Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 6.1.6Report Generated On : Mon, 6 Dec 2021 15:06:09 GMTDependencies Scanned : 53 (50 unique)Vulnerable Dependencies : 6 Vulnerabilities Found : 8Vulnerabilities Suppressed : 0... NVD CVE Checked : 2021-12-06T15:04:04NVD CVE Modified : 2021-12-06T13:00:01VersionCheckOn : 2021-12-06T15:04:04Summary Display:
Showing Vulnerable Dependencies (click to show all) Dependencies Description:
The application programming interface for the repository system.
File Path: /home/runner/.m2/repository/org/sonatype/aether/aether-api/1.13.1/aether-api-1.13.1.jarMD5: 6438f4b31d3f3220d88edc16abdc3721SHA1: e48292eae5e14ec44978aa53debb1af7ddd6df93SHA256: ae8dc80232771f8913febfa410c5719e9ba8ded81fb99788e214fd676dbbe13fReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom parent-groupid org.sonatype.aether Medium Vendor jar package name repository Highest Vendor jar package name sonatype Highest Vendor pom groupid sonatype.aether Highest Vendor jar package name sonatype Low Vendor pom artifactid aether-api Low Vendor pom parent-artifactid aether Low Vendor file name aether-api High Vendor jar package name aether Highest Vendor pom name Aether :: API High Vendor jar package name aether Low Vendor pom groupid org.sonatype.aether Highest Product pom parent-groupid org.sonatype.aether Medium Product jar package name repository Highest Product jar package name sonatype Highest Product pom parent-artifactid aether Medium Product pom groupid sonatype.aether Highest Product file name aether-api High Product jar package name aether Highest Product pom name Aether :: API High Product jar package name aether Low Product pom artifactid aether-api Highest Version pom version 1.13.1 Highest Version file version 1.13.1 High
Description:
An implementation of the repository system.
File Path: /home/runner/.m2/repository/org/sonatype/aether/aether-impl/1.13.1/aether-impl-1.13.1.jarMD5: 4236e1586cfdd28f032bcf71293f6bb1SHA1: ba2656934fa7c0f20c0c3882873dc705e16ae201SHA256: 865511994805827e88f327944a089142bb7f3d88cde271ba3dceb732cb137a93Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom parent-groupid org.sonatype.aether Medium Vendor jar package name sonatype Highest Vendor pom groupid sonatype.aether Highest Vendor pom artifactid aether-impl Low Vendor jar package name impl Low Vendor jar package name sonatype Low Vendor pom name Aether :: Implementation High Vendor jar package name impl Highest Vendor pom parent-artifactid aether Low Vendor file name aether-impl High Vendor jar package name aether Highest Vendor jar package name aether Low Vendor pom groupid org.sonatype.aether Highest Product pom parent-groupid org.sonatype.aether Medium Product jar package name sonatype Highest Product pom groupid sonatype.aether Highest Product pom artifactid aether-impl Highest Product jar package name impl Low Product pom name Aether :: Implementation High Product jar package name impl Highest Product pom parent-artifactid aether Medium Product file name aether-impl High Product jar package name aether Highest Product jar package name internal Low Product jar package name aether Low Version pom version 1.13.1 Highest Version file version 1.13.1 High
Description:
The service provider interface for repository system implementations and repository connectors.
File Path: /home/runner/.m2/repository/org/sonatype/aether/aether-spi/1.13.1/aether-spi-1.13.1.jarMD5: 3f1881f890062e779fa27aa9a6789cebSHA1: c62b02d2a5a3939fded72039dd83e5b8ed42d45eSHA256: d5de4e299be5a79feb1dbe8ff3814034c6e44314b4c00b92ffa8d97576ded5b3Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom parent-groupid org.sonatype.aether Medium Vendor jar package name sonatype Highest Vendor pom groupid sonatype.aether Highest Vendor jar package name spi Low Vendor jar package name sonatype Low Vendor pom name Aether :: SPI High Vendor file name aether-spi High Vendor jar package name spi Highest Vendor pom parent-artifactid aether Low Vendor jar package name aether Highest Vendor jar package name aether Low Vendor pom artifactid aether-spi Low Vendor pom groupid org.sonatype.aether Highest Product pom parent-groupid org.sonatype.aether Medium Product jar package name connector Low Product jar package name sonatype Highest Product pom groupid sonatype.aether Highest Product jar package name spi Low Product pom name Aether :: SPI High Product file name aether-spi High Product jar package name spi Highest Product pom artifactid aether-spi Highest Product pom parent-artifactid aether Medium Product jar package name aether Highest Product jar package name aether Low Version pom version 1.13.1 Highest Version file version 1.13.1 High
Description:
A collection of utility classes to ease usage of the repository system.
File Path: /home/runner/.m2/repository/org/sonatype/aether/aether-util/1.13.1/aether-util-1.13.1.jarMD5: 119757ef761de4a43c763622dcb1f56eSHA1: c8487ceb499b9ced96694731810acd1a70e13acaSHA256: 687799a0ce988bee9e8eb9ae0ba870300adc0114248ad4a4327bdb625d27e010Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name util Highest Vendor pom parent-groupid org.sonatype.aether Medium Vendor jar package name repository Highest Vendor jar package name sonatype Highest Vendor pom groupid sonatype.aether Highest Vendor jar package name sonatype Low Vendor pom name Aether :: Utilities High Vendor file name aether-util High Vendor jar package name util Low Vendor pom artifactid aether-util Low Vendor pom parent-artifactid aether Low Vendor jar package name aether Highest Vendor jar package name aether Low Vendor pom groupid org.sonatype.aether Highest Product pom artifactid aether-util Highest Product jar package name util Highest Product pom parent-groupid org.sonatype.aether Medium Product jar package name repository Highest Product jar package name sonatype Highest Product pom groupid sonatype.aether Highest Product pom name Aether :: Utilities High Product file name aether-util High Product jar package name util Low Product pom parent-artifactid aether Medium Product jar package name aether Highest Product jar package name aether Low Version pom version 1.13.1 Highest Version file version 1.13.1 High
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/commons-codec/commons-codec/1.10/commons-codec-1.10.jar
MD5: 353cf6a2bdba09595ccfa073b78c7fcb
SHA1: 4b95f4897fa13f2cd904aee711aeafc0c5295cd8
SHA256: 4241dfa94e711d435f29a4604a3e2de5c4aa3c165e23bd066be6fc1fc4309569
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor file name commons-codec High Vendor jar package name commons Highest Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low Vendor pom groupid commons-codec Highest Vendor pom artifactid commons-codec Low Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest bundle-symbolicname org.apache.commons.codec Medium Vendor pom parent-artifactid commons-parent Low Vendor jar package name codec Highest Vendor pom url http://commons.apache.org/proper/commons-codec/ Highest Vendor jar package name encoder Highest Vendor pom name Apache Commons Codec High Vendor Manifest Implementation-Vendor-Id org.apache Medium Product jar package name apache Highest Product file name commons-codec High Product jar package name commons Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Low Product pom groupid commons-codec Highest Product Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Low Product pom parent-groupid org.apache.commons Medium Product Manifest Implementation-Title Apache Commons Codec High Product Manifest bundle-symbolicname org.apache.commons.codec Medium Product Manifest specification-title Apache Commons Codec Medium Product pom artifactid commons-codec Highest Product jar package name codec Highest Product pom parent-artifactid commons-parent Medium Product jar package name encoder Highest Product pom name Apache Commons Codec High Product pom url http://commons.apache.org/proper/commons-codec/ Medium Product Manifest Bundle-Name Apache Commons Codec Medium Version pom version 1.10 Highest Version Manifest Implementation-Version 1.10 High Version pom parent-version 1.10 Low Version file version 1.10 High
