/gatein/common/common-logging/2.2.2.Final/common-logging-2.2.2.Final.jar
MD5: 28b7108ee63899bca08636d360e7df11
SHA1: aee18008518671fb10982c0fe5f7383e98f71c47
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid common-parent Low
Vendor Manifest implementation-url www.gatein.org/common-parent/common-logging/ Low
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom artifactid common-logging Low
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor pom parent-groupid org.gatein.common Medium
Vendor Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low
Vendor Manifest os-name Linux Medium
Vendor central groupid org.gatein.common Highest
Vendor pom groupid gatein.common Highest
Vendor Manifest Implementation-Vendor-Id org.gatein.common Medium
Vendor pom groupid org.gatein.common Highest
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor file name common-logging High
Vendor pom name GateIn - Common component (logging) High
Product pom artifactid common-logging Highest
Product Manifest implementation-url www.gatein.org/common-parent/common-logging/ Low
Product central artifactid common-logging Highest
Product Manifest specification-title GateIn - Common component (logging) Medium
Product pom groupid gatein.common Low
Product Manifest build-timestamp Mon, 17 Mar 2014 20:43:14 +0100 Low
Product Manifest os-name Linux Medium
Product pom parent-artifactid common-parent Medium
Product pom parent-groupid org.gatein.common Low
Product Manifest Implementation-Title GateIn - Common component (logging) High
Product file name common-logging High
Product pom name GateIn - Common component (logging) High
Version Manifest Implementation-Version 2.2.2.Final High
Version pom version 2.2.2.Final Highest
Version file version 2.2.2 Highest
Version central version 2.2.2.Final Highest
pc-portlet-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-portlet/5.3.x-SNAPSHOT/pc-portlet-5.3.x-SNAPSHOT.jar
MD5: 471a9c4fc6eb53f16cd833eedcd1069f
SHA1: 4a9cf81176c3da5bc100a8f90a87a151a20c4123
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid pc-portlet Low
Vendor pom parent-groupid org.exoplatform.gatein.pc Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Vendor Manifest specification-vendor GateIn Low
Vendor pom parent-artifactid pc-parent Low
Vendor pom name GateIn - Portlet Container (pc) High
Vendor pom groupid org.exoplatform.gatein.pc Highest
Vendor Manifest os-name Linux Medium
Vendor Manifest Implementation-Vendor GateIn High
Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-portlet Low
Vendor file name pc-portlet High
Vendor pom groupid exoplatform.gatein.pc Highest
Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium
Product Manifest specification-title GateIn - Portlet Container (pc) Medium
Product pom groupid exoplatform.gatein.pc Low
Product Manifest Implementation-Title GateIn - Portlet Container (pc) High
Product pom artifactid pc-portlet Highest
Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-portlet Low
Product pom parent-artifactid pc-parent Medium
Product file name pc-portlet High
Product Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Product pom name GateIn - Portlet Container (pc) High
Product Manifest os-name Linux Medium
Product pom parent-groupid org.exoplatform.gatein.pc Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.gatein.pc:pc-portlet:5.3.x-SNAPSHOT
Confidence :High
pc-federation-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-federation/5.3.x-SNAPSHOT/pc-federation-5.3.x-SNAPSHOT.jar
MD5: dd4ce55f7c860bb7d016dce9d657b75c
SHA1: 6740d145021ee194ff19685821bb77cf57ad1ec1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid pc-federation Low
Vendor pom name GateIn - Portlet Container (federation) High
Vendor file name pc-federation High
Vendor pom parent-groupid org.exoplatform.gatein.pc Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Vendor Manifest specification-vendor GateIn Low
Vendor pom parent-artifactid pc-parent Low
Vendor pom groupid org.exoplatform.gatein.pc Highest
Vendor Manifest os-name Linux Medium
Vendor Manifest Implementation-Vendor GateIn High
Vendor pom groupid exoplatform.gatein.pc Highest
Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium
Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-federation Low
Product pom groupid exoplatform.gatein.pc Low
Product pom name GateIn - Portlet Container (federation) High
Product file name pc-federation High
Product pom parent-artifactid pc-parent Medium
Product pom artifactid pc-federation Highest
Product Manifest Implementation-Title GateIn - Portlet Container (federation) High
Product Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Product Manifest specification-title GateIn - Portlet Container (federation) Medium
Product Manifest os-name Linux Medium
Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-federation Low
Product pom parent-groupid org.exoplatform.gatein.pc Low
Version file version 5.3 Highest
Version pom version 5.3.x-20190523.151133-3 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.gatein.pc:pc-federation:5.3.x-SNAPSHOT
Confidence :High
pc-bridge-5.3.x-SNAPSHOT.jar
File Path: /home/ciagent/.m2/repository/org/exoplatform/gatein/pc/pc-bridge/5.3.x-SNAPSHOT/pc-bridge-5.3.x-SNAPSHOT.jar
MD5: a8031f45e408fb5a638da0e001313c6e
SHA1: 807ded891c83a604160e6eac68bbaf3d6c071da9
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name GateIn - Portlet Container (bridge) High
Vendor pom parent-groupid org.exoplatform.gatein.pc Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Vendor Manifest specification-vendor GateIn Low
Vendor pom artifactid pc-bridge Low
Vendor pom parent-artifactid pc-parent Low
Vendor file name pc-bridge High
Vendor pom groupid org.exoplatform.gatein.pc Highest
Vendor Manifest os-name Linux Medium
Vendor Manifest Implementation-Vendor GateIn High
Vendor pom groupid exoplatform.gatein.pc Highest
Vendor Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-bridge Low
Vendor Manifest Implementation-Vendor-Id org.exoplatform.gatein.pc Medium
Product pom name GateIn - Portlet Container (bridge) High
Product pom artifactid pc-bridge Highest
Product pom groupid exoplatform.gatein.pc Low
Product pom parent-artifactid pc-parent Medium
Product Manifest Implementation-Title GateIn - Portlet Container (bridge) High
Product Manifest build-timestamp Thu, 23 May 2019 15:08:34 +0000 Low
Product file name pc-bridge High
Product Manifest specification-title GateIn - Portlet Container (bridge) Medium
Product Manifest implementation-url http://www.jboss.org/gatein/portletcontainer.html/pc-bridge Low
Product Manifest os-name Linux Medium
Product pom parent-groupid org.exoplatform.gatein.pc Low
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.gatein.pc:pc-bridge:5.3.x-SNAPSHOT
Confidence :High
activation-1.1.1.jar
Description: The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data
License:
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html
File Path: /home/ciagent/.m2/repository/javax/activation/activation/1.1.1/activation-1.1.1.jar
MD5: 46a37512971d8eca81c3fcf245bf07d2
SHA1: 485de3a253e23f645037828c07f1d7f1af40763a
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid activation Low
Vendor Manifest extension-name javax.activation Medium
Vendor pom url http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp Highest
Vendor central groupid javax.activation Highest
Vendor Manifest specification-vendor Sun Microsystems, Inc. Low
Vendor pom description The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data Medium
Vendor Manifest Implementation-Vendor-Id com.sun Medium
Vendor pom groupid javax.activation Highest
Vendor file name activation High
Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High
Vendor pom name JavaBeans(TM) Activation Framework High
Product pom groupid javax.activation Low
Product Manifest extension-name javax.activation Medium
Product central artifactid activation Highest
Product pom artifactid activation Highest
Product Manifest specification-title JavaBeans(TM) Activation Framework Specification Medium
Product pom description The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data Medium
Product pom url http://java.sun.com/javase/technologies/desktop/javabeans/jaf/index.jsp Medium
Product file name activation High
Product pom name JavaBeans(TM) Activation Framework High
Version Manifest Implementation-Version 1.1.1 High
Version pom version 1.1.1 Highest
Version central version 1.1.1 Highest
Version file version 1.1.1 Highest
jaxb-api-2.1.jar
File Path: /home/ciagent/.m2/repository/javax/xml/bind/jaxb-api/2.1/jaxb-api-2.1.jar
MD5: 9534ce6506dc96bac3944423d804be30
SHA1: d68570e722cffe2000358ce9c661a0b0bf1ebe11
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid javax.xml.bind Highest
Vendor file name jaxb-api High
Vendor Manifest extension-name javax.xml.bind Medium
Vendor pom artifactid jaxb-api Low
Vendor pom groupid javax.xml.bind Highest
Vendor Manifest specification-vendor Sun Microsystems, Inc. Low
Product pom artifactid jaxb-api Highest
Product file name jaxb-api High
Product pom groupid javax.xml.bind Low
Product Manifest extension-name javax.xml.bind Medium
Product central artifactid jaxb-api Highest
Product Manifest specification-title Java Architecture for XML Binding Medium
Version pom version 2.1 Highest
Version central version 2.1 Highest
Version file version 2.1 Highest
jaxb-impl-2.1.8.jar
File Path: /home/ciagent/.m2/repository/com/sun/xml/bind/jaxb-impl/2.1.8/jaxb-impl-2.1.8.jar
MD5: 1340264c75ea00b3d4d83e1ba57b606a
SHA1: 41b915446cb6962f9b403d1a5da3817a95ee579e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid com.sun.xml.bind Highest
Vendor pom groupid sun.xml.bind Highest
Vendor pom groupid com.sun.xml.bind Highest
Vendor file name jaxb-impl High
Vendor Manifest specification-vendor Sun Microsystems, Inc. Low
Vendor Manifest Implementation-Vendor-Id com.sun Medium
Vendor Manifest Implementation-Vendor Sun Microsystems, Inc. High
Vendor pom artifactid jaxb-impl Low
Vendor Manifest extension-name com.sun.xml.bind Medium
Product pom artifactid jaxb-impl Highest
Product central artifactid jaxb-impl Highest
Product Manifest Implementation-Title JAXB Reference Implementation High
Product file name jaxb-impl High
Product pom groupid sun.xml.bind Low
Product Manifest specification-title Java Architecture for XML Binding Medium
Product Manifest extension-name com.sun.xml.bind Medium
Version central version 2.1.8 Highest
Version file version 2.1.8 Highest
Version Manifest Implementation-Version 2.1.8 High
Version pom version 2.1.8 Highest
picketlink-idm-core-1.4.6.Final.jar
Description: PicketLink IDM IMPL contains the implementation of the API and the Identity Model.
License:
lgpl: http://repository.jboss.com/licenses/lgpl.txt
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-core/1.4.6.Final/picketlink-idm-core-1.4.6.Final.jar
MD5: a5c21c2186c186bc296d9909bcb11616
SHA1: 30d4385012393e4c50a82f8b84153eb6ee301a7d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest java-vendor Sun Microsystems Inc. Medium
Vendor pom parent-artifactid picketlink-idm-parent Low
Vendor Manifest Implementation-Vendor-Id org.picketlink.idm Medium
Vendor pom groupid picketlink.idm Highest
Vendor Manifest os-name Linux Medium
Vendor Manifest build-timestamp Fri, 27 Feb 2015 09:44:09 +0100 Low
Vendor file name picketlink-idm-core High
Vendor pom parent-groupid org.picketlink.idm Medium
Vendor pom description PicketLink IDM IMPL contains the implementation of the API and the Identity Model. Medium
Vendor pom groupid org.picketlink.idm Highest
Vendor pom organization name JBoss Inc. High
Vendor pom name PicketLink IDM Implementation High
Vendor Manifest specification-vendor JBoss Inc. Low
Vendor Manifest Implementation-Vendor JBoss Inc. High
Vendor pom artifactid picketlink-idm-core Low
Vendor Manifest implementation-url http://www.jboss.org/picketlink-idm-parent/picketlink-idm-core Low
Vendor pom organization url http://www.jboss.org Medium
Vendor central groupid org.picketlink.idm Highest
Product pom organization name JBoss Inc. Low
Product Manifest specification-title PicketLink IDM Implementation Medium
Product pom parent-groupid org.picketlink.idm Low
Product Manifest os-name Linux Medium
Product Manifest build-timestamp Fri, 27 Feb 2015 09:44:09 +0100 Low
Product file name picketlink-idm-core High
Product Manifest Implementation-Title PicketLink IDM Implementation High
Product pom description PicketLink IDM IMPL contains the implementation of the API and the Identity Model. Medium
Product pom groupid picketlink.idm Low
Product pom artifactid picketlink-idm-core Highest
Product pom parent-artifactid picketlink-idm-parent Medium
Product pom organization url http://www.jboss.org Low
Product pom name PicketLink IDM Implementation High
Product central artifactid picketlink-idm-core Highest
Product Manifest implementation-url http://www.jboss.org/picketlink-idm-parent/picketlink-idm-core Low
Version file version 1.4.6 Highest
Version Manifest Implementation-Version 1.4.6.Final High
Version pom version 1.4.6.Final Highest
Version central version 1.4.6.Final Highest
Related Dependencies
picketlink-idm-spi-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-spi/1.4.6.Final/picketlink-idm-spi-1.4.6.Final.jar
SHA1: 0804a3a34b7d031cc8daab4f4a8cbac1c00e98dd
MD5: 7289815e139890cb98b0f5a80e7b7a59
maven: org.picketlink.idm:picketlink-idm-spi:1.4.6.Final ✓
picketlink-idm-hibernate-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-hibernate/1.4.6.Final/picketlink-idm-hibernate-1.4.6.Final.jar
SHA1: 4cd6d4e7bc818d5d89e06d268302908903cd3447
MD5: 4e80873b893295bab629a5764c40b345
maven: org.picketlink.idm:picketlink-idm-hibernate:1.4.6.Final ✓
picketlink-idm-api-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-api/1.4.6.Final/picketlink-idm-api-1.4.6.Final.jar
SHA1: 6af0f6f08add632a442a6a415907460f9e8a9913
MD5: b85343ae7bcc7162b42ed3aaac08322a
maven: org.picketlink.idm:picketlink-idm-api:1.4.6.Final ✓
picketlink-idm-common-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-common/1.4.6.Final/picketlink-idm-common-1.4.6.Final.jar
SHA1: 37c1309fd376db4f4ff969fb0df4f8c388e2022c
MD5: 1ad4f8384e856abf4696895d7647dabf
maven: org.picketlink.idm:picketlink-idm-common:1.4.6.Final ✓
picketlink-idm-ldap-1.4.6.Final.jar
File Path: /home/ciagent/.m2/repository/org/picketlink/idm/picketlink-idm-ldap/1.4.6.Final/picketlink-idm-ldap-1.4.6.Final.jar
SHA1: b52fefb76b4f2d047422f4ff5caff9c7a18001f3
MD5: 7da4240664f237384cd33b35939ff153
maven: org.picketlink.idm:picketlink-idm-ldap:1.4.6.Final ✓
Published Vulnerabilities
CVE-2015-0277 suppress
Severity:
Medium
CVSS Score: 6.0
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-284 Improper Access Control
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
Vulnerable Software & Versions:
CVE-2015-3158 suppress
Severity:
Medium
CVSS Score: 4.0
(AV:N/AC:L/Au:S/C:P/I:N/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
Vulnerable Software & Versions:
CVE-2015-6254 suppress
Severity:
Medium
CVSS Score: 6.0
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
CWE: CWE-17 Code
The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
Vulnerable Software & Versions:
mop-api-1.3.2.Final.jar
Description: API of the Object Model for Portal
File Path: /home/ciagent/.m2/repository/org/gatein/mop/mop-api/1.3.2.Final/mop-api-1.3.2.Final.jar
MD5: 4f2c10678f3c5850bb85c25514469e2e
SHA1: 78f9c03a23ec1c3564e827d3927ce53eca6d919d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid org.gatein.mop Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor pom description API of the Object Model for Portal Medium
Vendor Manifest Implementation-Vendor-Id org.gatein.mop Medium
Vendor pom parent-artifactid mop-parent Low
Vendor Manifest implementation-url www.gatein.org/mop-parent/mop-api/ Low
Vendor pom artifactid mop-api Low
Vendor file name mop-api High
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor pom groupid gatein.mop Highest
Vendor Manifest os-name Mac OS X Medium
Vendor Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low
Vendor pom name MOP API High
Vendor pom groupid org.gatein.mop Highest
Product pom groupid gatein.mop Low
Product pom parent-artifactid mop-parent Medium
Product pom artifactid mop-api Highest
Product pom parent-groupid org.gatein.mop Low
Product pom description API of the Object Model for Portal Medium
Product Manifest implementation-url www.gatein.org/mop-parent/mop-api/ Low
Product Manifest specification-title MOP API Medium
Product file name mop-api High
Product Manifest Implementation-Title MOP API High
Product Manifest os-name Mac OS X Medium
Product Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low
Product pom name MOP API High
Version file version 1.3.2 Highest
Version Manifest Implementation-Version 1.3.2.Final High
Version pom version 1.3.2.Final Highest
maven: org.gatein.mop:mop-api:1.3.2.Final
Confidence :High
mop-spi-1.3.2.Final.jar
Description: SPI of the Object Model for Portal
File Path: /home/ciagent/.m2/repository/org/gatein/mop/mop-spi/1.3.2.Final/mop-spi-1.3.2.Final.jar
MD5: 6ef18d761e625d923ec01c6e5283026e
SHA1: 4fe3a673d58c85d2f6c9ad4446b90229f46c8987
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid org.gatein.mop Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest Implementation-Vendor-Id org.gatein.mop Medium
Vendor pom parent-artifactid mop-parent Low
Vendor Manifest implementation-url www.gatein.org/mop-parent/mop-spi/ Low
Vendor pom description SPI of the Object Model for Portal Medium
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor pom artifactid mop-spi Low
Vendor pom name MOP SPI High
Vendor pom groupid gatein.mop Highest
Vendor Manifest os-name Mac OS X Medium
Vendor file name mop-spi High
Vendor Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low
Vendor pom groupid org.gatein.mop Highest
Product pom groupid gatein.mop Low
Product Manifest Implementation-Title MOP SPI High
Product pom parent-artifactid mop-parent Medium
Product pom parent-groupid org.gatein.mop Low
Product Manifest specification-title MOP SPI Medium
Product Manifest implementation-url www.gatein.org/mop-parent/mop-spi/ Low
Product pom description SPI of the Object Model for Portal Medium
Product pom name MOP SPI High
Product Manifest os-name Mac OS X Medium
Product pom artifactid mop-spi Highest
Product file name mop-spi High
Product Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low
Version file version 1.3.2 Highest
Version Manifest Implementation-Version 1.3.2.Final High
Version pom version 1.3.2.Final Highest
maven: org.gatein.mop:mop-spi:1.3.2.Final
Confidence :High
mop-core-1.3.2.Final.jar
Description: Model Object for Portal Core
File Path: /home/ciagent/.m2/repository/org/gatein/mop/mop-core/1.3.2.Final/mop-core-1.3.2.Final.jar
MD5: 7d5eb7a5c2ed2d88362f9d8a9413a475
SHA1: d27e4c960aefd919f7c25049b72a9bc225cd6548
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid org.gatein.mop Medium
Vendor file name mop-core High
Vendor pom artifactid mop-core Low
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest Implementation-Vendor-Id org.gatein.mop Medium
Vendor pom parent-artifactid mop-parent Low
Vendor pom name MOP Core High
Vendor pom description Model Object for Portal Core Medium
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor Manifest implementation-url www.gatein.org/mop-parent/mop-core/ Low
Vendor pom groupid gatein.mop Highest
Vendor Manifest os-name Mac OS X Medium
Vendor Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low
Vendor pom groupid org.gatein.mop Highest
Product file name mop-core High
Product pom groupid gatein.mop Low
Product Manifest Implementation-Title MOP Core High
Product pom parent-artifactid mop-parent Medium
Product pom parent-groupid org.gatein.mop Low
Product pom name MOP Core High
Product pom description Model Object for Portal Core Medium
Product Manifest specification-title MOP Core Medium
Product Manifest implementation-url www.gatein.org/mop-parent/mop-core/ Low
Product pom artifactid mop-core Highest
Product Manifest os-name Mac OS X Medium
Product Manifest build-timestamp Mon, 14 Apr 2014 17:58:13 +0200 Low
Version file version 1.3.2 Highest
Version Manifest Implementation-Version 1.3.2.Final High
Version pom version 1.3.2.Final Highest
maven: org.gatein.mop:mop-core:1.3.2.Final
Confidence :High
gatein-management-api-2.1.0.Final.jar
File Path: /home/ciagent/.m2/repository/org/gatein/management/gatein-management-api/2.1.0.Final/gatein-management-api-2.1.0.Final.jar
MD5: dde253e45fefd580cab7a4ee75c6d92e
SHA1: 5c73b152fe9497eb37386052f86bfa7ee7d33b87
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-api/ Low
Vendor pom parent-artifactid gatein-management-parent Low
Vendor pom parent-groupid org.gatein.management Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom groupid org.gatein.management Highest
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor file name gatein-management-api High
Vendor Manifest os-name Linux Medium
Vendor pom groupid gatein.management Highest
Vendor pom name GateIn Management - API High
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor Manifest Implementation-Vendor-Id org.gatein.management Medium
Vendor pom artifactid gatein-management-api Low
Vendor Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low
Product pom artifactid gatein-management-api Highest
Product pom parent-groupid org.gatein.management Low
Product pom name GateIn Management - API High
Product Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-api/ Low
Product Manifest specification-title GateIn Management - API Medium
Product pom groupid gatein.management Low
Product pom parent-artifactid gatein-management-parent Medium
Product file name gatein-management-api High
Product Manifest Implementation-Title GateIn Management - API High
Product Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low
Product Manifest os-name Linux Medium
Version Manifest Implementation-Version 2.1.0.Final High
Version pom version 2.1.0.Final Highest
Version file version 2.1.0 Highest
maven: org.gatein.management:gatein-management-api:2.1.0.Final
Confidence :High
gatein-management-spi-2.1.0.Final.jar
File Path: /home/ciagent/.m2/repository/org/gatein/management/gatein-management-spi/2.1.0.Final/gatein-management-spi-2.1.0.Final.jar
MD5: 4e10565858662ec9eea75cfbd3544ba1
SHA1: 79670b2dd849b49e145b7122cbff4ef83116157f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid gatein-management-parent Low
Vendor Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-spi/ Low
Vendor pom parent-groupid org.gatein.management Medium
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor pom groupid org.gatein.management Highest
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest os-name Linux Medium
Vendor file name gatein-management-spi High
Vendor pom groupid gatein.management Highest
Vendor pom artifactid gatein-management-spi Low
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor Manifest Implementation-Vendor-Id org.gatein.management Medium
Vendor pom name GateIn Management - SPI High
Vendor Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low
Product Manifest specification-title GateIn Management - SPI Medium
Product file name gatein-management-spi High
Product pom parent-groupid org.gatein.management Low
Product Manifest implementation-url www.gatein.org/gatein-management-parent/gatein-management-spi/ Low
Product Manifest Implementation-Title GateIn Management - SPI High
Product pom groupid gatein.management Low
Product pom parent-artifactid gatein-management-parent Medium
Product pom artifactid gatein-management-spi Highest
Product pom name GateIn Management - SPI High
Product Manifest build-timestamp Mon, 17 Mar 2014 21:15:40 +0100 Low
Product Manifest os-name Linux Medium
Version Manifest Implementation-Version 2.1.0.Final High
Version pom version 2.1.0.Final Highest
Version file version 2.1.0 Highest
maven: org.gatein.management:gatein-management-spi:2.1.0.Final
Confidence :High
groovy-all-2.4.12.jar
Description: Groovy: A powerful, dynamic language for the JVM
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/codehaus/groovy/groovy-all/2.4.12/groovy-all-2.4.12.jar
MD5: dddb0b3d3619875fa1c538c743ae8f99
SHA1: 760afc568cbd94c09d78f801ce51aed1326710af
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description Groovy: A powerful, dynamic language for the JVM Medium
Vendor pom groupid org.codehaus.groovy Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom name Apache Groovy High
Vendor manifest Bundle-Description Groovy Runtime Medium
Vendor pom organization name Apache Software Foundation High
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor Manifest bundle-symbolicname groovy-all Medium
Vendor pom artifactid groovy-all Low
Vendor file name groovy-all High
Vendor Manifest extension-name groovy Medium
Vendor pom organization url http://groovy-lang.org Medium
Vendor pom groupid codehaus.groovy Highest
Vendor central groupid org.codehaus.groovy Highest
Vendor pom url http://groovy-lang.org Highest
Vendor Manifest originally-created-by 1.8.0_131-b11 (Oracle Corporation) Low
Product pom description Groovy: A powerful, dynamic language for the JVM Medium
Product Manifest Bundle-Name Groovy Runtime Medium
Product pom organization url http://groovy-lang.org Low
Product pom name Apache Groovy High
Product Manifest specification-title Groovy: a powerful, dynamic language for the JVM Medium
Product manifest Bundle-Description Groovy Runtime Medium
Product Manifest bundle-symbolicname groovy-all Medium
Product pom url http://groovy-lang.org Medium
Product Manifest Implementation-Title Groovy: a powerful, dynamic language for the JVM High
Product pom groupid codehaus.groovy Low
Product file name groovy-all High
Product Manifest extension-name groovy Medium
Product pom artifactid groovy-all Highest
Product pom organization name Apache Software Foundation Low
Product Manifest originally-created-by 1.8.0_131-b11 (Oracle Corporation) Low
Product central artifactid groovy-all Highest
Version Manifest Implementation-Version 2.4.12 High
Version pom version 2.4.12 Highest
Version file version 2.4.12 Highest
Version central version 2.4.12 Highest
twitter4j-core-3.0.5.jar
Description: A Java library for the Twitter API
License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/ciagent/.m2/repository/org/twitter4j/twitter4j-core/3.0.5/twitter4j-core-3.0.5.jar
MD5: e6c8d2b10c621b2bbd7809bad9cedca3
SHA1: c38ad47bc8ba5991886ce2c0e0acd76d0fdd6e6d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid twitter4j-core Low
Vendor pom name twitter4j-core High
Vendor file name twitter4j-core High
Vendor pom groupid twitter4j Highest
Vendor central groupid org.twitter4j Highest
Vendor pom url http://twitter4j.org/ Highest
Vendor Manifest Implementation-Vendor-Id org.twitter4j Medium
Vendor pom description A Java library for the Twitter API Medium
Vendor pom groupid org.twitter4j Highest
Product pom name twitter4j-core High
Product central artifactid twitter4j-core Highest
Product file name twitter4j-core High
Product pom artifactid twitter4j-core Highest
Product Manifest specification-title twitter4j-core Medium
Product pom url http://twitter4j.org/ Medium
Product Manifest Implementation-Title twitter4j-core High
Product pom description A Java library for the Twitter API Medium
Product pom groupid twitter4j Low
Version pom version 3.0.5 Highest
Version Manifest Implementation-Version 3.0.5 High
Version central version 3.0.5 Highest
Version file version 3.0.5 Highest
cpe: cpe:/a:twitter_project:twitter:3.0.5
Confidence :Low
suppress
maven: org.twitter4j:twitter4j-core:3.0.5 ✓
Confidence :Highest
cpe: cpe:/a:twitter:twitter:3.0.5
Confidence :Low
suppress
scribe-1.3.5.jar
Description: The best OAuth library out there
License:
MIT: http://github.com/fernandezpablo85/scribe-java/blob/master/LICENSE.txt
File Path: /home/ciagent/.m2/repository/org/scribe/scribe/1.3.5/scribe-1.3.5.jar
MD5: 0abb910da19741cd84aabf5520385bc2
SHA1: a3b3deded9d241d9f2c8aa9c9bcd90ad29e2581e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.scribe Highest
Vendor pom artifactid scribe Low
Vendor pom groupid scribe Highest
Vendor jar package name builder Low
Vendor pom groupid org.scribe Highest
Vendor pom description The best OAuth library out there Medium
Vendor pom url http://github.com/fernandezpablo85/scribe-java Highest
Vendor pom name Scribe OAuth Library High
Vendor jar package name scribe Low
Vendor file name scribe High
Vendor jar package name api Low
Product central artifactid scribe Highest
Product jar package name builder Low
Product pom description The best OAuth library out there Medium
Product pom url http://github.com/fernandezpablo85/scribe-java Medium
Product pom groupid scribe Low
Product pom name Scribe OAuth Library High
Product pom artifactid scribe Highest
Product file name scribe High
Product jar package name api Low
Version central version 1.3.5 Highest
Version file version 1.3.5 Highest
Version pom version 1.3.5 Highest
google-http-client-1.14.1-beta.jar
Description:
Google HTTP Client Library for Java. Functionality that works on all supported Java platforms,
including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.
File Path: /home/ciagent/.m2/repository/com/google/http-client/google-http-client/1.14.1-beta/google-http-client-1.14.1-beta.jar
MD5: 8a3711522ebceef2531d455e2f04a639
SHA1: cb503d4021739e6bac39442ac87b4e311ec77b5e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid com.google.http-client Medium
Vendor pom name Google HTTP Client Library for Java High
Vendor pom groupid google.http-client Highest
Vendor central groupid com.google.http-client Highest
Vendor pom artifactid google-http-client Low
Vendor pom parent-artifactid google-http-client-parent Low
Vendor pom description Google HTTP Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine. Low
Vendor Manifest Implementation-Vendor Google High
Vendor pom groupid com.google.http-client Highest
Vendor Manifest Implementation-Vendor-Id com.google.http-client Medium
Vendor file name google-http-client High
Product pom name Google HTTP Client Library for Java High
Product pom description Google HTTP Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine. Low
Product pom groupid google.http-client Low
Product central artifactid google-http-client Highest
Product Manifest Implementation-Title Google HTTP Client Library for Java High
Product pom parent-groupid com.google.http-client Low
Product pom artifactid google-http-client Highest
Product file name google-http-client High
Product pom parent-artifactid google-http-client-parent Medium
Version file version 1.14.1.beta Highest
Version Manifest Implementation-Version 1.14.1-beta High
Version pom version 1.14.1-beta Highest
Version central version 1.14.1-beta Highest
google-oauth-client-1.14.1-beta.jar
Description:
Google OAuth Client Library for Java. Functionality that works on all supported Java platforms,
including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.