Description:
Apache Commons Compress software defines an API for working with
compression and archive formats. These include: bzip2, gzip, pack200,
lzma, xz, Snappy, traditional Unix Compress, DEFLATE, DEFLATE64, LZ4,
Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar
MD5: 2a713d10331bc4e13459a3dc0463f16f
SHA1: 4ec95b60d4e86b5c95a0e919cb172a0af98011ef
SHA256: 6aecfd5459728a595601cfa07258d131972ffc39b492eb48bdd596577a2f244a
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest bundle-docurl https://commons.apache.org/proper/commons-compress/ Low Vendor jar package name apache Highest Vendor pom name Apache Commons Compress High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor jar package name commons Highest Vendor pom url https://commons.apache.org/proper/commons-compress/ Highest Vendor Manifest build-jdk-spec 1.8 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.commons Medium Vendor jar package name compress Highest Vendor pom artifactid commons-compress Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom parent-artifactid commons-parent Low Vendor pom groupid org.apache.commons Highest Vendor file name commons-compress High Vendor Manifest implementation-build UNKNOWN@r60e3d9f6bef1e431f8738e881c051d706f81e6cf; 2021-07-09 16:56:00+0000 Low Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest automatic-module-name org.apache.commons.compress Medium Vendor Manifest bundle-symbolicname org.apache.commons.commons-compress Medium Vendor Manifest extension-name org.apache.commons.compress Medium Vendor pom groupid apache.commons Highest Product Manifest bundle-docurl https://commons.apache.org/proper/commons-compress/ Low Product jar package name apache Highest Product pom name Apache Commons Compress High Product pom artifactid commons-compress Highest Product jar package name commons Highest Product Manifest build-jdk-spec 1.8 Low Product pom parent-groupid org.apache.commons Medium Product jar package name compress Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product file name commons-compress High Product Manifest Bundle-Name Apache Commons Compress Medium Product Manifest Implementation-Title Apache Commons Compress High Product pom parent-artifactid commons-parent Medium Product pom url https://commons.apache.org/proper/commons-compress/ Medium Product Manifest specification-title Apache Commons Compress Medium Product Manifest implementation-build UNKNOWN@r60e3d9f6bef1e431f8738e881c051d706f81e6cf; 2021-07-09 16:56:00+0000 Low Product Manifest automatic-module-name org.apache.commons.compress Medium Product Manifest bundle-symbolicname org.apache.commons.commons-compress Medium Product Manifest extension-name org.apache.commons.compress Medium Product pom groupid apache.commons Highest Version pom version 1.21 Highest Version Manifest Implementation-Version 1.21 High Version pom parent-version 1.21 Low Version file version 1.21 High
Description:
The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/commons-io/commons-io/2.5/commons-io-2.5.jar
MD5: e2d74794fba570ec2115fb9d5b05dc9b
SHA1: 2852e6e05fbb95076fc091f6d1780f1f8fe35e0f
SHA256: a10418348d234968600ccb1d988efcbbd08716e1d96936ccc1880e7d22513474
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom groupid commons-io Highest Vendor jar package name apache Highest Vendor file name commons-io High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest implementation-build tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400 Low Vendor pom name Apache Commons IO High Vendor jar package name commons Highest Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom artifactid commons-io Low Vendor pom parent-groupid org.apache.commons Medium Vendor jar package name io Highest Vendor Manifest implementation-url http://commons.apache.org/proper/commons-io/ Low Vendor pom url http://commons.apache.org/proper/commons-io/ Highest Vendor pom parent-artifactid commons-parent Low Vendor Manifest bundle-symbolicname org.apache.commons.io Medium Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-io/ Low Product jar package name apache Highest Product pom groupid commons-io Highest Product file name commons-io High Product pom url http://commons.apache.org/proper/commons-io/ Medium Product Manifest implementation-build tags/commons-io-2.5@r1739098; 2016-04-14 09:19:54-0400 Low Product pom name Apache Commons IO High Product jar package name commons Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product pom parent-groupid org.apache.commons Medium Product jar package name io Highest Product Manifest specification-title Apache Commons IO Medium Product pom artifactid commons-io Highest Product Manifest implementation-url http://commons.apache.org/proper/commons-io/ Low Product Manifest Implementation-Title Apache Commons IO High Product pom parent-artifactid commons-parent Medium Product Manifest bundle-symbolicname org.apache.commons.io Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-io/ Low Product Manifest Bundle-Name Apache Commons IO Medium Version file version 2.5 High Version pom parent-version 2.5 Low Version pom version 2.5 Highest Version Manifest Implementation-Version 2.5 High
Published Vulnerabilities CVE-2021-29425 suppress
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (5.8) Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: MEDIUM (4.8) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.6/commons-lang3-3.6.jar
MD5: 5d18f68b5122fd398c118df53ab4cf55
SHA1: 9d28a6b23650e8a7e9063c04588ace6cf7012c17
SHA256: 89c27f03fff18d0b06e7afd7ef25e209766df95b6c1269d6c3ebbdea48d5f284
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor Manifest automatic-module-name org.apache.commons.lang3 Medium Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Vendor pom url http://commons.apache.org/proper/commons-lang/ Highest Vendor jar package name commons Highest Vendor Manifest bundle-symbolicname org.apache.commons.lang3 Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.commons Medium Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Vendor pom artifactid commons-lang3 Low Vendor jar package name lang3 Highest Vendor pom parent-artifactid commons-parent Low Vendor pom groupid org.apache.commons Highest Vendor Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Low Vendor Manifest Implementation-Vendor-Id org.apache.commons Medium Vendor file name commons-lang3 High Vendor pom name Apache Commons Lang High Vendor pom groupid apache.commons Highest Product jar package name apache Highest Product Manifest Bundle-Name Apache Commons Lang Medium Product Manifest automatic-module-name org.apache.commons.lang3 Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Low Product jar package name commons Highest Product Manifest bundle-symbolicname org.apache.commons.lang3 Medium Product pom artifactid commons-lang3 Highest Product pom parent-groupid org.apache.commons Medium Product Manifest Implementation-Title Apache Commons Lang High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))" Low Product Manifest specification-title Apache Commons Lang Medium Product jar package name lang3 Highest Product Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Low Product pom parent-artifactid commons-parent Medium Product pom url http://commons.apache.org/proper/commons-lang/ Medium Product file name commons-lang3 High Product pom name Apache Commons Lang High Product pom groupid apache.commons Highest Version pom parent-version 3.6 Low Version file version 3.6 High Version Manifest Implementation-Version 3.6 High Version pom version 3.6 Highest
Description:
Apache Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems. License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