File Path: /home/ciagent/.m2/repository/com/google/oauth-client/google-oauth-client/1.14.1-beta/google-oauth-client-1.14.1-beta.jar
MD5: 71feea1d54eb7878c12855b7c47ef289
SHA1: 7260cd30808a6d1d4ddef6250e3d92d814aaa4cb
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name Google OAuth Client Library for Java High
Vendor Manifest Implementation-Vendor-Id com.google.oauth-client Medium
Vendor pom description Google OAuth Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine. Low
Vendor pom parent-artifactid google-oauth-client-parent Low
Vendor file name google-oauth-client High
Vendor pom parent-groupid com.google.oauth-client Medium
Vendor pom groupid com.google.oauth-client Highest
Vendor Manifest Implementation-Vendor Google High
Vendor pom artifactid google-oauth-client Low
Vendor pom groupid google.oauth-client Highest
Vendor central groupid com.google.oauth-client Highest
Product pom name Google OAuth Client Library for Java High
Product pom description Google OAuth Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine. Low
Product pom artifactid google-oauth-client Highest
Product file name google-oauth-client High
Product pom parent-groupid com.google.oauth-client Low
Product pom groupid google.oauth-client Low
Product Manifest Implementation-Title Google OAuth Client Library for Java High
Product central artifactid google-oauth-client Highest
Product pom parent-artifactid google-oauth-client-parent Medium
Version file version 1.14.1.beta Highest
Version Manifest Implementation-Version 1.14.1-beta High
Version pom version 1.14.1-beta Highest
Version central version 1.14.1-beta Highest
google-api-client-1.14.1-beta.jar
File Path: /home/ciagent/.m2/repository/com/google/api-client/google-api-client/1.14.1-beta/google-api-client-1.14.1-beta.jar
MD5: 6832804471d4d635ed74ae1fbd5d9d86
SHA1: e95d3b6e36fc67bffd7e71ef60bc5af623e73843
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid com.google.api-client Highest
Vendor Manifest Implementation-Vendor-Id com.google.api-client Medium
Vendor pom groupid google.api-client Highest
Vendor pom name Google APIs Client Library for Java High
Vendor pom parent-groupid com.google.api-client Medium
Vendor Manifest Implementation-Vendor Google High
Vendor pom artifactid google-api-client Low
Vendor file name google-api-client High
Vendor central groupid com.google.api-client Highest
Vendor pom parent-artifactid google-api-client-parent Low
Product pom artifactid google-api-client Highest
Product pom name Google APIs Client Library for Java High
Product pom groupid google.api-client Low
Product pom parent-artifactid google-api-client-parent Medium
Product central artifactid google-api-client Highest
Product Manifest Implementation-Title Google APIs Client Library for Java High
Product pom parent-groupid com.google.api-client Low
Product file name google-api-client High
Version file version 1.14.1.beta Highest
Version Manifest Implementation-Version 1.14.1-beta High
Version pom version 1.14.1-beta Highest
Version central version 1.14.1-beta Highest
jackson-core-asl-1.9.11.jar
Description: Jackson is a high-performance JSON processor (parser, generator)
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/codehaus/jackson/jackson-core-asl/1.9.11/jackson-core-asl-1.9.11.jar
MD5: 49801a6d43725d5c3a1a52ca021d7dc5
SHA1: e32303ef8bd18a5c9272780d49b81c95e05ddf43
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor http://www.ietf.org/rfc/rfc4627.txt Low
Vendor pom name Jackson High
Vendor file name jackson-core-asl High
Vendor pom organization name FasterXML High
Vendor central groupid org.codehaus.jackson Highest
Vendor Manifest Implementation-Vendor http://fasterxml.com High
Vendor pom organization url http://fasterxml.com Medium
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low
Vendor pom groupid org.codehaus.jackson Highest
Vendor pom groupid codehaus.jackson Highest
Vendor pom description Jackson is a high-performance JSON processor (parser, generator)
Medium
Vendor pom artifactid jackson-core-asl Low
Vendor pom url http://jackson.codehaus.org Highest
Vendor Manifest bundle-symbolicname jackson-core-asl Medium
Product pom groupid codehaus.jackson Low
Product Manifest Implementation-Title Jackson JSON processor High
Product pom name Jackson High
Product Manifest Bundle-Name Jackson JSON processor Medium
Product file name jackson-core-asl High
Product pom organization url http://fasterxml.com Low
Product Manifest specification-title JSON - JavaScript Object Notation Medium
Product central artifactid jackson-core-asl Highest
Product pom artifactid jackson-core-asl Highest
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6 Low
Product pom organization name FasterXML Low
Product pom description Jackson is a high-performance JSON processor (parser, generator)
Medium
Product pom url http://jackson.codehaus.org Medium
Product Manifest bundle-symbolicname jackson-core-asl Medium
Version Manifest Implementation-Version 1.9.11 High
Version pom version 1.9.11 Highest
Version central version 1.9.11 Highest
Version file version 1.9.11 Highest
google-http-client-jackson-1.14.1-beta.jar
File Path: /home/ciagent/.m2/repository/com/google/http-client/google-http-client-jackson/1.14.1-beta/google-http-client-jackson-1.14.1-beta.jar
MD5: 85d9f42910a68e85ff22d24805688da9
SHA1: 3cfc08bf4b0f62234ff69ff2a0b3c26d7e447829
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-groupid com.google.http-client Medium
Vendor pom groupid google.http-client Highest
Vendor central groupid com.google.http-client Highest
Vendor pom parent-artifactid google-http-client-parent Low
Vendor Manifest Implementation-Vendor Google High
Vendor pom artifactid google-http-client-jackson Low
Vendor pom groupid com.google.http-client Highest
Vendor Manifest Implementation-Vendor-Id com.google.http-client Medium
Vendor file name google-http-client-jackson High
Vendor pom name Jackson extensions to the Google HTTP Client Library for Java. High
Product pom artifactid google-http-client-jackson Highest
Product Manifest Implementation-Title Jackson extensions to the Google HTTP Client Library for Java. High
Product central artifactid google-http-client-jackson Highest
Product pom groupid google.http-client Low
Product pom parent-groupid com.google.http-client Low
Product file name google-http-client-jackson High
Product pom parent-artifactid google-http-client-parent Medium
Product pom name Jackson extensions to the Google HTTP Client Library for Java. High
Version file version 1.14.1.beta Highest
Version Manifest Implementation-Version 1.14.1-beta High
Version pom version 1.14.1-beta Highest
Version central version 1.14.1-beta Highest
google-api-services-plus-v1-rev69-1.14.2-beta.jar
File Path: /home/ciagent/.m2/repository/com/google/apis/google-api-services-plus/v1-rev69-1.14.2-beta/google-api-services-plus-v1-rev69-1.14.2-beta.jar
MD5: fbddf71619f41f1359f0b3abff442444
SHA1: a6c5cc69690a3bd7777025a65b0f1abe66112a5e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid google-api-services-plus Low
Vendor jar package name google Low
Vendor jar package name services Low
Vendor pom parent-groupid com.google Medium
Vendor pom groupid google.apis Highest
Vendor central groupid com.google.apis Highest
Vendor file name google-api-services-plus-v1-rev69 High
Vendor pom name Google+ API v1 (revision 69) High
Vendor pom parent-artifactid google Low
Vendor pom groupid com.google.apis Highest
Vendor jar package name api Low
Product pom groupid google.apis Low
Product jar package name services Low
Product pom parent-artifactid google Medium
Product pom artifactid google-api-services-plus Highest
Product jar package name plus Low
Product file name google-api-services-plus-v1-rev69 High
Product pom parent-groupid com.google Low
Product pom name Google+ API v1 (revision 69) High
Product central artifactid google-api-services-plus Highest
Product jar package name api Low
Version pom version v1-rev69-1.14.2-beta Highest
Version file version 1.14.2.beta Highest
Version file name google-api-services-plus-v1-rev69 Medium
Version pom parent-version v1-rev69-1.14.2-beta Low
Version central version v1-rev69-1.14.2-beta Highest
google-api-services-oauth2-v2-rev36-1.14.2-beta.jar
File Path: /home/ciagent/.m2/repository/com/google/apis/google-api-services-oauth2/v2-rev36-1.14.2-beta/google-api-services-oauth2-v2-rev36-1.14.2-beta.jar
MD5: cd2ac31ad0317e53e660c2a4578749f3
SHA1: c7249e1e4832f6e6585f7b7db307585b3ae53881
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor file name google-api-services-oauth2-v2-rev36 High
Vendor jar package name google Low
Vendor jar package name services Low
Vendor pom name Google OAuth2 API v2 (revision 36) High
Vendor pom parent-groupid com.google Medium
Vendor pom groupid google.apis Highest
Vendor central groupid com.google.apis Highest
Vendor pom artifactid google-api-services-oauth2 Low
Vendor pom parent-artifactid google Low
Vendor pom groupid com.google.apis Highest
Vendor jar package name api Low
Product pom groupid google.apis Low
Product pom artifactid google-api-services-oauth2 Highest
Product file name google-api-services-oauth2-v2-rev36 High
Product jar package name services Low
Product pom parent-artifactid google Medium
Product pom name Google OAuth2 API v2 (revision 36) High
Product jar package name oauth2 Low
Product pom parent-groupid com.google Low
Product central artifactid google-api-services-oauth2 Highest
Product jar package name api Low
Version pom version v2-rev36-1.14.2-beta Highest
Version central version v2-rev36-1.14.2-beta Highest
Version pom parent-version v2-rev36-1.14.2-beta Low
Version file version 1.14.2.beta Highest
Version file name google-api-services-oauth2-v2-rev36 Medium
joda-time-2.4.jar
Description: Date and time library to replace JDK date handling
License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/joda-time/joda-time/2.4/joda-time-2.4.jar
MD5: 1231c3e09de6aa5d6b6d9982c0224e20
SHA1: 89e9725439adffbbd41c5f5c215c136082b34a7f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest Implementation-Vendor Joda.org High
Vendor Manifest bundle-docurl http://www.joda.org/joda-time/ Low
Vendor Manifest Implementation-Vendor-Id org.joda Medium
Vendor pom description Date and time library to replace JDK date handling Medium
Vendor pom name Joda-Time High
Vendor Manifest extension-name joda-time Medium
Vendor pom groupid joda-time Highest
Vendor pom artifactid joda-time Low
Vendor file name joda-time High
Vendor Manifest specification-vendor Joda.org Low
Vendor pom url http://www.joda.org/joda-time/ Highest
Vendor central groupid joda-time Highest
Vendor pom organization url http://www.joda.org Medium
Vendor Manifest bundle-symbolicname joda-time Medium
Vendor pom organization name Joda.org High
Product central artifactid joda-time Highest
Product pom artifactid joda-time Highest
Product Manifest specification-title Joda-Time Medium
Product pom organization url http://www.joda.org Low
Product Manifest bundle-docurl http://www.joda.org/joda-time/ Low
Product pom description Date and time library to replace JDK date handling Medium
Product pom name Joda-Time High
Product Manifest extension-name joda-time Medium
Product pom organization name Joda.org Low
Product Manifest Bundle-Name Joda-Time Medium
Product file name joda-time High
Product pom groupid joda-time Low
Product Manifest Implementation-Title org.joda.time High
Product Manifest bundle-symbolicname joda-time Medium
Product pom url http://www.joda.org/joda-time/ Medium
Version Manifest Implementation-Version 2.4 High
Version central version 2.4 Highest
Version pom version 2.4 Highest
Version file version 2.4 Highest
ehcache-core-2.6.9.jar
Description: This is the ehcache core module. Pair it with other modules for added functionality.
License:
The Apache Software License, Version 2.0: src/assemble/EHCACHE-CORE-LICENSE.txt
File Path: /home/ciagent/.m2/repository/net/sf/ehcache/ehcache-core/2.6.9/ehcache-core-2.6.9.jar
MD5: 521348c6da7c20dba2058917a6a8c0a9
SHA1: e892585cc2cf95d46a2533df438a1d3323034ae8
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid ehcache-parent Low
Vendor central groupid net.sf.ehcache Highest
Vendor pom name Ehcache Core High
Vendor pom artifactid ehcache-core Low
Vendor file name ehcache-core High
Vendor pom url http://ehcache.org Highest
Vendor pom description This is the ehcache core module. Pair it with other modules for added functionality. Medium
Vendor pom groupid net.sf.ehcache Highest
Product pom name Ehcache Core High
Product central artifactid ehcache-core Highest
Product pom groupid net.sf.ehcache Low
Product pom parent-artifactid ehcache-parent Medium
Product file name ehcache-core High
Product pom description This is the ehcache core module. Pair it with other modules for added functionality. Medium
Product pom url http://ehcache.org Medium
Product pom artifactid ehcache-core Highest
Version file version 2.6.9 Highest
Version pom version 2.6.9 Highest
Version central version 2.6.9 Highest
juel-impl-2.2.7.jar
File Path: /home/ciagent/.m2/repository/de/odysseus/juel/juel-impl/2.2.7/juel-impl-2.2.7.jar
MD5: c5d7a62edafb5706b6beadbbcfd8f57d
SHA1: 97958467acef4c2b230b72354a4eefc66628dd99
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid de.odysseus.juel Highest
Vendor pom parent-artifactid juel-parent Low
Vendor Manifest bundle-symbolicname de.odysseus.juel-impl Medium
Vendor pom artifactid juel-impl Low
Vendor Manifest Implementation-Vendor Odysseus Software GmbH High
Vendor Manifest Implementation-Vendor-Id de.odysseus Medium
Vendor pom groupid de.odysseus.juel Highest
Vendor Manifest service-component OSGI-INF/services.xml Low
Vendor file name juel-impl High
Vendor Manifest specification-vendor Sun Microsystems Inc. Low
Vendor pom name Java Unified Expression Language Implementation High
Product pom groupid de.odysseus.juel Low
Product Manifest bundle-symbolicname de.odysseus.juel-impl Medium
Product central artifactid juel-impl Highest
Product Manifest Implementation-Title JUEL High
Product pom parent-artifactid juel-parent Medium
Product Manifest specification-title Expression Language Medium
Product Manifest service-component OSGI-INF/services.xml Low
Product pom artifactid juel-impl Highest
Product file name juel-impl High
Product Manifest Bundle-Name Expression Language Implementation Medium
Product pom name Java Unified Expression Language Implementation High
Version central version 2.2.7 Highest
Version file version 2.2.7 Highest
Version Manifest Implementation-Version 2.2.7 High
Version pom version 2.2.7 Highest
shindig-common-2.5.2.jar
Description: Common java code for Shindig
File Path: /home/ciagent/.m2/repository/org/apache/shindig/shindig-common/2.5.2/shindig-common-2.5.2.jar
MD5: 9deeebec74d0530849d5dd42e19ee9cd
SHA1: 8e3d0ee31607e7a18f20612ef705b32ab8eace2b
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid apache.shindig Highest
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom name Apache Shindig Common Code High
Vendor pom groupid org.apache.shindig Highest
Vendor file name shindig-common High
Vendor Manifest Implementation-Vendor-Id org.apache.shindig Medium
Vendor pom parent-groupid org.apache.shindig Medium
Vendor pom description Common java code for Shindig Medium
Vendor pom parent-artifactid shindig-project Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor central groupid org.apache.shindig Highest
Vendor pom artifactid shindig-common Low
Product pom parent-groupid org.apache.shindig Low
Product pom parent-artifactid shindig-project Medium
Product pom name Apache Shindig Common Code High
Product file name shindig-common High
Product Manifest Implementation-Title Apache Shindig Common Code High
Product pom groupid apache.shindig Low
Product pom artifactid shindig-common Highest
Product Manifest specification-title Apache Shindig Common Code Medium
Product central artifactid shindig-common Highest
Product pom description Common java code for Shindig Medium
Version central version 2.5.2 Highest
Version file version 2.5.2 Highest
Version Manifest Implementation-Version 2.5.2 High
Version pom version 2.5.2 Highest
Related Dependencies
shindig-gadgets-2.5.2.jar
File Path: /home/ciagent/.m2/repository/org/apache/shindig/shindig-gadgets/2.5.2/shindig-gadgets-2.5.2.jar
SHA1: ad7a540e121450a885d053c9edf59eae423a64c5
MD5: aaca1591b9f8b82ac1859b56184711b0
maven: org.apache.shindig:shindig-gadgets:2.5.2 ✓
shindig-features-2.5.2.jar
File Path: /home/ciagent/.m2/repository/org/apache/shindig/shindig-features/2.5.2/shindig-features-2.5.2.jar
SHA1: 8da6aa8af98070e4aefe9434628db2f23cfea80d
MD5: ae2ff4a2cfe4dff4897273cb28906654
maven: org.apache.shindig:shindig-features:2.5.2 ✓
shindig-social-api-2.5.2.jar
File Path: /home/ciagent/.m2/repository/org/apache/shindig/shindig-social-api/2.5.2/shindig-social-api-2.5.2.jar
SHA1: d8eba76e26bc2e2c4b34d0ee4575816a27f26c96
MD5: eac1069ed022e9ba99b6d9703022cb99
maven: org.apache.shindig:shindig-social-api:2.5.2 ✓
filters-2.0.235.jar
Description: A collection of image processing filters.
License:
Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/ciagent/.m2/repository/com/jhlabs/filters/2.0.235/filters-2.0.235.jar
MD5: d91073d6b28e2505e96620709626495f
SHA1: af6a2dfefef70f1ab2d7a8d1f8173f67e276b3f4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name JHLabs Image Processing Filters High
Vendor pom description A collection of image processing filters. Medium
Vendor file name filters High
Vendor central groupid com.jhlabs Highest
Vendor pom groupid jhlabs Highest
Vendor pom url http://www.jhlabs.com/ip/index.html Highest
Vendor pom groupid com.jhlabs Highest
Vendor pom artifactid filters Low
Vendor Manifest Implementation-Vendor-Id com.jhlabs Medium
Product pom name JHLabs Image Processing Filters High
Product central artifactid filters Highest
Product pom groupid jhlabs Low
Product pom description A collection of image processing filters. Medium
Product pom artifactid filters Highest
Product file name filters High
Product Manifest specification-title JHLabs Image Processing Filters Medium
Product pom url http://www.jhlabs.com/ip/index.html Medium
Product Manifest Implementation-Title JHLabs Image Processing Filters High
Version file version 2.0.235 Highest
Version Manifest Implementation-Version 2.0.235 High
Version pom version 2.0.235 Highest
Version central version 2.0.235 Highest
Published Vulnerabilities
CVE-2005-0406 suppress
Severity:
Low
CVSS Score: 2.1
(AV:L/AC:L/Au:N/C:P/I:N/A:N)
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.
Vulnerable Software & Versions:
CVE-2018-1000840 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
Vulnerable Software & Versions:
simplecaptcha-1.1.1.Final-gatein-4.jar
File Path: /home/ciagent/.m2/repository/org/gatein/captcha/simplecaptcha/1.1.1.Final-gatein-4/simplecaptcha-1.1.1.Final-gatein-4.jar
MD5: a8b83c67e6fd04cd02d8ebcfd47348c1
SHA1: 964c53fedc87745494c5f8f2cd62b2548dbdeff5
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest Implementation-Vendor-Id org.gatein.captcha Medium
Vendor pom parent-groupid org.gatein Medium
Vendor pom groupid org.gatein.captcha Highest
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest build-timestamp Mon, 17 Jun 2013 09:04:01 +0200 Low
Vendor Manifest os-name Linux Medium
Vendor pom name GateIn SimpleCaptcha High
Vendor file name simplecaptcha High
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor pom groupid gatein.captcha Highest
Vendor pom artifactid simplecaptcha Low
Vendor pom parent-artifactid gatein-parent Low
Vendor Manifest implementation-url www.gatein.org/simplecaptcha/ Low
Product pom name GateIn SimpleCaptcha High
Product file name simplecaptcha High
Product pom groupid gatein.captcha Low
Product pom parent-artifactid gatein-parent Medium
Product Manifest Implementation-Title GateIn SimpleCaptcha High
Product Manifest specification-title GateIn SimpleCaptcha Medium
Product pom parent-groupid org.gatein Low
Product pom artifactid simplecaptcha Highest
Product Manifest build-timestamp Mon, 17 Jun 2013 09:04:01 +0200 Low
Product Manifest os-name Linux Medium
Product Manifest implementation-url www.gatein.org/simplecaptcha/ Low
Version Manifest Implementation-Version 1.1.1.Final-gatein-4 High
Version pom version 1.1.1.Final-gatein-4 Highest
maven: org.gatein.captcha:simplecaptcha:1.1.1.Final-gatein-4
Confidence :High
gatein-api-1.0.1.Final.jar
File Path: /home/ciagent/.m2/repository/org/gatein/api/gatein-api/1.0.1.Final/gatein-api-1.0.1.Final.jar
MD5: 04d51eb4e2734df16f83e514b7110000
SHA1: b67727b03994e6081e2e411804c25bd5d0d919a6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.gatein.api Highest
Vendor file name gatein-api High
Vendor pom parent-groupid org.gatein Medium
Vendor Manifest Implementation-Vendor-Id org.gatein.api Medium
Vendor pom groupid org.gatein.api Highest
Vendor Manifest java-vendor Oracle Corporation Medium
Vendor Manifest Implementation-Vendor JBoss by Red Hat High
Vendor Manifest os-name Linux Medium
Vendor pom artifactid gatein-api Low
Vendor Manifest build-timestamp Tue, 30 Jul 2013 09:10:07 -0400 Low
Vendor Manifest specification-vendor JBoss by Red Hat Low
Vendor pom groupid gatein.api Highest
Vendor pom parent-artifactid gatein-parent Low
Vendor Manifest implementation-url www.gatein.org/gatein-api/ Low
Product file name gatein-api High
Product pom groupid gatein.api Low
Product pom parent-artifactid gatein-parent Medium
Product pom artifactid gatein-api Highest
Product Manifest Implementation-Title gatein-api High
Product Manifest build-timestamp Tue, 30 Jul 2013 09:10:07 -0400 Low
Product pom parent-groupid org.gatein Low
Product central artifactid gatein-api Highest
Product Manifest specification-title gatein-api Medium
Product Manifest os-name Linux Medium
Product Manifest implementation-url www.gatein.org/gatein-api/ Low
Version central version 1.0.1.Final Highest
Version pom version 1.0.1.Final Highest
Version file version 1.0.1 Highest
Version Manifest Implementation-Version 1.0.1.Final High
json-simple-1.1.1.jar
Description: A simple Java toolkit for JSON
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/googlecode/json-simple/json-simple/1.1.1/json-simple-1.1.1.jar
MD5: 5cc2c478d73e8454b4c369cee66c5bc7
SHA1: c9ad4a0850ab676c5c64461a05ca524cdfff59f1
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid json-simple Low
Vendor central groupid com.googlecode.json-simple Highest
Vendor manifest Bundle-Description A simple Java toolkit for JSON Medium
Vendor pom description A simple Java toolkit for JSON Medium
Vendor file name json-simple High
Vendor pom groupid com.googlecode.json-simple Highest
Vendor Manifest bundle-symbolicname com.googlecode.json-simple Medium
Vendor pom groupid googlecode.json-simple Highest
Vendor pom name JSON.simple High
Vendor pom url http://code.google.com/p/json-simple/ Highest
Product pom groupid googlecode.json-simple Low
Product pom url http://code.google.com/p/json-simple/ Medium
Product central artifactid json-simple Highest
Product Manifest Bundle-Name JSON.simple Medium
Product manifest Bundle-Description A simple Java toolkit for JSON Medium
Product pom description A simple Java toolkit for JSON Medium
Product pom artifactid json-simple Highest
Product file name json-simple High
Product Manifest bundle-symbolicname com.googlecode.json-simple Medium
Product pom name JSON.simple High
Version pom version 1.1.1 Highest
Version central version 1.1.1 Highest
Version file version 1.1.1 Highest
caja-r5054.jar
Description:
Caja is a HTML/CSS/JavaScript compiler which allows websites to safely embed web applications
from third parties, and enables rich interaction between the embedding page and the embedded
applications using an object-capability security model.
License:
Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/ciagent/.m2/repository/caja/caja/r5054/caja-r5054.jar
MD5: 7379ecf5bc7945ca6ab533b905e449a3
SHA1: 18b47afa0172413346d9c8ae1595b6ffbbddd499
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid caja Highest
Vendor pom organization name Google High
Vendor pom description Caja is a HTML/CSS/JavaScript compiler which allows websites to safely embed web applications from third parties, and enables rich interaction between the embedding page and the embedded applications using an object-capability security model. Low
Vendor pom groupid google.caja Highest
Vendor pom artifactid caja Low
Vendor pom url http://code.google.com/p/google-caja Highest
Vendor jar package name google Low
Vendor jar package name caja Low
Vendor file name caja-r5054 High
Vendor pom organization url http://www.google.com Medium
Vendor pom name Caja High
Product pom description Caja is a HTML/CSS/JavaScript compiler which allows websites to safely embed web applications from third parties, and enables rich interaction between the embedding page and the embedded applications using an object-capability security model. Low
Product pom organization url http://www.google.com Low
Product pom organization name Google Low
Product jar package name caja Low
Product pom artifactid caja Highest
Product file name caja-r5054 High
Product pom groupid google.caja Low
Product pom url http://code.google.com/p/google-caja Medium
Product pom name Caja High
Version pom version r5054 Highest
Version file version 5054 Medium
Version file name caja-r5054 Medium
maven: com.google.caja:caja:r5054
Confidence :High
htmlparser-r4209.jar
Description:
A patched version of the nu.validator v1.2.1 HTML parser.
License:
No Warranty
File Path: /home/ciagent/.m2/repository/caja/htmlparser/r4209/htmlparser-r4209.jar
MD5: 31c18bc52991e53ed4eaa28347c44189
SHA1: 0573217e5c9bf8fad6ce827a94191ca0f5785087
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom groupid caja Highest
Vendor file name htmlparser-r4209 High
Vendor jar package name validator Low
Vendor pom organization url http://validator.nu Medium
Vendor pom url http://code.google.com/p/google-caja Highest
Vendor pom description
A patched version of the nu.validator v1.2.1 HTML parser.
Medium
Vendor pom name HtmlParser High
Vendor jar package name nu Low
Vendor pom artifactid htmlparser Low
Vendor pom organization name Validator.nu High
Vendor jar package name htmlparser Low
Product file name htmlparser-r4209 High
Product pom artifactid htmlparser Highest
Product jar package name validator Low
Product pom description
A patched version of the nu.validator v1.2.1 HTML parser.