MD5: 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1: 4bfc12adfe4842bf07b657f0369c4cb522955686
SHA256: daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom name Apache Commons Logging High Vendor jar package name apache Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor jar package name commons Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom parent-groupid org.apache.commons Medium Vendor jar package name logging Highest Vendor Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Vendor pom artifactid commons-logging Low Vendor Manifest bundle-symbolicname org.apache.commons.logging Medium Vendor pom parent-artifactid commons-parent Low Vendor pom url http://commons.apache.org/proper/commons-logging/ Highest Vendor pom groupid commons-logging Highest Vendor Manifest implementation-build tags/LOGGING_1_2_RC2@r1608092; 2014-07-05 20:11:44+0200 Low Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor file name commons-logging High Product pom name Apache Commons Logging High Product jar package name apache Highest Product jar package name commons Highest Product Manifest specification-title Apache Commons Logging Medium Product pom artifactid commons-logging Highest Product pom parent-groupid org.apache.commons Medium Product jar package name logging Highest Product Manifest Bundle-Name Apache Commons Logging Medium Product Manifest bundle-docurl http://commons.apache.org/proper/commons-logging/ Low Product pom url http://commons.apache.org/proper/commons-logging/ Medium Product Manifest bundle-symbolicname org.apache.commons.logging Medium Product Manifest Implementation-Title Apache Commons Logging High Product pom parent-artifactid commons-parent Medium Product pom groupid commons-logging Highest Product Manifest implementation-build tags/LOGGING_1_2_RC2@r1608092; 2014-07-05 20:11:44+0200 Low Product file name commons-logging High Version file version 1.2 High Version pom parent-version 1.2 Low Version pom version 1.2 Highest Version Manifest Implementation-Version 1.2 High
Description:
Apache HttpComponents Client
File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jarMD5: 40d6b9075fbd28fa10292a45a0db9457SHA1: e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cadaSHA256: 6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom parent-artifactid httpcomponents-client Low Vendor file name httpclient High Vendor pom groupid apache.httpcomponents Highest Vendor pom name Apache HttpClient High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor jar package name client Highest Vendor Manifest Implementation-Vendor-Id org.apache.httpcomponents Medium Vendor pom url http://hc.apache.org/httpcomponents-client Highest Vendor jar package name httpclient Highest Vendor Manifest automatic-module-name org.apache.httpcomponents.httpclient Medium Vendor pom groupid org.apache.httpcomponents Highest Vendor pom parent-groupid org.apache.httpcomponents Medium Vendor pom artifactid httpclient Low Vendor Manifest implementation-url http://hc.apache.org/httpcomponents-client Low Product pom url http://hc.apache.org/httpcomponents-client Medium Product jar package name apache Highest Product file name httpclient High Product pom groupid apache.httpcomponents Highest Product pom name Apache HttpClient High Product jar package name client Highest Product pom artifactid httpclient Highest Product jar package name httpclient Highest Product Manifest automatic-module-name org.apache.httpcomponents.httpclient Medium Product Manifest specification-title Apache HttpClient Medium Product pom parent-artifactid httpcomponents-client Medium Product Manifest Implementation-Title Apache HttpClient High Product pom parent-groupid org.apache.httpcomponents Medium Product Manifest implementation-url http://hc.apache.org/httpcomponents-client Low Product jar package name http Highest Version Manifest Implementation-Version 4.5.13 High Version pom version 4.5.13 Highest Version file version 4.5.13 High
Description:
Apache HttpComponents Core (blocking I/O)
File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpcore/4.4.14/httpcore-4.4.14.jarMD5: 2b3991eda121042765a5ee299556c200SHA1: 9dd1a631c082d92ecd4bd8fd4cf55026c720a8c1SHA256: f956209e450cb1d0c51776dfbd23e53e9dd8db9a1298ed62b70bf0944ba63b28Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor Manifest implementation-url http://hc.apache.org/httpcomponents-core-ga Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom parent-artifactid httpcomponents-core Low Vendor pom groupid apache.httpcomponents Highest Vendor pom name Apache HttpCore High Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest automatic-module-name org.apache.httpcomponents.httpcore Medium Vendor pom artifactid httpcore Low Vendor pom url http://hc.apache.org/httpcomponents-core-ga Highest Vendor Manifest implementation-build ${scmBranch}@r${buildNumber}; 2020-11-26 19:07:01+0000 Low Vendor file name httpcore High Vendor pom groupid org.apache.httpcomponents Highest Vendor Manifest Implementation-Vendor-Id org.apache Medium Vendor pom parent-groupid org.apache.httpcomponents Medium Vendor Manifest url http://hc.apache.org/httpcomponents-core-ga Low Product pom url http://hc.apache.org/httpcomponents-core-ga Medium Product jar package name apache Highest Product Manifest implementation-url http://hc.apache.org/httpcomponents-core-ga Low Product Manifest specification-title HttpComponents Apache HttpCore Medium Product pom groupid apache.httpcomponents Highest Product pom name Apache HttpCore High Product pom artifactid httpcore Highest Product Manifest automatic-module-name org.apache.httpcomponents.httpcore Medium Product Manifest implementation-build ${scmBranch}@r${buildNumber}; 2020-11-26 19:07:01+0000 Low Product file name httpcore High Product Manifest Implementation-Title HttpComponents Apache HttpCore High Product pom parent-artifactid httpcomponents-core Medium Product pom parent-groupid org.apache.httpcomponents Medium Product Manifest url http://hc.apache.org/httpcomponents-core-ga Low Product jar package name http Highest Version file version 4.4.14 High Version pom version 4.4.14 Highest Version Manifest Implementation-Version 4.4.14 High
Description:
Apache HttpComponents HttpClient - MIME coded entities
File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpmime/4.5.13/httpmime-4.5.13.jarMD5: 3f0c1ef2c9dc47b62b780192f54b0c18SHA1: efc110bad4a0d45cda7858e6beee1d8a8313da5aSHA256: 06e754d99245b98dcc2860dcb43d20e737d650da2bf2077a105f68accbd5c5ccReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest automatic-module-name org.apache.httpcomponents.httpmime Medium Vendor jar package name apache Highest Vendor file name httpmime High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom parent-artifactid httpcomponents-client Low Vendor jar package name mime Highest Vendor pom groupid apache.httpcomponents Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom name Apache HttpClient Mime High Vendor pom artifactid httpmime Low Vendor Manifest Implementation-Vendor-Id org.apache.httpcomponents Medium Vendor pom url http://hc.apache.org/httpcomponents-client Highest Vendor pom groupid org.apache.httpcomponents Highest Vendor pom parent-groupid org.apache.httpcomponents Medium Vendor Manifest implementation-url http://hc.apache.org/httpcomponents-client Low Product Manifest automatic-module-name org.apache.httpcomponents.httpmime Medium Product pom url http://hc.apache.org/httpcomponents-client Medium Product jar package name apache Highest Product file name httpmime High Product jar package name mime Highest Product pom groupid apache.httpcomponents Highest Product pom name Apache HttpClient Mime High Product pom artifactid httpmime Highest Product Manifest Implementation-Title Apache HttpClient Mime High Product pom parent-artifactid httpcomponents-client Medium Product pom parent-groupid org.apache.httpcomponents Medium Product Manifest specification-title Apache HttpClient Mime Medium Product Manifest implementation-url http://hc.apache.org/httpcomponents-client Low Product jar package name http Highest Version Manifest Implementation-Version 4.5.13 High Version pom version 4.5.13 Highest Version file version 4.5.13 High