Medium
Product pom name HtmlParser High
Product pom organization url http://validator.nu Low
Product pom groupid caja Low
Product pom organization name Validator.nu Low
Product pom url http://code.google.com/p/google-caja Medium
Product jar package name htmlparser Low
Version file name htmlparser-r4209 Medium
Version pom version r4209 Highest
Version file version 4209 Medium
maven: caja:htmlparser:r4209
Confidence :High
oauth-20100527.jar
File Path: /home/ciagent/.m2/repository/net/oauth/core/oauth/20100527/oauth-20100527.jar
MD5: 91c7c70579f95b7ddee95b2143a49b41
SHA1: a84c5331e225bc25a5a288db328048d6b1bb6fd5
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid oauth Low
Vendor jar package name net Low
Vendor pom parent-artifactid oauth-core-parent Low
Vendor pom groupid net.oauth.core Highest
Vendor jar package name oauth Low
Vendor pom name OAuth Core High
Vendor central groupid net.oauth.core Highest
Vendor file name oauth-20100527 High
Product jar package name oauth Low
Product pom artifactid oauth Highest
Product pom name OAuth Core High
Product pom groupid net.oauth.core Low
Product file name oauth-20100527 High
Product pom parent-artifactid oauth-core-parent Medium
Product central artifactid oauth Highest
Version pom version 20100527 Highest
Version central version 20100527 Highest
Version file version 20100527 Medium
oauth-consumer-20090617.jar
File Path: /home/ciagent/.m2/repository/net/oauth/core/oauth-consumer/20090617/oauth-consumer-20090617.jar
MD5: f0e2849d152f4d8bf725aa4e11b8f969
SHA1: fb70a4c98119c27e78320c5e42a99f0b9eb7c356
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name net Low
Vendor pom parent-artifactid oauth-core-parent Low
Vendor pom groupid net.oauth.core Highest
Vendor pom artifactid oauth-consumer Low
Vendor jar package name client Low
Vendor jar package name oauth Low
Vendor pom name OAuth Core: Consumer High
Vendor file name oauth-consumer-20090617 High
Product jar package name client Low
Product jar package name oauth Low
Product pom artifactid oauth-consumer Highest
Product pom groupid net.oauth.core Low
Product pom name OAuth Core: Consumer High
Product pom parent-artifactid oauth-core-parent Medium
Product file name oauth-consumer-20090617 High
Version file version 20090617 Medium
Version pom version 20090617 Highest
maven: net.oauth.core:oauth-consumer:20090617
Confidence :High
oauth-httpclient4-20090913.jar
File Path: /home/ciagent/.m2/repository/net/oauth/core/oauth-httpclient4/20090913/oauth-httpclient4-20090913.jar
MD5: 577e1f28c28bc5006b8adcf838ffd46d
SHA1: a42f9135d3d72e77274982c4aa14fa0f4dab882f
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid oauth-httpclient4 Low
Vendor pom name OAuth Core: HttpClient4 High
Vendor jar package name net Low
Vendor pom parent-artifactid oauth-core-parent Low
Vendor pom groupid net.oauth.core Highest
Vendor jar package name client Low
Vendor jar package name oauth Low
Vendor file name oauth-httpclient4-20090913 High
Product pom name OAuth Core: HttpClient4 High
Product jar package name httpclient4 Low
Product jar package name client Low
Product jar package name oauth Low
Product file name oauth-httpclient4-20090913 High
Product pom artifactid oauth-httpclient4 Highest
Product pom groupid net.oauth.core Low
Product pom parent-artifactid oauth-core-parent Medium
Version pom parent-version 20090913 Low
Version file name oauth-httpclient4-20090913 Medium
Version pom version 20090913 Highest
Version file version 4.20090913 Highest
maven: net.oauth.core:oauth-httpclient4:20090913
Confidence :High
oauth-provider-20100527.jar
File Path: /home/ciagent/.m2/repository/net/oauth/core/oauth-provider/20100527/oauth-provider-20100527.jar
MD5: afdc85d3f14481e4842c317c4f414f7e
SHA1: 165bfc97e63e5af8e052a47f4dee832ce06bf7d7
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name net Low
Vendor pom parent-artifactid oauth-core-parent Low
Vendor pom groupid net.oauth.core Highest
Vendor file name oauth-provider-20100527 High
Vendor jar package name oauth Low
Vendor pom name OAuth Core: Provider High
Vendor central groupid net.oauth.core Highest
Vendor pom artifactid oauth-provider Low
Product file name oauth-provider-20100527 High
Product jar package name oauth Low
Product pom artifactid oauth-provider Highest
Product pom name OAuth Core: Provider High
Product central artifactid oauth-provider Highest
Product pom groupid net.oauth.core Low
Product pom parent-artifactid oauth-core-parent Medium
Version pom version 20100527 Highest
Version central version 20100527 Highest
Version file version 20100527 Medium
guava-20.0.jar
Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/google/guava/guava/20.0/guava-20.0.jar
MD5: f32a8a2524620dbecc9f6bf6a20c293f
SHA1: 89507701249388e1ed5ddcf8c41f4ce1be7831ef
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest bundle-docurl https://github.com/google/guava/ Low
Vendor pom name Guava: Google Core Libraries for Java High
Vendor file name guava High
Vendor manifest Bundle-Description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low
Vendor pom parent-groupid com.google.guava Medium
Vendor pom groupid google.guava Highest
Vendor pom groupid com.google.guava Highest
Vendor Manifest bundle-symbolicname com.google.guava Medium
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Vendor pom parent-artifactid guava-parent Low
Vendor pom artifactid guava Low
Vendor central groupid com.google.guava Highest
Vendor pom description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low
Product pom artifactid guava Highest
Product Manifest bundle-docurl https://github.com/google/guava/ Low
Product pom name Guava: Google Core Libraries for Java High
Product file name guava High
Product manifest Bundle-Description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low
Product Manifest Bundle-Name Guava: Google Core Libraries for Java Medium
Product pom parent-groupid com.google.guava Low
Product pom parent-artifactid guava-parent Medium
Product Manifest bundle-symbolicname com.google.guava Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Product pom groupid google.guava Low
Product pom description Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more. Guava has only one code dependency - javax.annotation, per the JSR-305 spec. Low
Product central artifactid guava Highest
Version pom version 20.0 Highest
Version file version 20.0 Highest
Version central version 20.0 Highest
Published Vulnerabilities
CVE-2018-10237 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Vulnerable Software & Versions: (show all )
aopalliance-1.0.jar
Description: AOP Alliance
License:
Public Domain
File Path: /home/ciagent/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom name AOP alliance High
Vendor jar package name aopalliance Low
Vendor pom artifactid aopalliance Low
Vendor pom groupid aopalliance Highest
Vendor pom url http://aopalliance.sourceforge.net Highest
Vendor pom description AOP Alliance Medium
Vendor jar package name intercept Low
Vendor central groupid aopalliance Highest
Vendor file name aopalliance High
Product pom name AOP alliance High
Product pom url http://aopalliance.sourceforge.net Medium
Product central artifactid aopalliance Highest
Product pom description AOP Alliance Medium
Product jar package name intercept Low
Product pom groupid aopalliance Low
Product pom artifactid aopalliance Highest
Product file name aopalliance High
Version file version 1.0 Highest
Version central version 1.0 Highest
Version pom version 1.0 Highest
guice-3.0.jar
Description: Guice is a lightweight dependency injection framework for Java 5 and above
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/google/inject/guice/3.0/guice-3.0.jar
MD5: ca1c7ba366884cfcd2cfb48d2395c400
SHA1: 9d84f15fe35e2c716a02979fb62f50a29f38aefa
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest Bundle-Description Guice is a lightweight dependency injection framework for Java 5 and above Medium
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low
Vendor Manifest bundle-symbolicname com.google.inject Medium
Vendor pom parent-groupid com.google.inject Medium
Vendor pom groupid google.inject Highest
Vendor file name guice High
Vendor central groupid com.google.inject Highest
Vendor Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low
Vendor pom name Google Guice - Core Library High
Vendor pom parent-artifactid guice-parent Low
Vendor pom groupid com.google.inject Highest
Vendor Manifest bundle-docurl http://code.google.com/p/google-guice/ Low
Vendor pom artifactid guice Low
Product manifest Bundle-Description Guice is a lightweight dependency injection framework for Java 5 and above Medium
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low
Product Manifest bundle-symbolicname com.google.inject Medium
Product pom parent-groupid com.google.inject Low
Product Manifest Bundle-Name guice Medium
Product pom parent-artifactid guice-parent Medium
Product pom artifactid guice Highest
Product file name guice High
Product pom groupid google.inject Low
Product Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low
Product pom name Google Guice - Core Library High
Product central artifactid guice Highest
Product Manifest bundle-docurl http://code.google.com/p/google-guice/ Low
Version central version 3.0 Highest
Version pom version 3.0 Highest
Version file version 3.0 Highest
guice-multibindings-3.0.jar
Description: Guice is a lightweight dependency injection framework for Java 5 and above
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/google/inject/extensions/guice-multibindings/3.0/guice-multibindings-3.0.jar
MD5: 4be1e91408e173eb10ed53a1a565a793
SHA1: 5e670615a927571234df68a8b1fe1a16272be555
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid com.google.inject.extensions Highest
Vendor pom groupid google.inject.extensions Highest
Vendor manifest Bundle-Description Guice is a lightweight dependency injection framework for Java 5 and above Medium
Vendor pom groupid com.google.inject.extensions Highest
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low
Vendor pom parent-artifactid extensions-parent Low
Vendor Manifest bundle-symbolicname com.google.inject.multibindings Medium
Vendor pom parent-groupid com.google.inject.extensions Medium
Vendor pom name Google Guice - Extensions - MultiBindings High
Vendor pom artifactid guice-multibindings Low
Vendor Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low
Vendor file name guice-multibindings High
Vendor Manifest bundle-docurl http://code.google.com/p/google-guice/ Low
Product pom parent-artifactid extensions-parent Medium
Product manifest Bundle-Description Guice is a lightweight dependency injection framework for Java 5 and above Medium
Product central artifactid guice-multibindings Highest
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low
Product pom groupid google.inject.extensions Low
Product Manifest bundle-symbolicname com.google.inject.multibindings Medium
Product Manifest Bundle-Name guice-multibindings Medium
Product pom name Google Guice - Extensions - MultiBindings High
Product pom parent-groupid com.google.inject.extensions Low
Product Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low
Product pom artifactid guice-multibindings Highest
Product file name guice-multibindings High
Product Manifest bundle-docurl http://code.google.com/p/google-guice/ Low
Version central version 3.0 Highest
Version pom version 3.0 Highest
Version file version 3.0 Highest
rome-1.0.jar
Description: All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it
easy to work in Java with most syndication formats. Today it accepts all flavors of RSS
(0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes
a set of parsers and generators for the various flavors of feeds, as well as converters
to convert from one format to another. The parsers can give you back Java objects that
are either specific for the format you want to work with, or a generic normalized
SyndFeed object that lets you work on with the data without bothering about the
underlying format.
File Path: /home/ciagent/.m2/repository/rome/rome/1.0/rome-1.0.jar
MD5: 53d38c030287b939f4e6d745ba1269a7
SHA1: 022b33347f315833e9348cec2751af1a5d5656e4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom organization url http://java.sun.com/ Medium
Vendor pom url https://rome.dev.java.net/ Highest
Vendor pom organization name Sun Microsystems High
Vendor pom artifactid rome Low
Vendor manifest Bundle-Description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low
Vendor Manifest embed-directory META-INF/lib Low
Vendor Manifest originally-created-by 1.6.0_10 (Sun Microsystems Inc.) Low
Vendor pom name ROME, RSS and atOM utilitiEs for Java High
Vendor central groupid rome Highest
Vendor file name rome High
Vendor Manifest bundle-docurl http://java.sun.com/ Low
Vendor pom description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low
Vendor pom groupid rome Highest
Vendor Manifest bundle-symbolicname rome.rome Medium
Product pom groupid rome Low
Product central artifactid rome Highest
Product pom url https://rome.dev.java.net/ Medium
Product manifest Bundle-Description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low
Product Manifest embed-directory META-INF/lib Low
Product Manifest originally-created-by 1.6.0_10 (Sun Microsystems Inc.) Low
Product Manifest Bundle-Name ROME, RSS and atOM utilitiEs for Java Medium
Product pom name ROME, RSS and atOM utilitiEs for Java High
Product pom artifactid rome Highest
Product file name rome High
Product Manifest bundle-docurl http://java.sun.com/ Low
Product pom description All Roads Lead to ROME. ROME is a set of Atom/RSS Java utilities that make it easy to work in Java with most syndication formats. Today it accepts all flavors of RSS (0.90, 0.91, 0.92, 0.93, 0.94, 1.0 and 2.0), Atom 0.3 and Atom 1.0 feeds. Rome includes a set of parsers and generators for the various flavors of feeds, as well as converters to convert from one format to another. The parsers can give you back Java objects that are either specific for the format you want to work with, or a generic normalized SyndFeed object that lets you work on with the data without bothering about the underlying format. Low
Product pom organization url http://java.sun.com/ Low
Product pom organization name Sun Microsystems Low
Product Manifest bundle-symbolicname rome.rome Medium
Version file version 1.0 Highest
Version central version 1.0 Highest
Version pom version 1.0 Highest
nekohtml-1.9.22.jar
Description: An HTML parser and tag balancer.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/net/sourceforge/nekohtml/nekohtml/1.9.22/nekohtml-1.9.22.jar
MD5: a97dfe2d0ceb81ffbdd15436961b0f23
SHA1: 4f54af68ecb345f2453fb6884672ad08414154e3
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest: org/cyberneko/html/ Implementation-Vendor Andy Clark, Marc Guillemot Medium
Vendor central groupid net.sourceforge.nekohtml Highest
Vendor pom description An HTML parser and tag balancer. Medium
Vendor file name nekohtml High
Vendor pom url http://nekohtml.sourceforge.net/ Highest
Vendor pom groupid net.sourceforge.nekohtml Highest
Vendor pom artifactid nekohtml Low
Vendor pom name Neko HTML High
Product central artifactid nekohtml Highest
Product pom artifactid nekohtml Highest
Product manifest: org/cyberneko/html/ Implementation-Title CyberNeko HTML Parser Medium
Product pom groupid net.sourceforge.nekohtml Low
Product pom url http://nekohtml.sourceforge.net/ Medium
Product pom description An HTML parser and tag balancer. Medium
Product file name nekohtml High
Product manifest: org/cyberneko/html/ Specification-Title Hyper-Text Markup Language (HTML) Medium
Product pom name Neko HTML High
Version pom version 1.9.22 Highest
Version central version 1.9.22 Highest
Version file version 1.9.22 Highest
xercesImpl-2.9.1.jar
Description:
Xerces2 is the next generation of high performance, fully compliant XML parsers in the
Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI),
a complete framework for building parser components and configurations that is extremely
modular and easy to program.
File Path: /home/ciagent/.m2/repository/xerces/xercesImpl/2.9.1/xercesImpl-2.9.1.jar
MD5: f807f86d7d9db25edbfc782aca7ca2a9
SHA1: 7bc7e49ddfe4fb5f193ed37ecc96c12292c8ceb6
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest: org/apache/xerces/impl/Version.class Implementation-Vendor Apache Software Foundation Medium
Vendor manifest: org/w3c/dom/ Implementation-Vendor World Wide Web Consortium Medium
Vendor manifest: org/w3c/dom/ls/ Implementation-Vendor World Wide Web Consortium Medium
Vendor file name xercesImpl High
Vendor manifest: javax/xml/xpath/ Implementation-Vendor Apache Software Foundation Medium
Vendor pom parent-artifactid apache Low
Vendor pom description Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program. Low
Vendor pom name Xerces2 Java Parser High
Vendor pom artifactid xercesImpl Low
Vendor pom groupid xerces Highest
Vendor manifest: javax/xml/transform/ Implementation-Vendor Apache Software Foundation Medium
Vendor manifest: javax/xml/parsers/ Implementation-Vendor Apache Software Foundation Medium
Vendor central groupid xerces Highest
Vendor pom url http://xerces.apache.org/xerces2-j Highest
Vendor manifest: org/xml/sax/ Implementation-Vendor David Megginson Medium
Vendor manifest: javax/xml/datatype/ Implementation-Vendor Apache Software Foundation Medium
Vendor manifest: org/apache/xerces/xni/ Implementation-Vendor Apache Software Foundation Medium
Vendor manifest: javax/xml/validation/ Implementation-Vendor Apache Software Foundation Medium
Vendor pom parent-groupid org.apache Medium
Product pom artifactid xercesImpl Highest
Product manifest: javax/xml/transform/ Specification-Title Java API for XML Processing Medium
Product pom groupid xerces Low
Product file name xercesImpl High
Product manifest: org/apache/xerces/impl/Version.class Implementation-Title org.apache.xerces.impl.Version Medium
Product pom description Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program. Low
Product central artifactid xercesImpl Highest
Product pom name Xerces2 Java Parser High
Product manifest: javax/xml/parsers/ Specification-Title Java API for XML Processing Medium
Product manifest: org/xml/sax/ Implementation-Title org.xml.sax Medium
Product manifest: org/w3c/dom/ls/ Implementation-Title org.w3c.dom.ls Medium
Product manifest: org/w3c/dom/ls/ Specification-Title Document Object Model, Level 3 Load and Save Medium
Product pom parent-artifactid apache Medium
Product manifest: org/w3c/dom/ Implementation-Title org.w3c.dom Medium
Product manifest: javax/xml/xpath/ Implementation-Title javax.xml.xpath Medium
Product manifest: javax/xml/validation/ Specification-Title Java API for XML Processing Medium
Product manifest: org/w3c/dom/ Specification-Title Document Object Model, Level 3 Core Medium
Product manifest: javax/xml/datatype/ Implementation-Title javax.xml.datatype Medium
Product manifest: org/apache/xerces/xni/ Implementation-Title org.apache.xerces.xni Medium
Product manifest: org/apache/xerces/xni/ Specification-Title Xerces Native Interface Medium
Product manifest: javax/xml/parsers/ Implementation-Title javax.xml.parsers Medium
Product manifest: javax/xml/datatype/ Specification-Title Java API for XML Processing Medium
Product manifest: javax/xml/xpath/ Specification-Title Java API for XML Processing Medium
Product manifest: javax/xml/transform/ Implementation-Title javax.xml.transform Medium
Product pom parent-groupid org.apache Low
Product manifest: org/xml/sax/ Specification-Title Simple API for XML Medium
Product pom url http://xerces.apache.org/xerces2-j Medium
Product manifest: javax/xml/validation/ Implementation-Title javax.xml.validation Medium
Version central version 2.9.1 Highest
Version pom version 2.9.1 Highest
Version file version 2.9.1 Highest
Published Vulnerabilities
CVE-2012-0881 suppress
Severity:
High
CVSS Score: 7.8
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-399 Resource Management Errors
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Vulnerable Software & Versions:
sanselan-0.97-incubator.jar
Description: Apache Sanselan is a pure-Java image library.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/org/apache/sanselan/sanselan/0.97-incubator/sanselan-0.97-incubator.jar
MD5: 84f823e61d93fcedcb3c10a827c45989
SHA1: 8396778b076a2eaf62024b64f6d924e4e0095fca
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor central groupid org.apache.sanselan Highest
Vendor file name sanselan High
Vendor pom parent-artifactid apache Low
Vendor Manifest bundle-symbolicname org.apache.sanselan.sanselan Medium
Vendor pom artifactid sanselan Low
Vendor pom description Apache Sanselan is a pure-Java image library. Medium
Vendor pom organization url http://cwiki.apache.org/SANSELAN/ Medium
Vendor pom name Apache Sanselan High
Vendor Manifest bundle-docurl http://cwiki.apache.org/SANSELAN/ Low
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor manifest Bundle-Description Apache Sanselan is a pure-Java image library. Medium
Vendor pom groupid org.apache.sanselan Highest
Vendor pom groupid apache.sanselan Highest
Vendor pom url http://sanselan.apache.org/ Highest
Vendor pom parent-groupid org.apache Medium
Product pom artifactid sanselan Highest
Product pom organization url http://cwiki.apache.org/SANSELAN/ Low
Product file name sanselan High
Product Manifest bundle-symbolicname org.apache.sanselan.sanselan Medium
Product pom description Apache Sanselan is a pure-Java image library. Medium
Product central artifactid sanselan Highest
Product Manifest Bundle-Name Apache Sanselan Medium
Product pom name Apache Sanselan High
Product Manifest bundle-docurl http://cwiki.apache.org/SANSELAN/ Low
Product pom groupid apache.sanselan Low
Product pom url http://sanselan.apache.org/ Medium
Product pom parent-groupid org.apache Low
Product Manifest Implementation-Title Apache Sanselan High
Product manifest Bundle-Description Apache Sanselan is a pure-Java image library. Medium
Product pom parent-artifactid apache Medium
Product Manifest specification-title Apache Sanselan Medium
Version Manifest Implementation-Version 0.97-incubator High
Version central version 0.97-incubator Highest
Version pom version 0.97-incubator Highest
Version file version 0.97 Highest
commons-io-2.4.jar
Description:
The Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-io/commons-io/2.4/commons-io-2.4.jar
MD5: 7f97854dc04c119d461fed14f5d8bb96
SHA1: b1b6ea3b7e4aa4f492509a4952029cd8e48019ad
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor pom parent-artifactid commons-parent Low
Vendor Manifest bundle-symbolicname org.apache.commons.io Medium
Vendor pom groupid commons-io Highest
Vendor manifest Bundle-Description The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low
Vendor Manifest bundle-docurl http://commons.apache.org/io/ Low
Vendor pom parent-groupid org.apache.commons Medium
Vendor pom description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor Manifest implementation-build tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400 Low
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom artifactid commons-io Low
Vendor pom name Commons IO High
Vendor pom url http://commons.apache.org/io/ Highest
Vendor central groupid commons-io Highest
Vendor file name commons-io High
Product pom parent-artifactid commons-parent Medium
Product Manifest bundle-symbolicname org.apache.commons.io Medium
Product manifest Bundle-Description The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low
Product pom url http://commons.apache.org/io/ Medium
Product pom parent-groupid org.apache.commons Low
Product Manifest bundle-docurl http://commons.apache.org/io/ Low
Product pom description
The Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Low
Product pom artifactid commons-io Highest
Product Manifest implementation-build tags/2.4-RC2@r1349569; 2012-06-12 18:18:20-0400 Low
Product Manifest Bundle-Name Commons IO Medium
Product pom name Commons IO High
Product Manifest specification-title Commons IO Medium
Product central artifactid commons-io Highest
Product file name commons-io High
Product Manifest Implementation-Title Commons IO High
Product pom groupid commons-io Low
Version Manifest Implementation-Version 2.4 High
Version central version 2.4 Highest
Version pom version 2.4 Highest
Version file version 2.4 Highest
commons-codec-1.10.jar
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar
MD5: 353cf6a2bdba09595ccfa073b78c7fcb
SHA1: 4b95f4897fa13f2cd904aee711aeafc0c5295cd8
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low
Vendor pom parent-artifactid commons-parent Low
Vendor pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low
Vendor manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low
Vendor pom parent-groupid org.apache.commons Medium
Vendor Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor central groupid commons-codec Highest
Vendor file name commons-codec High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Vendor pom artifactid commons-codec Low
Vendor pom name Apache Commons Codec High
Vendor pom groupid commons-codec Highest
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor Manifest bundle-symbolicname org.apache.commons.codec Medium
Vendor pom url http://commons.apache.org/proper/commons-codec/ Highest
Product pom parent-artifactid commons-parent Medium
Product Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low
Product pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low
Product manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Low
Product pom parent-groupid org.apache.commons Low
Product Manifest specification-title Apache Commons Codec Medium
Product Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low
Product file name commons-codec High
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Product Manifest Implementation-Title Apache Commons Codec High
Product pom name Apache Commons Codec High
Product Manifest Bundle-Name Apache Commons Codec Medium
Product pom url http://commons.apache.org/proper/commons-codec/ Medium
Product central artifactid commons-codec Highest
Product Manifest bundle-symbolicname org.apache.commons.codec Medium
Product pom artifactid commons-codec Highest
Product pom groupid commons-codec Low
Version Manifest Implementation-Version 1.10 High
Version pom version 1.10 Highest
Version file version 1.10 Highest
Version central version 1.10 Highest
httpcore-4.3.3.jar
Description:
HttpComponents Core (blocking I/O)
File Path: /home/ciagent/.m2/repository/org/apache/httpcomponents/httpcore/4.3.3/httpcore-4.3.3.jar
MD5: c26171852f9810cd3d2416604a387e71
SHA1: f91b7a4aadc5cf486df6e4634748d7dd7a73f06d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor Manifest url http://hc.apache.org/httpcomponents-core-ga Low
Vendor pom name Apache HttpCore High
Vendor central groupid org.apache.httpcomponents Highest
Vendor pom groupid org.apache.httpcomponents Highest
Vendor pom description
HttpComponents Core (blocking I/O)
Medium
Vendor pom url http://hc.apache.org/httpcomponents-core-ga Highest
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor file name httpcore High
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor pom parent-artifactid httpcomponents-core Low
Vendor Manifest implementation-build tags/4.3.3-RC1/httpcore@r1632770; 2014-10-18 13:50:12+0200 Low
Vendor pom groupid apache.httpcomponents Highest
Vendor pom artifactid httpcore Low
Vendor pom parent-groupid org.apache.httpcomponents Medium
Product Manifest url http://hc.apache.org/httpcomponents-core-ga Low
Product pom name Apache HttpCore High
Product pom groupid apache.httpcomponents Low
Product Manifest Implementation-Title HttpComponents Apache HttpCore High
Product pom parent-groupid org.apache.httpcomponents Low
Product pom parent-artifactid httpcomponents-core Medium
Product pom description
HttpComponents Core (blocking I/O)
Medium
Product pom url http://hc.apache.org/httpcomponents-core-ga Medium
Product file name httpcore High
Product pom artifactid httpcore Highest
Product Manifest specification-title HttpComponents Apache HttpCore Medium
Product central artifactid httpcore Highest
Product Manifest implementation-build tags/4.3.3-RC1/httpcore@r1632770; 2014-10-18 13:50:12+0200 Low
Version Manifest Implementation-Version 4.3.3 High
Version file version 4.3.3 Highest
Version central version 4.3.3 Highest
Version pom version 4.3.3 Highest
httpclient-4.3.6.jar
Description:
HttpComponents Client
File Path: /home/ciagent/.m2/repository/org/apache/httpcomponents/httpclient/4.3.6/httpclient-4.3.6.jar
MD5: 2d29a27bb6c6b44bc8a608a0e5d09735
SHA1: 4c47155e3e6c9a41a28db36680b828ced53b8af4
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid httpclient Low
Vendor file name httpclient High
Vendor Manifest specification-vendor The Apache Software Foundation Low
Vendor central groupid org.apache.httpcomponents Highest
Vendor pom groupid org.apache.httpcomponents Highest
Vendor pom parent-artifactid httpcomponents-client Low
Vendor Manifest implementation-build tags/4.3.6-RC1/httpclient@r1636012; 2014-11-02 14:45:03+0100 Low
Vendor Manifest Implementation-Vendor The Apache Software Foundation High
Vendor pom url http://hc.apache.org/httpcomponents-client Highest
Vendor pom name Apache HttpClient High
Vendor Manifest Implementation-Vendor-Id org.apache Medium
Vendor Manifest url http://hc.apache.org/httpcomponents-client Low
Vendor pom description
HttpComponents Client
Medium
Vendor pom groupid apache.httpcomponents Highest
Vendor pom parent-groupid org.apache.httpcomponents Medium
Product pom url http://hc.apache.org/httpcomponents-client Medium
Product pom parent-artifactid httpcomponents-client Medium
Product file name httpclient High
Product Manifest specification-title HttpComponents Apache HttpClient Medium
Product pom groupid apache.httpcomponents Low
Product pom parent-groupid org.apache.httpcomponents Low
Product Manifest implementation-build tags/4.3.6-RC1/httpclient@r1636012; 2014-11-02 14:45:03+0100 Low
Product pom name Apache HttpClient High
Product central artifactid httpclient Highest
Product Manifest Implementation-Title HttpComponents Apache HttpClient High
Product Manifest url http://hc.apache.org/httpcomponents-client Low
Product pom description
HttpComponents Client
Medium
Product pom artifactid httpclient Highest
Version pom version 4.3.6 Highest
Version Manifest Implementation-Version 4.3.6 High
Version central version 4.3.6 Highest
Version file version 4.3.6 Highest
closure-compiler-externs-v20170910.jar
File Path: /home/ciagent/.m2/repository/com/google/javascript/closure-compiler-externs/v20170910/closure-compiler-externs-v20170910.jar
MD5: 573e49fb83760d25b675028eb612e2b2
SHA1: 036e801a929fcd121d212093923daf34986f5572
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid closure-compiler-externs Low
Vendor file name closure-compiler-externs-v20170910 High
Vendor pom name Closure Compiler Externs High
Vendor pom parent-groupid com.google.javascript Medium
Vendor pom groupid com.google.javascript Highest
Vendor pom groupid google.javascript Highest
Vendor central groupid com.google.javascript Highest
Vendor pom parent-artifactid closure-compiler-parent Low
Product pom groupid google.javascript Low
Product file name closure-compiler-externs-v20170910 High
Product pom name Closure Compiler Externs High
Product pom parent-groupid com.google.javascript Low
Product pom parent-artifactid closure-compiler-parent Medium
Product pom artifactid closure-compiler-externs Highest
Product central artifactid closure-compiler-externs Highest
Version pom version v20170910 Highest
Version file name closure-compiler-externs-v20170910 Medium
Version central version v20170910 Highest
Version file version 20170910 Medium
args4j-2.33.jar
Description: args4j : Java command line arguments parser
License:
http://www.opensource.org/licenses/mit-license.php
File Path: /home/ciagent/.m2/repository/args4j/args4j/2.33/args4j-2.33.jar
MD5: 0a6d515f76b15d29e3cd529de9319739
SHA1: bd87a75374a6d6523de82fef51fc3cfe9baf9fc9
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid args4j-site Low
Vendor manifest Bundle-Description args4j : Java command line arguments parser Medium
Vendor Manifest bundle-docurl http://www.kohsuke.org/ Low
Vendor pom artifactid args4j Low
Vendor pom groupid args4j Highest
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Vendor pom name args4j High
Vendor central groupid args4j Highest
Vendor file name args4j High
Vendor Manifest bundle-symbolicname org.kohsuke.args4j Medium
Product pom artifactid args4j Highest
Product manifest Bundle-Description args4j : Java command line arguments parser Medium
Product Manifest bundle-docurl http://www.kohsuke.org/ Low
Product Manifest Bundle-Name args4j Medium
Product central artifactid args4j Highest
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.5))" Low
Product pom name args4j High
Product file name args4j High
Product Manifest bundle-symbolicname org.kohsuke.args4j Medium
Product pom parent-artifactid args4j-site Medium
Product pom groupid args4j Low
Version pom version 2.33 Highest
Version central version 2.33 Highest
Version file version 2.33 Highest
error_prone_annotations-2.0.18.jar
File Path: /home/ciagent/.m2/repository/com/google/errorprone/error_prone_annotations/2.0.18/error_prone_annotations-2.0.18.jar
MD5: 98051758c08c9b7111b3268655069432
SHA1: 5f65affce1684999e2f4024983835efc3504012e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name errorprone Low
Vendor file name error_prone_annotations High
Vendor jar package name annotations Low
Vendor pom parent-groupid com.google.errorprone Medium
Vendor jar package name google Low
Vendor central groupid com.google.errorprone Highest
Vendor pom groupid com.google.errorprone Highest
Vendor pom groupid google.errorprone Highest
Vendor pom parent-artifactid error_prone_parent Low
Vendor pom name error-prone annotations High
Vendor pom artifactid error_prone_annotations Low
Product jar package name errorprone Low
Product file name error_prone_annotations High
Product jar package name annotations Low
Product pom groupid google.errorprone Low
Product pom parent-artifactid error_prone_parent Medium
Product pom artifactid error_prone_annotations Highest
Product central artifactid error_prone_annotations Highest
Product pom name error-prone annotations High
Product pom parent-groupid com.google.errorprone Low
Version pom version 2.0.18 Highest
Version central version 2.0.18 Highest
Version file version 2.0.18 Highest
protobuf-java-3.0.2.jar
Description:
Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an
efficient yet extensible format.