Description:
Java Library for uploading and downloading AEM content packages via CRX Package Manager. License:
"The Apache Software License, Version 2.0";link="http://www.apache.org/licenses/LICENSE-2.0.txt" File Path: /home/runner/work/wcm-io-tooling/wcm-io-tooling/commons/crx-packmgr-helper/target/io.wcm.tooling.commons.crx-packmgr-helper-1.7.5-SNAPSHOT.jar
MD5: ff01434d57fc995f3a9da67fb33ec60f
SHA1: 5a22fad9dd5ba73740e894d0f6f31f007e04420f
SHA256: d8b10ee4388007bcd723dfc4d0d9435c564ab194fd8aa182d6a8fdc0ec071949
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom groupid io.wcm.tooling.commons Highest Vendor jar package name wcm Highest Vendor jar package name commons Highest Vendor pom artifactid io.wcm.tooling.commons.crx-packmgr-helper Low Vendor Manifest build-jdk-spec 1.8 Low Vendor jar package name tooling Highest Vendor jar package name io Highest Vendor pom parent-artifactid io.wcm.tooling.commons.parent Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom url ${site.url}/${site.url.module.prefix}/ Highest Vendor Manifest bundle-symbolicname io.wcm.tooling.commons.crx-packmgr-helper Medium Vendor pom name CRX Package Manager Helper High Vendor Manifest bundle-docurl https://wcm.io/tooling/commons/crx-packmgr-helper/ Low Vendor file name io.wcm.tooling.commons.crx-packmgr-helper High Product pom groupid io.wcm.tooling.commons Highest Product jar package name wcm Highest Product pom url ${site.url}/${site.url.module.prefix}/ Medium Product jar package name commons Highest Product Manifest build-jdk-spec 1.8 Low Product jar package name tooling Highest Product jar package name io Highest Product Manifest Bundle-Name wcm.io CRX Package Manager Helper Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product pom artifactid io.wcm.tooling.commons.crx-packmgr-helper Highest Product Manifest bundle-symbolicname io.wcm.tooling.commons.crx-packmgr-helper Medium Product pom name CRX Package Manager Helper High Product Manifest bundle-docurl https://wcm.io/tooling/commons/crx-packmgr-helper/ Low Product file name io.wcm.tooling.commons.crx-packmgr-helper High Product pom parent-artifactid io.wcm.tooling.commons.parent Medium Version pom version 1.7.5-SNAPSHOT Highest Version pom parent-version 1.7.5-SNAPSHOT Low
Description:
Jackrabbit-specific extensions to the JCR API License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/apache/jackrabbit/jackrabbit-api/2.19.3/jackrabbit-api-2.19.3.jar
MD5: 70fa2dc7695900e62e96aea2792f3a3a
SHA1: 8503de04a71ea05b680692d47bfe8a185ec5f4d0
SHA256: 045be6c97e17c771bbe885d6d0308722bb540b5bf693322a96aadb976de7aa5a
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name jackrabbit Highest Vendor jar package name apache Highest Vendor pom groupid org.apache.jackrabbit Highest Vendor pom artifactid jackrabbit-api Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor Manifest bundle-docurl http://jackrabbit.apache.org Low Vendor pom parent-groupid org.apache.jackrabbit Medium Vendor pom name Apache Jackrabbit API High Vendor pom groupid apache.jackrabbit Highest Vendor Manifest bundle-symbolicname org.apache.jackrabbit.jackrabbit-api Medium Vendor jar package name api Highest Vendor file name jackrabbit-api High Vendor pom parent-artifactid jackrabbit-parent Low Product jar package name jackrabbit Highest Product jar package name apache Highest Product Manifest Bundle-Name Apache Jackrabbit API Medium Product pom artifactid jackrabbit-api Highest Product pom parent-artifactid jackrabbit-parent Medium Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product Manifest bundle-docurl http://jackrabbit.apache.org Low Product pom parent-groupid org.apache.jackrabbit Medium Product pom name Apache Jackrabbit API High Product pom groupid apache.jackrabbit Highest Product Manifest bundle-symbolicname org.apache.jackrabbit.jackrabbit-api Medium Product jar package name api Highest Product file name jackrabbit-api High Version pom version 2.19.3 Highest Version Manifest Bundle-Version 2.19.3 High Version file version 2.19.3 High
Related Dependencies jackrabbit-jcr-commons-2.19.3.jarFile Path: /home/runner/.m2/repository/org/apache/jackrabbit/jackrabbit-jcr-commons/2.19.3/jackrabbit-jcr-commons-2.19.3.jar MD5: 3236148da9598a0b316192554aa4ed3e SHA1: 36f2ceb4dbcab8e1e188174361cab2908483e642 SHA256: da14b6310c764b81e608361c92e1eba67913684376cd5378b24e2cdbd5d44446 pkg:maven/org.apache.jackrabbit/jackrabbit-jcr-commons@2.19.3 Description:
Jaxen is a universal Java XPath engine. License:
http://jaxen.codehaus.org/license.html File Path: /home/runner/.m2/repository/jaxen/jaxen/1.1.6/jaxen-1.1.6.jar
MD5: a140517286b56eea981e188dcc3a13f6
SHA1: 3f8c36d9a0578e8e98f030c662b69888b1430ac0
SHA256: 5ac9c74bbb3964b34a886ba6b1b6c0b0dc3ebeebc1dc4a44942a76634490b3eb
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor file name jaxen High Vendor Manifest bundle-symbolicname jaxen Medium Vendor Manifest bundle-docurl http://codehaus.org Low Vendor pom name jaxen High Vendor pom url http://jaxen.codehaus.org/ Highest Vendor jar package name jaxen Highest Vendor jar package name xpath Highest Vendor pom organization url http://codehaus.org Medium Vendor pom artifactid jaxen Low Vendor pom organization name Codehaus High Vendor pom groupid jaxen Highest Product Manifest bundle-symbolicname jaxen Medium Product pom url http://jaxen.codehaus.org/ Medium Product pom name jaxen High Product jar package name jaxen Highest Product jar package name xpath Highest Product pom organization url http://codehaus.org Low Product pom groupid jaxen Highest Product Manifest Bundle-Name jaxen Medium Product file name jaxen High Product Manifest bundle-docurl http://codehaus.org Low Product pom organization name Codehaus Low Product pom artifactid jaxen Highest Version pom version 1.1.6 Highest Version Manifest Bundle-Version 1.1.6 High Version file version 1.1.6 High
Description:
JCL 1.2 implemented over SLF4J License:
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.32/jcl-over-slf4j-1.7.32.jar
MD5: 8788169f5d5be6550efc75d3bfffc82c
SHA1: 32c060250bcc5282cdbc1fd7008c12eb4ebad00e
SHA256: 60f3bda5922e3912889cca1311d1b227753610bf60cb4e5e914e8b2eaa0326b4
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor pom parent-groupid org.slf4j Medium Vendor jar package name logging Highest Vendor file name jcl-over-slf4j High Vendor Manifest bundle-symbolicname jcl.over.slf4j Medium Vendor pom groupid org.slf4j Highest Vendor pom artifactid jcl-over-slf4j Low Vendor Manifest automatic-module-name org.apache.commons.logging Medium Vendor pom groupid slf4j Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor pom name JCL 1.2 implemented over SLF4J High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product pom url http://www.slf4j.org Medium Product jar package name apache Highest Product jar package name commons Highest Product pom parent-groupid org.slf4j Medium Product jar package name logging Highest Product file name jcl-over-slf4j High Product Manifest Implementation-Title jcl-over-slf4j High Product pom parent-artifactid slf4j-parent Medium Product Manifest bundle-symbolicname jcl.over.slf4j Medium Product pom artifactid jcl-over-slf4j Highest Product Manifest automatic-module-name org.apache.commons.logging Medium Product pom groupid slf4j Highest Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest Bundle-Name jcl-over-slf4j Medium Product pom name JCL 1.2 implemented over SLF4J High Version file version 1.7.32 High Version Manifest Implementation-Version 1.7.32 High Version pom version 1.7.32 Highest Version Manifest Bundle-Version 1.7.32 High
Description:
The Content Repository API for JavaTM Technology Version 2.0 is specified by JSR-283.