License:
http://www.opensource.org/licenses/bsd-license.php
File Path: /home/ciagent/.m2/repository/com/google/protobuf/protobuf-java/3.0.2/protobuf-java-3.0.2.jar
MD5: fca93e016f4dd35aacde356a4b711423
SHA1: ee55e8e697d10b6643d77bb1f686bac3b9ba8579
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom description Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Low
Vendor Manifest bundle-docurl https://developers.google.com/protocol-buffers/ Low
Vendor file name protobuf-java High
Vendor pom groupid com.google.protobuf Highest
Vendor pom groupid google.protobuf Highest
Vendor pom artifactid protobuf-java Low
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Vendor central groupid com.google.protobuf Highest
Vendor pom parent-artifactid protobuf-parent Low
Vendor pom parent-groupid com.google.protobuf Medium
Vendor manifest Bundle-Description Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Low
Vendor pom name Protocol Buffers [Core] High
Vendor Manifest bundle-symbolicname com.google.protobuf Medium
Product pom description Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Low
Product central artifactid protobuf-java Highest
Product Manifest Bundle-Name Protocol Buffers [Core] Medium
Product Manifest bundle-docurl https://developers.google.com/protocol-buffers/ Low
Product pom parent-artifactid protobuf-parent Medium
Product file name protobuf-java High
Product pom groupid google.protobuf Low
Product pom artifactid protobuf-java Highest
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Product manifest Bundle-Description Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. Low
Product pom parent-groupid com.google.protobuf Low
Product pom name Protocol Buffers [Core] High
Product Manifest bundle-symbolicname com.google.protobuf Medium
Version file version 3.0.2 Highest
Version central version 3.0.2 Highest
Version pom version 3.0.2 Highest
Published Vulnerabilities
CVE-2015-5237 suppress
Severity:
Medium
CVSS Score: 6.5
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Vulnerable Software & Versions: (show all )
gson-2.7.jar
Description: Gson JSON library
File Path: /home/ciagent/.m2/repository/com/google/code/gson/gson/2.7/gson-2.7.jar
MD5: 5134a2350f58890ffb9db0b40047195d
SHA1: 751f548c85fa49f330cecbb1875893f971b33c4e
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest Bundle-Description Gson JSON library Medium
Vendor central groupid com.google.code.gson High
Vendor Manifest bundle-contactaddress https://github.com/google/gson Low
Vendor pom artifactid gson Low
Vendor file name gson High
Vendor pom parent-groupid com.google.code.gson Medium
Vendor Manifest bundle-symbolicname com.google.gson Medium
Vendor pom parent-artifactid gson-parent Low
Vendor central groupid org.netbeans.external High
Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Vendor pom groupid google.code.gson Highest
Vendor pom groupid com.google.code.gson Highest
Vendor pom name Gson High
Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6, JavaSE-1.7, JavaSE-1.8 Low
Product pom artifactid gson Highest
Product manifest Bundle-Description Gson JSON library Medium
Product central artifactid com-google-gson High
Product Manifest bundle-contactaddress https://github.com/google/gson Low
Product central artifactid gson High
Product file name gson High
Product Manifest bundle-symbolicname com.google.gson Medium
Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low
Product pom parent-groupid com.google.code.gson Low
Product pom parent-artifactid gson-parent Medium
Product pom groupid google.code.gson Low
Product pom name Gson High
Product Manifest Bundle-Name Gson Medium
Product Manifest bundle-requiredexecutionenvironment J2SE-1.5, JavaSE-1.6, JavaSE-1.7, JavaSE-1.8 Low
Version central version RELEASE110 High
Version pom version 2.7 Highest
Version central version RELEASE100 High
Version central version 2.7 High
Version file version 2.7 Highest
jsr305-3.0.1.jar
Description: JSR305 Annotations for Findbugs
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/ciagent/.m2/repository/com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1.jar
MD5: c6532beb3f7cc54a8d73d25d5602b9e4
SHA1: f7be08ec23c21485b9b5a1cf1654c2ec8c58168d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor manifest Bundle-Description JSR305 Annotations for Findbugs Medium
Vendor pom groupid google.code.findbugs Highest
Vendor pom description JSR305 Annotations for Findbugs Medium
Vendor pom name FindBugs-jsr305 High
Vendor pom url http://findbugs.sourceforge.net/ Highest
Vendor Manifest bundle-symbolicname org.jsr-305 Medium
Vendor pom groupid com.google.code.findbugs Highest
Vendor pom artifactid jsr305 Low
Vendor file name jsr305 High
Vendor central groupid com.google.code.findbugs Highest
Product manifest Bundle-Description JSR305 Annotations for Findbugs Medium
Product central artifactid jsr305 Highest
Product pom description JSR305 Annotations for Findbugs Medium
Product pom name FindBugs-jsr305 High
Product Manifest bundle-symbolicname org.jsr-305 Medium
Product pom url http://findbugs.sourceforge.net/ Medium
Product pom groupid google.code.findbugs Low
Product pom artifactid jsr305 Highest
Product file name jsr305 High
Product Manifest Bundle-Name FindBugs-jsr305 Medium
Version central version 3.0.1 Highest
Version pom version 3.0.1 Highest
Version file version 3.0.1 Highest
jsinterop-annotations-1.0.0.jar
File Path: /home/ciagent/.m2/repository/com/google/jsinterop/jsinterop-annotations/1.0.0/jsinterop-annotations-1.0.0.jar
MD5: 93302e3d0cc146097ecd08039dc1de52
SHA1: 23c3a3c060ffe4817e67673cc8294e154b0a4a95
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name annotations Low
Vendor jar package name jsinterop Low
Vendor pom groupid com.google.jsinterop Highest
Vendor file name jsinterop-annotations High
Vendor pom groupid google.jsinterop Highest
Vendor pom parent-groupid com.google.jsinterop Medium
Vendor pom parent-artifactid jsinterop Low
Vendor central groupid com.google.jsinterop Highest
Vendor pom artifactid jsinterop-annotations Low
Product jar package name annotations Low
Product central artifactid jsinterop-annotations Highest
Product pom parent-artifactid jsinterop Medium
Product pom parent-groupid com.google.jsinterop Low
Product pom artifactid jsinterop-annotations Highest
Product file name jsinterop-annotations High
Product pom groupid google.jsinterop Low
Version pom version 1.0.0 Highest
Version central version 1.0.0 Highest
Version file version 1.0.0 Highest
closure-compiler-v20170910.jar
File Path: /home/ciagent/.m2/repository/com/google/javascript/closure-compiler/v20170910/closure-compiler-v20170910.jar
MD5: ca8e9f88ba9aad9c5e2c0f8f937fe869
SHA1: 3b87499e9ed3f068e69889182ab95cff92de0932
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor jar package name google Low
Vendor file name closure-compiler-v20170910 High
Vendor jar package name javascript Low
Vendor pom groupid com.google.javascript Highest
Vendor central groupid com.google.javascript Highest
Product pom artifactid closure-compiler Highest
Product file name closure-compiler-v20170910 High
Product jar package name javascript Low
Product central artifactid closure-compiler Highest
Version pom version v20170910 Highest
Version central version v20170910 Highest
Version file name closure-compiler-v20170910 Medium
Version file version 20170910 Medium
social-component-core-5.3.x-SNAPSHOT.jar
Description: eXo Social Core Component: People and Space
File Path: /home/ciagent/.m2/repository/org/exoplatform/social/social-component-core/5.3.x-SNAPSHOT/social-component-core-5.3.x-SNAPSHOT.jar
MD5: e316fbfba9fa30e37a9d370db43643f9
SHA1: cd72311e8b68d1ad544934b2e2f0ba33bcaed44d
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom name eXo PLF:: Social Core Component High
Vendor pom groupid org.exoplatform.social Highest
Vendor pom groupid exoplatform.social Highest
Vendor pom artifactid social-component-core Low
Vendor file name social-component-core High
Vendor pom parent-artifactid social-component Low
Vendor Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-core Low
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-groupid org.exoplatform.social Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.social Medium
Vendor Manifest date 2019-05-24T10:23:51Z Low
Vendor pom description eXo Social Core Component: People and Space Medium
Product pom parent-groupid org.exoplatform.social Low
Product file name social-component-core High
Product Manifest specification-title eXo PLF:: Social Core Component Medium
Product pom name eXo PLF:: Social Core Component High
Product pom groupid exoplatform.social Low
Product Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-core Low
Product pom artifactid social-component-core Highest
Product pom parent-artifactid social-component Medium
Product Manifest date 2019-05-24T10:23:51Z Low
Product Manifest Implementation-Title eXo PLF:: Social Core Component High
Product pom description eXo Social Core Component: People and Space Medium
Version file version 5.3 Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.social:social-component-core:5.3.x-SNAPSHOT
Confidence :High
jackson-annotations-2.3.0.jar
Description: Core annotations used for value types, used by Jackson data binding package.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.3.0/jackson-annotations-2.3.0.jar
MD5: c954fbca7d677f323d810d0fa8baead2
SHA1: f5e853a20b60758922453d56f9ae1e64af5cb3da
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid oss-parent Low
Vendor file name jackson-annotations High
Vendor pom parent-groupid com.fasterxml Medium
Vendor Manifest implementation-build-date 2013-11-13 20:56:27-0800 Low
Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low
Vendor Manifest Implementation-Vendor FasterXML High
Vendor pom name Jackson-annotations High
Vendor pom description Core annotations used for value types, used by Jackson data binding package.
Medium
Vendor Manifest specification-vendor FasterXML Low
Vendor pom groupid fasterxml.jackson.core Highest
Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium
Vendor central groupid com.fasterxml.jackson.core Highest
Vendor pom groupid com.fasterxml.jackson.core Highest
Vendor pom artifactid jackson-annotations Low
Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-annotations Medium
Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest
Vendor manifest Bundle-Description Core annotations used for value types, used by Jackson data binding package. Medium
Product pom artifactid jackson-annotations Highest
Product file name jackson-annotations High
Product Manifest implementation-build-date 2013-11-13 20:56:27-0800 Low
Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low
Product pom groupid fasterxml.jackson.core Low
Product pom name Jackson-annotations High
Product pom description Core annotations used for value types, used by Jackson data binding package.
Medium
Product Manifest Implementation-Title Jackson-annotations High
Product pom parent-groupid com.fasterxml Low
Product pom parent-artifactid oss-parent Medium
Product Manifest Bundle-Name Jackson-annotations Medium
Product central artifactid jackson-annotations Highest
Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-annotations Medium
Product pom url http://wiki.fasterxml.com/JacksonHome Medium
Product manifest Bundle-Description Core annotations used for value types, used by Jackson data binding package. Medium
Product Manifest specification-title Jackson-annotations Medium
Version Manifest Implementation-Version 2.3.0 High
Version central version 2.3.0 Highest
Version file version 2.3.0 Highest
Version pom version 2.3.0 Highest
jackson-core-2.3.1.jar
Description: Core Jackson abstractions, basic JSON streaming API implementation
License:
http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.3.1/jackson-core-2.3.1.jar
MD5: aa2152b5f610a2dee75bb81bcab66c36
SHA1: f9f7185c92ca5fefe2fb3efdeb477a67c96ea2d0
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom artifactid jackson-core Low
Vendor pom parent-artifactid oss-parent Low
Vendor pom description Core Jackson abstractions, basic JSON streaming API implementation
Medium
Vendor pom parent-groupid com.fasterxml Medium
Vendor pom name Jackson-core High
Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low
Vendor Manifest Implementation-Vendor FasterXML High
Vendor Manifest specification-vendor FasterXML Low
Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium
Vendor pom groupid fasterxml.jackson.core Highest
Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium
Vendor central groupid com.fasterxml.jackson.core Highest
Vendor pom groupid com.fasterxml.jackson.core Highest
Vendor manifest Bundle-Description Core Jackson abstractions, basic JSON streaming API implementation Medium
Vendor Manifest implementation-build-date 2013-12-27 17:00:34-0800 Low
Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest
Vendor file name jackson-core High
Product Manifest Bundle-Name Jackson-core Medium
Product pom description Core Jackson abstractions, basic JSON streaming API implementation
Medium
Product pom name Jackson-core High
Product Manifest specification-title Jackson-core Medium
Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low
Product Manifest Implementation-Title Jackson-core High
Product pom groupid fasterxml.jackson.core Low
Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-core Medium
Product manifest Bundle-Description Core Jackson abstractions, basic JSON streaming API implementation Medium
Product pom parent-groupid com.fasterxml Low
Product central artifactid jackson-core Highest
Product pom parent-artifactid oss-parent Medium
Product Manifest implementation-build-date 2013-12-27 17:00:34-0800 Low
Product pom artifactid jackson-core Highest
Product file name jackson-core High
Product pom url http://wiki.fasterxml.com/JacksonHome Medium
Version central version 2.3.1 Highest
Version file version 2.3.1 Highest
Version Manifest Implementation-Version 2.3.1 High
Version pom version 2.3.1 Highest
jackson-databind-2.3.1.jar
Description: General data-binding functionality for Jackson: works on core streaming API
License:
http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.3.1/jackson-databind-2.3.1.jar
MD5: 4de637793707fdecb1b7a90f677103ec
SHA1: c4096a8323bbbcbeda072e3def123a9b66783361
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid oss-parent Low
Vendor file name jackson-databind High
Vendor pom parent-groupid com.fasterxml Medium
Vendor pom artifactid jackson-databind Low
Vendor Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low
Vendor Manifest Implementation-Vendor FasterXML High
Vendor Manifest specification-vendor FasterXML Low
Vendor manifest Bundle-Description General data-binding functionality for Jackson: works on core streaming API Medium
Vendor pom groupid fasterxml.jackson.core Highest
Vendor Manifest Implementation-Vendor-Id com.fasterxml.jackson.core Medium
Vendor central groupid com.fasterxml.jackson.core Highest
Vendor pom groupid com.fasterxml.jackson.core Highest
Vendor Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium
Vendor Manifest implementation-build-date 2013-12-27 18:28:29-0800 Low
Vendor pom name jackson-databind High
Vendor pom url http://wiki.fasterxml.com/JacksonHome Highest
Vendor pom description General data-binding functionality for Jackson: works on core streaming API Medium
Product file name jackson-databind High
Product Manifest specification-title jackson-databind Medium
Product Manifest bundle-docurl http://wiki.fasterxml.com/JacksonHome Low
Product pom groupid fasterxml.jackson.core Low
Product central artifactid jackson-databind Highest
Product pom artifactid jackson-databind Highest
Product manifest Bundle-Description General data-binding functionality for Jackson: works on core streaming API Medium
Product pom parent-groupid com.fasterxml Low
Product Manifest bundle-symbolicname com.fasterxml.jackson.core.jackson-databind Medium
Product pom parent-artifactid oss-parent Medium
Product Manifest implementation-build-date 2013-12-27 18:28:29-0800 Low
Product pom name jackson-databind High
Product Manifest Bundle-Name jackson-databind Medium
Product Manifest Implementation-Title jackson-databind High
Product pom url http://wiki.fasterxml.com/JacksonHome Medium
Product pom description General data-binding functionality for Jackson: works on core streaming API Medium
Version central version 2.3.1 Highest
Version file version 2.3.1 Highest
Version Manifest Implementation-Version 2.3.1 High
Version pom version 2.3.1 Highest
Published Vulnerabilities
CVE-2017-15095 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Vulnerable Software & Versions: (show all )
CVE-2017-17485 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