This module contains the complete API as specified.
License:
Day Specification License: http://www.day.com/dam/day/downloads/jsr283/day-spec-license.htm
Day Specification License addendum: http://www.day.com/content/dam/day/downloads/jsr283/LICENSE.txt File Path: /home/runner/.m2/repository/javax/jcr/jcr/2.0/jcr-2.0.jar
MD5: ede5e78b16c8ed298ce0b6d296584ebd
SHA1: 08297216bcfe4aea369ed6ee0d1718133f752e97
SHA256: cbf083bc58cb88a0c19112187a4c52d3115f525b5bb7f2913635f5679e6e9743
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor file name jcr High Vendor jar package name javax Highest Vendor pom groupid javax.jcr Highest Vendor pom artifactid jcr Low Vendor jar package name repository Highest Vendor jar package name version Highest Vendor Manifest bundle-category jcr Low Vendor Manifest bundle-docurl http://www.jcp.org/en/jsr/detail?id=283 Low Vendor pom organization name Day Software High Vendor pom organization url http://www.day.com Medium Vendor pom name Content Repository for JavaTM Technology API High Vendor pom url http://www.jcp.org/en/jsr/detail?id=283 Highest Vendor Manifest bundle-symbolicname javax.jcr Medium Vendor jar package name jcr Highest Product file name jcr High Product jar package name javax Highest Product pom groupid javax.jcr Highest Product jar package name repository Highest Product jar package name version Highest Product Manifest bundle-category jcr Low Product Manifest bundle-docurl http://www.jcp.org/en/jsr/detail?id=283 Low Product pom url http://www.jcp.org/en/jsr/detail?id=283 Medium Product pom artifactid jcr Highest Product pom organization url http://www.day.com Low Product pom organization name Day Software Low Product pom name Content Repository for JavaTM Technology API High Product Manifest bundle-symbolicname javax.jcr Medium Product jar package name jcr Highest Product Manifest Bundle-Name Content Repository for JavaTM Technology API Medium Version pom version 2.0 Highest Version Manifest Bundle-Version 2.0 High Version file version 2.0 High
Description:
A complete, Java-based solution for accessing, manipulating,
and outputting XML data
License:
Similar to Apache License but with the acknowledgment clause removed: https://raw.github.com/hunterhacker/jdom/master/LICENSE.txt File Path: /home/runner/.m2/repository/org/jdom/jdom2/2.0.6/jdom2-2.0.6.jar
MD5: 86a30c9b1ddc08ca155747890db423b7
SHA1: 6f14738ec2e9dd0011e343717fa624a10f8aab64
SHA256: 1345f11ba606d15603d6740551a8c21947c0215640770ec67271fe78bea97cf5
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom artifactid jdom2 Low Vendor manifest: org/jdom2/filter/ Implementation-Vendor jdom.org Medium Vendor pom url http://www.jdom.org Highest Vendor file name jdom2 High Vendor manifest: org/jdom2/ Implementation-Vendor jdom.org Medium Vendor manifest: org/jdom2/xpath/ Implementation-Vendor jdom.org Medium Vendor manifest: org/jdom2/adapters/ Implementation-Vendor jdom.org Medium Vendor manifest: org/jdom2/input/ Implementation-Vendor jdom.org Medium Vendor pom groupid jdom Highest Vendor pom organization name JDOM High Vendor manifest: org/jdom2/transform/ Implementation-Vendor jdom.org Medium Vendor pom organization url http://www.jdom.org Medium Vendor pom name JDOM High Vendor manifest: org/jdom2/output/ Implementation-Vendor jdom.org Medium Vendor pom groupid org.jdom Highest Vendor jar package name jdom2 Highest Product file name jdom2 High Product manifest: org/jdom2/output/ Specification-Title JDOM Output Classes Medium Product manifest: org/jdom2/transform/ Specification-Title JDOM Transformation Classes Medium Product jar package name transform Highest Product jar package name output Highest Product manifest: org/jdom2/filter/ Specification-Title JDOM Filter Classes Medium Product pom groupid jdom Highest Product manifest: org/jdom2/ Implementation-Title org.jdom2 Medium Product pom url http://www.jdom.org Medium Product manifest: org/jdom2/adapters/ Implementation-Title org.jdom2.adapters Medium Product manifest: org/jdom2/ Specification-Title JDOM Classes Medium Product pom name JDOM High Product jar package name adapters Highest Product manifest: org/jdom2/adapters/ Specification-Title JDOM Adapter Classes Medium Product jar package name jdom2 Highest Product pom organization name JDOM Low Product manifest: org/jdom2/xpath/ Specification-Title JDOM XPath Classes Medium Product manifest: org/jdom2/output/ Implementation-Title org.jdom2.output Medium Product jar package name input Highest Product jar package name xpath Highest Product manifest: org/jdom2/transform/ Implementation-Title org.jdom2.transform Medium Product pom artifactid jdom2 Highest Product manifest: org/jdom2/input/ Specification-Title JDOM Input Classes Medium Product manifest: org/jdom2/input/ Implementation-Title org.jdom2.input Medium Product pom organization url http://www.jdom.org Low Product manifest: org/jdom2/xpath/ Implementation-Title org.jdom2.xpath Medium Product jar package name filter Highest Product manifest: org/jdom2/filter/ Implementation-Title org.jdom2.filter Medium Version pom version 2.0.6 Highest Version manifest: org/jdom2/input/ Implementation-Version 2.0.6 Medium Version manifest: org/jdom2/filter/ Implementation-Version 2.0.6 Medium Version manifest: org/jdom2/adapters/ Implementation-Version 2.0.6 Medium Version manifest: org/jdom2/ Implementation-Version 2.0.6 Medium Version manifest: org/jdom2/xpath/ Implementation-Version 2.0.6 Medium Version manifest: org/jdom2/output/ Implementation-Version 2.0.6 Medium Version manifest: org/jdom2/transform/ Implementation-Version 2.0.6 Medium Version file version 2.0.6 High
Published Vulnerabilities CVE-2021-33813 suppress
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References:
Vulnerable Software & Versions: (show all )
Description:
JSON is a light-weight, language independent, data interchange format.
See http://www.JSON.org/
The files in this package implement JSON encoders/decoders in Java.
It also includes the capability to convert between JSON and XML, HTTP
headers, Cookies, and CDL.
This is a reference implementation. There is a large number of JSON packages
in Java. Perhaps someday the Java community will standardize on one. Until
then, choose carefully.
The license includes this restriction: "The software shall be used for good,
not evil." If your conscience cannot live with that, then choose a different
package.
The package compiles on Java 1.2 thru Java 1.4.
License:
The JSON License: http://json.org/license.html File Path: /home/runner/.m2/repository/org/json/json/20140107/json-20140107.jar
MD5: 8ca2437d3dbbaa2e76195adedfd901f4
SHA1: d1ffca6e2482b002702c6a576166fd685e3370e3
SHA256: 8e5aa0a368bee60347b5a4ad861d9f68c7793f60deeea89efd449eb70d5ae622
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name cdl Highest Vendor pom name JSON in Java High Vendor pom groupid org.json Highest Vendor jar package name json Highest Vendor pom url douglascrockford/JSON-java Highest Vendor pom artifactid json Low Vendor jar package name json Low Vendor file name json-20140107 High Vendor jar package name xml Highest Vendor pom groupid json Highest Vendor jar package name http Highest Product jar package name cdl Highest Product pom name JSON in Java High Product pom url douglascrockford/JSON-java High Product jar package name json Highest Product pom artifactid json Highest Product file name json-20140107 High Product jar package name xml Highest Product pom groupid json Highest Product jar package name http Highest Version file version 20140107 Medium Version pom version 20140107 Highest
Description:
This module provides extensions to Aether for utilizing the Maven POM and Maven repository metadata for artifacts resolution
and download.
File Path: /home/runner/.m2/repository/org/apache/maven/maven-aether-provider/3.0.5/maven-aether-provider-3.0.5.jarMD5: aad430d4111400e0d78c4e79eb0f9797SHA1: e0716af7536efeb1da5d90b12464fea2a6fb40efSHA256: c74327cd5d7b137c8be3591c766271ac8ace1a617518f0410b8a95579f9839b0Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor jar package name repository Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor pom artifactid maven-aether-provider Low Vendor pom groupid org.apache.maven Highest Vendor file name maven-aether-provider High Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor pom parent-groupid org.apache.maven Medium Vendor pom name Maven Aether Provider High Product jar package name apache Highest Product file name maven-aether-provider High Product Manifest specification-title Maven Aether Provider Medium Product pom artifactid maven-aether-provider Highest Product Manifest Implementation-Title Maven Aether Provider High Product jar package name repository Highest Product jar package name maven Highest Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product pom name Maven Aether Provider High Product pom parent-artifactid maven Medium Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
Provides utility methods for creating JARs and other archive files from a Maven project. File Path: /home/runner/.m2/repository/org/apache/maven/maven-archiver/3.1.1/maven-archiver-3.1.1.jarMD5: 66d6f10af50840da5b7088bf0903356bSHA1: 978c773786667a2f642b034e55fac72ad8215385SHA256: f001bc8c7b2a378f50865799a85962dd9cc6d66f84a0bdeacc6333d72fd10788Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven-shared-components Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom parent-groupid org.apache.maven.shared Medium Vendor jar package name archiver Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor file name maven-archiver High Vendor pom groupid org.apache.maven Highest Vendor pom name Apache Maven Archiver High Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor Manifest implementation-url https://maven.apache.org/shared/maven-archiver/ Low Vendor pom artifactid maven-archiver Low Product jar package name apache Highest Product pom parent-groupid org.apache.maven.shared Medium Product jar package name archiver Highest Product jar package name maven Highest Product pom groupid apache.maven Highest Product Manifest specification-title Apache Maven Archiver Medium Product file name maven-archiver High Product Manifest Implementation-Title Apache Maven Archiver High Product pom name Apache Maven Archiver High Product Manifest implementation-url https://maven.apache.org/shared/maven-archiver/ Low Product pom artifactid maven-archiver Highest Product pom parent-artifactid maven-shared-components Medium Version pom parent-version 3.1.1 Low Version file version 3.1.1 High Version pom version 3.1.1 Highest Version Manifest Implementation-Version 3.1.1 High
File Path: /home/runner/.m2/repository/org/apache/maven/maven-artifact/3.0.5/maven-artifact-3.0.5.jarMD5: 37818c6f0ef84b6338fdd1520e9831dbSHA1: 7cd9aa7425c4a967bd39c2f6f61ab9535570fcb4SHA256: c6d5e244dd2329971f91b8df666ffe9e0b00a7dd014d6ee073b6f6cb82877f5cReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom name Maven Artifact High Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor jar package name artifact Highest Vendor pom groupid org.apache.maven Highest Vendor pom artifactid maven-artifact Low Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor file name maven-artifact High Vendor pom parent-groupid org.apache.maven Medium Product Manifest Implementation-Title Maven Artifact High Product jar package name apache Highest Product pom name Maven Artifact High Product file name maven-artifact High Product jar package name maven Highest Product Manifest specification-title Maven Artifact Medium Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product pom artifactid maven-artifact Highest Product pom parent-artifactid maven Medium Product jar package name artifact Highest Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
Maven Core classes. File Path: /home/runner/.m2/repository/org/apache/maven/maven-core/3.0.5/maven-core-3.0.5.jarMD5: ee0bd82403231f5e268fd85044027221SHA1: 27659b27346aff66d36e8ab16c7050220d875bcaSHA256: ac8e617f951ecde3c4f6bca4922fdd7861500fe7d58289f26ad5adac443075bcReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor file name maven-core High Vendor pom artifactid maven-core Low Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor pom groupid org.apache.maven Highest Vendor pom name Maven Core High Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor pom parent-groupid org.apache.maven Medium Product jar package name apache Highest Product pom artifactid maven-core Highest Product file name maven-core High Product pom name Maven Core High Product Manifest Implementation-Title Maven Core High Product jar package name maven Highest Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product Manifest specification-title Maven Core Medium Product pom parent-artifactid maven Medium Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Published Vulnerabilities CVE-2021-26291 suppress
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html CWE-346 Origin Validation Error
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N CVSSv3:
Base Score: CRITICAL (9.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Model for Maven POM (Project Object Model) File Path: /home/runner/.m2/repository/org/apache/maven/maven-model/3.0.5/maven-model-3.0.5.jarMD5: 40a2c5b201caf14b90faa27fd55f9515SHA1: 490d7489dd73137f6afef52c5a3e465201c533bfSHA256: 876a76b663db6c7326ad234afe430c473d3261a06b3284f31d5eb4889d1c3084Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom name Maven Model High Vendor jar package name model Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor pom artifactid maven-model Low Vendor pom groupid org.apache.maven Highest Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor file name maven-model High Vendor pom parent-groupid org.apache.maven Medium Product jar package name apache Highest Product pom name Maven Model High Product jar package name model Highest Product file name maven-model High Product Manifest Implementation-Title Maven Model High Product jar package name maven Highest Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product Manifest specification-title Maven Model Medium Product pom parent-artifactid maven Medium Product pom artifactid maven-model Highest Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