CVE-2017-7525 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
BID - 99623
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1462702
CONFIRM - https://cwiki.apache.org/confluence/display/WW/S2-055
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1599
CONFIRM - https://github.com/FasterXML/jackson-databind/issues/1723
CONFIRM - https://security.netapp.com/advisory/ntap-20171214-0002/
CONFIRM - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
CONFIRM - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
DEBIAN - DSA-4004
MISC - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
MLIST - [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
MLIST - [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
REDHAT - RHSA-2017:1834
REDHAT - RHSA-2017:1835
REDHAT - RHSA-2017:1836
REDHAT - RHSA-2017:1837
REDHAT - RHSA-2017:1839
REDHAT - RHSA-2017:1840
REDHAT - RHSA-2017:2477
REDHAT - RHSA-2017:2546
REDHAT - RHSA-2017:2547
REDHAT - RHSA-2017:2633
REDHAT - RHSA-2017:2635
REDHAT - RHSA-2017:2636
REDHAT - RHSA-2017:2637
REDHAT - RHSA-2017:2638
REDHAT - RHSA-2017:3141
REDHAT - RHSA-2017:3454
REDHAT - RHSA-2017:3455
REDHAT - RHSA-2017:3456
REDHAT - RHSA-2017:3458
REDHAT - RHSA-2018:0294
REDHAT - RHSA-2018:0342
REDHAT - RHSA-2018:1449
REDHAT - RHSA-2018:1450
REDHAT - RHSA-2019:0910
SECTRACK - 1039744
SECTRACK - 1039947
SECTRACK - 1040360
Vulnerable Software & Versions: (show all )
CVE-2018-1000873 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20 Improper Input Validation
Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Vulnerable Software & Versions: (show all )
CVE-2018-14719 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14720 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-14721 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-918 Server-Side Request Forgery (SSRF)
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19360 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19361 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-19362 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-502 Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerable Software & Versions: (show all )
CVE-2018-5968 suppress
Severity:
Medium
CVSS Score: 5.1
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-184 Incomplete Blacklist
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Vulnerable Software & Versions: (show all )
CVE-2018-7489 suppress
Severity:
High
CVSS Score: 7.5
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-184 Incomplete Blacklist
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Vulnerable Software & Versions: (show all )
CVE-2019-12086 suppress
Severity:
Medium
CVSS Score: 5.0
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200 Information Exposure
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Vulnerable Software & Versions: (show all )
social-component-service-5.3.x-SNAPSHOT.jar
Description: eXo Social Service Component
File Path: /srv/ciagent/workspace/PLF/social-develop-site/sources/component/service/target/social-component-service-5.3.x-SNAPSHOT.jar
MD5: 039487cb7889c983ec7daa930526fc78
SHA1: ba5ae83c58b7b4548c95acfdf9deb519bcdc6070
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom description eXo Social Service Component Medium
Vendor pom name eXo PLF:: Social Service Component High
Vendor pom artifactid social-component-service Low
Vendor Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-service Low
Vendor pom groupid org.exoplatform.social Highest
Vendor pom groupid exoplatform.social Highest
Vendor pom parent-artifactid social-component Low
Vendor file name social-component-service High
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-groupid org.exoplatform.social Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.social Medium
Vendor Manifest date 2019-05-26T07:45:21Z Low
Product pom description eXo Social Service Component Medium
Product pom parent-groupid org.exoplatform.social Low
Product pom name eXo PLF:: Social Service Component High
Product Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-service Low
Product pom groupid exoplatform.social Low
Product file name social-component-service High
Product Manifest Implementation-Title eXo PLF:: Social Service Component High
Product pom artifactid social-component-service Highest
Product Manifest specification-title eXo PLF:: Social Service Component Medium
Product pom parent-artifactid social-component Medium
Product Manifest date 2019-05-26T07:45:21Z Low
Version file version 5.3 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.social:social-component-service:5.3.x-SNAPSHOT
Confidence :High
social-component-notification-5.3.x-SNAPSHOT.jar
Description: eXo Social Notification Component
File Path: /srv/ciagent/workspace/PLF/social-develop-site/sources/component/notification/target/social-component-notification-5.3.x-SNAPSHOT.jar
MD5: 9bd6e83f075985862df34e636c7ad37d
SHA1: aa1bbebbd0550830fa7a52a03c85695b6c8ea8ea
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor Manifest specification-vendor eXo Platform SAS Low
Vendor pom groupid org.exoplatform.social Highest
Vendor pom groupid exoplatform.social Highest
Vendor pom artifactid social-component-notification Low
Vendor Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-notification Low
Vendor pom description eXo Social Notification Component Medium
Vendor file name social-component-notification High
Vendor pom parent-artifactid social-component Low
Vendor pom name eXo PLF:: Social Notification Component High
Vendor Manifest Implementation-Vendor eXo Platform SAS High
Vendor pom parent-groupid org.exoplatform.social Medium
Vendor Manifest Implementation-Vendor-Id org.exoplatform.social Medium
Vendor Manifest date 2019-05-26T07:45:21Z Low
Product pom parent-groupid org.exoplatform.social Low
Product Manifest implementation-url https://projects.exoplatform.org/social/social-component/social-component-notification Low
Product pom description eXo Social Notification Component Medium
Product file name social-component-notification High
Product pom groupid exoplatform.social Low
Product pom name eXo PLF:: Social Notification Component High
Product pom artifactid social-component-notification Highest
Product Manifest Implementation-Title eXo PLF:: Social Notification Component High
Product Manifest specification-title eXo PLF:: Social Notification Component Medium
Product pom parent-artifactid social-component Medium
Product Manifest date 2019-05-26T07:45:21Z Low
Version file version 5.3 Highest
Version pom version 5.3.x-SNAPSHOT Highest
Version Manifest Implementation-Version 5.3.x-SNAPSHOT High
maven: org.exoplatform.social:social-component-notification:5.3.x-SNAPSHOT
Confidence :High
ehcache-core-2.6.9.jar: sizeof-agent.jar
File Path: /home/ciagent/.m2/repository/net/sf/ehcache/ehcache-core/2.6.9/ehcache-core-2.6.9.jar/net/sf/ehcache/pool/sizeof/sizeof-agent.jar
MD5: 5ad919b3ac0516897bdca079c9a222a8
SHA1: e86399a80ae6a6c7a563717eaa0ce9ba4708571c
Referenced In Project/Scope:
eXo PLF:: Social Notification Extension:runtime
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid ehcache-parent Low
Vendor pom artifactid sizeof-agent Low
Vendor Manifest hudson-project sizeof-agent_sizeof-agent-1.0.1_publisher Low
Vendor pom url http://www.ehcache.org Highest
Vendor file name sizeof-agent High
Vendor pom name Ehcache Size-Of Agent High
Vendor Manifest jenkins-project sizeof-agent_sizeof-agent-1.0.1_publisher Low
Vendor Manifest hudson-build-number 6 Low
Vendor pom groupid net.sf.ehcache Highest
Vendor Manifest jenkins-build-number 6 Low
Product Manifest hudson-project sizeof-agent_sizeof-agent-1.0.1_publisher Low
Product file name sizeof-agent High
Product pom artifactid sizeof-agent Highest
Product pom groupid net.sf.ehcache Low
Product pom parent-artifactid ehcache-parent Medium
Product pom name Ehcache Size-Of Agent High
Product Manifest jenkins-project sizeof-agent_sizeof-agent-1.0.1_publisher Low
Product Manifest hudson-build-number 6 Low
Product pom url http://www.ehcache.org Medium
Product Manifest jenkins-build-number 6 Low
Version pom version 1.0.1 Highest
Version pom parent-version 1.0.1 Low
Version Manifest hudson-version 1.449 Medium
Version Manifest hudson-build-number 6 Low
Version Manifest jenkins-version 1.449 Medium
Version Manifest jenkins-build-number 6 Low
maven: net.sf.ehcache:sizeof-agent:1.0.1
Confidence :High
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling/pom.xml
Description: JBoss Marshalling API
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling/pom.xml
MD5: 2b0e9541ec4a0f19e378eaabc5e85ea0
SHA1: da91abf3554dceed9454faa89acafc48c0649df5
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid jboss-marshalling-parent Low
Vendor pom groupid jboss.marshalling Highest
Vendor pom description JBoss Marshalling API Medium
Vendor pom artifactid jboss-marshalling Low
Vendor pom parent-groupid org.jboss.marshalling Medium
Vendor pom name JBoss Marshalling API High
Product pom parent-groupid org.jboss.marshalling Low
Product pom artifactid jboss-marshalling Highest
Product pom parent-artifactid jboss-marshalling-parent Medium
Product pom description JBoss Marshalling API Medium
Product pom groupid jboss.marshalling Low
Product pom name JBoss Marshalling API High
Version pom version 2.0.0.Beta3 Highest
maven: org.jboss.marshalling:jboss-marshalling:2.0.0.Beta3
Confidence :High
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-river/pom.xml
Description: JBoss Marshalling River Implementation
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-river/pom.xml
MD5: 1dda062cdd15bd160a4ee6cf1be9f93d
SHA1: 366411529f00ec1eb4451b9b45012bfc09bde34b
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid jboss-marshalling-parent Low
Vendor pom description JBoss Marshalling River Implementation Medium
Vendor pom artifactid jboss-marshalling-river Low
Vendor pom name JBoss Marshalling River High
Vendor pom groupid jboss.marshalling Highest
Vendor pom parent-groupid org.jboss.marshalling Medium
Product pom description JBoss Marshalling River Implementation Medium
Product pom name JBoss Marshalling River High
Product pom parent-groupid org.jboss.marshalling Low
Product pom parent-artifactid jboss-marshalling-parent Medium
Product pom artifactid jboss-marshalling-river Highest
Product pom groupid jboss.marshalling Low
Version pom version 2.0.0.Beta3 Highest
maven: org.jboss.marshalling:jboss-marshalling-river:2.0.0.Beta3
Confidence :High
jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-serial/pom.xml
Description: JBoss Marshalling Serial Implementation
File Path: /home/ciagent/.m2/repository/org/jboss/marshalling/jboss-marshalling-osgi/2.0.0.Beta3/jboss-marshalling-osgi-2.0.0.Beta3.jar/META-INF/maven/org.jboss.marshalling/jboss-marshalling-serial/pom.xml
MD5: 16b74097e7ec70db37b74205776ad0a7
SHA1: cf519c8805a14e6ce20933b7a89bfe0d5a7dbf0f
Evidence
Type Source Name Value Confidence
Vendor pom parent-artifactid jboss-marshalling-parent Low
Vendor pom artifactid jboss-marshalling-serial Low
Vendor pom groupid jboss.marshalling Highest
Vendor pom description JBoss Marshalling Serial Implementation Medium
Vendor pom name JBoss Marshalling Serial High
Vendor pom parent-groupid org.jboss.marshalling Medium
Product pom parent-groupid org.jboss.marshalling Low
Product pom parent-artifactid jboss-marshalling-parent Medium
Product pom artifactid jboss-marshalling-serial Highest
Product pom description JBoss Marshalling Serial Implementation Medium
Product pom name JBoss Marshalling Serial High
Product pom groupid jboss.marshalling Low
Version pom version 2.0.0.Beta3 Highest
maven: org.jboss.marshalling:jboss-marshalling-serial:2.0.0.Beta3
Confidence :High
jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/pom.xml
Description: Support for reading and writing YAML-encoded data via Jackson abstractions.
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.4.2/jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/pom.xml
MD5: 287aac9a700de46369cc0e327e3577bc
SHA1: da124b77ecdec56e2af7ef65828ec493590ab214
Evidence
Type Source Name Value Confidence
Vendor pom url http://wiki.fasterxml.com/JacksonExtensionYAML Highest
Vendor pom description Support for reading and writing YAML-encoded data via Jackson abstractions.
Medium
Vendor pom artifactid jackson-dataformat-yaml Low
Vendor pom name Jackson-dataformat-YAML High
Vendor pom groupid fasterxml.jackson.dataformat Highest
Vendor pom parent-artifactid jackson-parent Low
Vendor pom parent-groupid com.fasterxml.jackson Medium
Product pom parent-artifactid jackson-parent Medium
Product pom description Support for reading and writing YAML-encoded data via Jackson abstractions.
Medium
Product pom groupid fasterxml.jackson.dataformat Low
Product pom parent-groupid com.fasterxml.jackson Low
Product pom url http://wiki.fasterxml.com/JacksonExtensionYAML Medium
Product pom name Jackson-dataformat-YAML High
Product pom artifactid jackson-dataformat-yaml Highest
Version pom version 2.4.2 Highest
Version pom parent-version 2.4.2 Low
maven: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.4.2
Confidence :High
cpe: cpe:/a:fasterxml:jackson:2.4.2
Confidence :Low
suppress
jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/org.yaml/snakeyaml/pom.xml
Description: YAML 1.1 parser and emitter for Java
License:
Apache License Version 2.0: LICENSE.txt
File Path: /home/ciagent/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.4.2/jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/org.yaml/snakeyaml/pom.xml
MD5: d103ace8c756cc13661469b53cff1794
SHA1: c9dbe57a55450ef61cdb139c01a8edea9206949d
Evidence
Type Source Name Value Confidence
Vendor pom description YAML 1.1 parser and emitter for Java Medium
Vendor pom groupid yaml Highest
Vendor pom url http://www.snakeyaml.org Highest
Vendor pom name SnakeYAML High
Vendor pom artifactid snakeyaml Low
Product pom groupid yaml Low
Product pom artifactid snakeyaml Highest
Product pom description YAML 1.1 parser and emitter for Java Medium
Product pom url http://www.snakeyaml.org Medium
Product pom name SnakeYAML High
Version pom version 1.12 Highest
maven: org.yaml:snakeyaml:1.12
Confidence :High
closure-compiler-v20170910.jar/META-INF/maven/com.google.javascript/closure-compiler/pom.xml
Description:
Closure Compiler is a JavaScript optimizing compiler. It parses your
JavaScript, analyzes it, removes dead code and rewrites and minimizes
what's left. It also checks syntax, variable references, and types, and
warns about common JavaScript pitfalls. It is used in many of Google's
JavaScript apps, including Gmail, Google Web Search, Google Maps, and
Google Docs.
File Path: /home/ciagent/.m2/repository/com/google/javascript/closure-compiler/v20170910/closure-compiler-v20170910.jar/META-INF/maven/com.google.javascript/closure-compiler/pom.xml
MD5: 1b66a934999bffadab1ef6f26b68288b
SHA1: c4f1e36254f80d8b202705a678e804bc484c1e27
Evidence
Type Source Name Value Confidence
Vendor pom url https://developers.google.com/closure/compiler/ Highest
Vendor pom parent-groupid com.google.javascript Medium
Vendor pom description Closure Compiler is a JavaScript optimizing compiler. It parses your JavaScript, analyzes it, removes dead code and rewrites and minimizes what's left. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. It is used in many of Google's JavaScript apps, including Gmail, Google Web Search, Google Maps, and Google Docs. Low
Vendor pom name Closure Compiler High
Vendor pom groupid google.javascript Highest
Vendor pom artifactid closure-compiler Low
Vendor pom parent-artifactid closure-compiler-main Low
Product pom url https://developers.google.com/closure/compiler/ Medium
Product pom groupid google.javascript Low
Product pom artifactid closure-compiler Highest
Product pom parent-groupid com.google.javascript Low
Product pom parent-artifactid closure-compiler-main Medium
Product pom description Closure Compiler is a JavaScript optimizing compiler. It parses your JavaScript, analyzes it, removes dead code and rewrites and minimizes what's left. It also checks syntax, variable references, and types, and warns about common JavaScript pitfalls. It is used in many of Google's JavaScript apps, including Gmail, Google Web Search, Google Maps, and Google Docs. Low
Product pom name Closure Compiler High
Version pom version v20170910 Highest
maven: com.google.javascript:closure-compiler:v20170910
Confidence :High
cpe: cpe:/a:google:gmail:-
Confidence :Low
suppress
Published Vulnerabilities
CVE-2017-17689 suppress
Severity:
Medium
CVSS Score: 4.3
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
CWE: CWE-310 Cryptographic Issues
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
Vulnerable Software & Versions: (show all )