The effective model builder, with inheritance, profile activation, interpolation, ... File Path: /home/runner/.m2/repository/org/apache/maven/maven-model-builder/3.0.5/maven-model-builder-3.0.5.jarMD5: 98198ff5698781c9bf48b081bad49e62SHA1: f1e0b49ebe74335c11c93eec7549c65291053bc9SHA256: 45a2c6ff76e12678eaf576bd7a68d028c5a5ba85fdc216a381ea86e9187e1b51Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom artifactid maven-model-builder Low Vendor file name maven-model-builder High Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom name Maven Model Builder High Vendor jar package name model Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor jar package name interpolation Highest Vendor pom groupid org.apache.maven Highest Vendor jar package name profile Highest Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor pom parent-groupid org.apache.maven Medium Vendor jar package name inheritance Highest Product file name maven-model-builder High Product jar package name apache Highest Product pom name Maven Model Builder High Product jar package name model Highest Product jar package name maven Highest Product Manifest specification-title Maven Model Builder Medium Product pom groupid apache.maven Highest Product jar package name interpolation Highest Product Manifest Implementation-Title Maven Model Builder High Product jar package name profile Highest Product pom parent-groupid org.apache.maven Medium Product jar package name inheritance Highest Product pom parent-artifactid maven Medium Product pom artifactid maven-model-builder Highest Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
The API for plugins - Mojos - development. File Path: /home/runner/.m2/repository/org/apache/maven/maven-plugin-api/3.0.5/maven-plugin-api-3.0.5.jarMD5: cbe2f575d378fc6163c157a0e6af42a3SHA1: 958b87b581d46e7958b39733b0cc600927e8521eSHA256: 469505f75b8526a338cfd7e0ec841655ae52ddbcc1b36482e97d72f52ce7d890Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid maven-plugin-api Low Vendor file name maven-plugin-api High Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor pom groupid org.apache.maven Highest Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor jar package name plugin Highest Vendor pom parent-groupid org.apache.maven Medium Vendor pom name Maven Plugin API High Product Manifest Implementation-Title Maven Plugin API High Product jar package name apache Highest Product Manifest specification-title Maven Plugin API Medium Product file name maven-plugin-api High Product jar package name maven Highest Product jar package name plugin Highest Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product pom parent-artifactid maven Medium Product pom name Maven Plugin API High Product pom artifactid maven-plugin-api Highest Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
Per-directory local and remote repository metadata. File Path: /home/runner/.m2/repository/org/apache/maven/maven-repository-metadata/3.0.5/maven-repository-metadata-3.0.5.jarMD5: 2b5e8628b7d1d32829437dd1dc66f97aSHA1: 94475fff77103ae46a1b02284a0950ed74497fc3SHA256: c867b4e075a4548bf27422542f96b159f94c4e7ffaaf6427b10433afd6a3a38cReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor jar package name repository Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor pom groupid org.apache.maven Highest Vendor file name maven-repository-metadata High Vendor pom name Maven Repository Metadata Model High Vendor pom artifactid maven-repository-metadata Low Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor pom parent-groupid org.apache.maven Medium Product jar package name apache Highest Product Manifest specification-title Maven Repository Metadata Model Medium Product pom artifactid maven-repository-metadata Highest Product file name maven-repository-metadata High Product pom name Maven Repository Metadata Model High Product jar package name repository Highest Product jar package name maven Highest Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product pom parent-artifactid maven Medium Product Manifest Implementation-Title Maven Repository Metadata Model High Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
Maven Settings model. File Path: /home/runner/.m2/repository/org/apache/maven/maven-settings/3.0.5/maven-settings-3.0.5.jarMD5: a608e0ce2bffaf9f89418e657746c894SHA1: 8e98d918ba2b41175d72307853f792e3bded4fc7SHA256: d8f9f237afc21d8202eedffa29cbf6e9d46c78b3c22b217d16267216988221b9Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor jar package name settings Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor file name maven-settings High Vendor pom groupid apache.maven Highest Vendor pom groupid org.apache.maven Highest Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor pom artifactid maven-settings Low Vendor pom parent-groupid org.apache.maven Medium Vendor pom name Maven Settings High Product jar package name apache Highest Product Manifest specification-title Maven Settings Medium Product jar package name settings Highest Product Manifest Implementation-Title Maven Settings High Product jar package name maven Highest Product file name maven-settings High Product pom groupid apache.maven Highest Product pom artifactid maven-settings Highest Product pom parent-groupid org.apache.maven Medium Product pom name Maven Settings High Product pom parent-artifactid maven Medium Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
The effective settings builder, with inheritance and password decryption. File Path: /home/runner/.m2/repository/org/apache/maven/maven-settings-builder/3.0.5/maven-settings-builder-3.0.5.jarMD5: 9446d7885d57cd95170f1c2cccd89564SHA1: 7b87eb83abd6efa77e51882bbebc1b316739c681SHA256: ac0e62e26b7f690e265ba75667531973b8a2da12b3b0ff102a612f05b42b6fafReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name apache Highest Vendor pom parent-artifactid maven Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor jar package name settings Highest Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom groupid apache.maven Highest Vendor pom name Maven Settings Builder High Vendor pom groupid org.apache.maven Highest Vendor file name maven-settings-builder High Vendor Manifest Implementation-Vendor-Id org.apache.maven Medium Vendor pom artifactid maven-settings-builder Low Vendor pom parent-groupid org.apache.maven Medium Product Manifest specification-title Maven Settings Builder Medium Product jar package name apache Highest Product file name maven-settings-builder High Product Manifest Implementation-Title Maven Settings Builder High Product jar package name settings Highest Product jar package name maven Highest Product pom groupid apache.maven Highest Product pom parent-groupid org.apache.maven Medium Product pom artifactid maven-settings-builder Highest Product pom parent-artifactid maven Medium Product pom name Maven Settings Builder High Version pom version 3.0.5 Highest Version Manifest Implementation-Version 3.0.5 High Version file version 3.0.5 High
Description:
Shared utils without any further dependencies File Path: /home/runner/.m2/repository/org/apache/maven/shared/maven-shared-utils/3.0.1/maven-shared-utils-3.0.1.jarMD5: 98b5ed54f633e6c59f0f9f26ff12f00bSHA1: 67e99046630df6c4f4b2c8f2143481240198105eSHA256: fe7c84582900b5243d1c107353157c187697dab809ef4c40672fd9407916c4aeReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name utils Highest Vendor jar package name apache Highest Vendor pom parent-artifactid maven-shared-components Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom parent-groupid org.apache.maven.shared Medium Vendor file name maven-shared-utils High Vendor jar package name maven Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor pom name Apache Maven Shared Utils High Vendor pom artifactid maven-shared-utils Low Vendor Manifest Implementation-Vendor-Id org.apache.maven.shared Medium Vendor pom groupid org.apache.maven.shared Highest Vendor pom groupid apache.maven.shared Highest Vendor jar package name shared Highest Vendor Manifest implementation-url https://maven.apache.org/shared/maven-shared-utils/ Low Product jar package name utils Highest Product jar package name apache Highest Product pom parent-groupid org.apache.maven.shared Medium Product file name maven-shared-utils High Product jar package name maven Highest Product pom name Apache Maven Shared Utils High Product pom artifactid maven-shared-utils Highest Product Manifest Implementation-Title Apache Maven Shared Utils High Product pom groupid apache.maven.shared Highest Product jar package name shared Highest Product Manifest implementation-url https://maven.apache.org/shared/maven-shared-utils/ Low Product Manifest specification-title Apache Maven Shared Utils Medium Product pom parent-artifactid maven-shared-components Medium Version pom version 3.0.1 Highest Version file version 3.0.1 High Version Manifest Implementation-Version 3.0.1 High Version pom parent-version 3.0.1 Low
Description:
The core classes of Apache Jackrabbit FileVault License:
"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt" File Path: /home/runner/.m2/repository/org/apache/jackrabbit/vault/org.apache.jackrabbit.vault/3.5.6/org.apache.jackrabbit.vault-3.5.6.jar
MD5: 7311cb5a35268eb640213d16658cefa1
SHA1: 936eb3333d7389aa59b635669ad8867643c9eda2
SHA256: 961bb956259edfc3cb08766d88e1508573613b6f085e5b98cb7710caf49df761
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name jackrabbit Highest Vendor jar package name apache Highest Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor Manifest bundle-symbolicname org.apache.jackrabbit.vault Medium Vendor pom parent-groupid org.apache.jackrabbit.vault Medium Vendor pom groupid org.apache.jackrabbit.vault Highest Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest require-capability osgi.service;filter:="(objectClass=org.apache.jackrabbit.vault.packaging.events.PackageEventListener)";effective:=active;resolution:=optional;cardinality:=multiple,osgi.service;filter:="(objectClass=org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcher)";effective:=active,osgi.service;filter:="(objectClass=org.apache.jackrabbit.vault.packaging.registry.PackageRegistry)";effective:=active;resolution:=optional;cardinality:=multiple,osgi.service;filter:="(objectClass=org.apache.sling.jcr.api.SlingRepository)";effective:=active;resolution:=optional,osgi.extender;filter:="(&(osgi.extender=osgi.component)(version>=1.4.0)(!(version>=2.0.0)))",osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Vendor pom groupid apache.jackrabbit.vault Highest Vendor pom parent-artifactid parent Low Vendor Manifest bundle-docurl https://jackrabbit.apache.org/filevault/ Low Vendor Manifest service-component OSGI-INF/org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcherImpl.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.impl.ActivityLog.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.impl.PackageManagerMBeanImpl.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.impl.PackagingImpl.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.registry.impl.FSPackageRegistry.xml Low Vendor Manifest build-jdk-spec 11 Low Vendor pom name Apache Jackrabbit FileVault Core Bundle High Vendor Manifest provide-capability osgi.service;objectClass:List="javax.management.DynamicMBean";uses:="javax.management",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.Packaging";uses:="org.apache.jackrabbit.vault.packaging",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.events.PackageEventListener";uses:="org.apache.jackrabbit.vault.packaging.events",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcher";uses:="org.apache.jackrabbit.vault.packaging.events.impl",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.registry.PackageRegistry";uses:="org.apache.jackrabbit.vault.packaging.registry" Low Vendor Manifest bundle-category jackrabbit Low Vendor file name org.apache.jackrabbit.vault High Vendor jar package name vault Highest Vendor pom artifactid apache.jackrabbit.vault Low Product jar package name apache Highest Product pom parent-artifactid parent Medium Product pom artifactid apache.jackrabbit.vault Highest Product pom groupid apache.jackrabbit.vault Highest Product jar package name xml Highest Product Manifest bundle-docurl https://jackrabbit.apache.org/filevault/ Low Product Manifest service-component OSGI-INF/org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcherImpl.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.impl.ActivityLog.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.impl.PackageManagerMBeanImpl.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.impl.PackagingImpl.xml,OSGI-INF/org.apache.jackrabbit.vault.packaging.registry.impl.FSPackageRegistry.xml Low Product pom artifactid org.apache.jackrabbit.vault Highest Product pom name Apache Jackrabbit FileVault Core Bundle High Product Manifest provide-capability osgi.service;objectClass:List="javax.management.DynamicMBean";uses:="javax.management",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.Packaging";uses:="org.apache.jackrabbit.vault.packaging",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.events.PackageEventListener";uses:="org.apache.jackrabbit.vault.packaging.events",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcher";uses:="org.apache.jackrabbit.vault.packaging.events.impl",osgi.service;objectClass:List="org.apache.jackrabbit.vault.packaging.registry.PackageRegistry";uses:="org.apache.jackrabbit.vault.packaging.registry" Low Product file name org.apache.jackrabbit.vault High Product jar package name vault Highest Product Manifest Bundle-Name Apache Jackrabbit FileVault Core Bundle Medium Product jar package name jackrabbit Highest Product Manifest specification-title Apache Jackrabbit FileVault Core Bundle Medium Product Manifest bundle-symbolicname org.apache.jackrabbit.vault Medium Product pom parent-groupid org.apache.jackrabbit.vault Medium Product jar package name osgi Highest Product Manifest require-capability osgi.service;filter:="(objectClass=org.apache.jackrabbit.vault.packaging.events.PackageEventListener)";effective:=active;resolution:=optional;cardinality:=multiple,osgi.service;filter:="(objectClass=org.apache.jackrabbit.vault.packaging.events.impl.PackageEventDispatcher)";effective:=active,osgi.service;filter:="(objectClass=org.apache.jackrabbit.vault.packaging.registry.PackageRegistry)";effective:=active;resolution:=optional;cardinality:=multiple,osgi.service;filter:="(objectClass=org.apache.sling.jcr.api.SlingRepository)";effective:=active;resolution:=optional,osgi.extender;filter:="(&(osgi.extender=osgi.component)(version>=1.4.0)(!(version>=2.0.0)))",osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))" Low Product jar package name packaging Highest Product Manifest Implementation-Title Apache Jackrabbit FileVault Core Bundle High Product Manifest build-jdk-spec 11 Low Product Manifest bundle-category jackrabbit Low Product jar package name api Highest Version Manifest Implementation-Version 3.5.6 High Version file version 3.5.6 High Version pom version 3.5.6 Highest Version Manifest Bundle-Version 3.5.6 High
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-archiver/3.4/plexus-archiver-3.4.jarMD5: 1d9a183c24155d3ba19f2ef07ceea177SHA1: d99cffd480e050d87d93defa605a959a15cbb611SHA256: 3c6611c98547dbf3f5125848c273ba719bc10df44e3f492fa2e302d6135a6ea5Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name codehaus Low Vendor jar package name plexus Low Vendor jar package name archiver Highest Vendor file name plexus-archiver High Vendor pom parent-groupid org.codehaus.plexus Medium Vendor pom name Plexus Archiver Component High Vendor pom groupid org.codehaus.plexus Highest Vendor pom groupid codehaus.plexus Highest Vendor jar package name plexus Highest Vendor jar package name codehaus Highest Vendor jar package name archiver Low Vendor pom artifactid plexus-archiver Low Vendor pom parent-artifactid plexus Low Product jar package name plexus Low Product pom groupid codehaus.plexus Highest Product jar package name plexus Highest Product jar package name codehaus Highest Product jar package name archiver Highest Product file name plexus-archiver High Product jar package name archiver Low Product pom parent-artifactid plexus Medium Product pom parent-groupid org.codehaus.plexus Medium Product pom artifactid plexus-archiver Highest Product pom name Plexus Archiver Component High Version pom parent-version 3.4 Low Version pom version 3.4 Highest Version file version 3.4 High
Published Vulnerabilities CVE-2018-1002200 suppress
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N CVSSv3:
Base Score: MEDIUM (5.5) Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N References:
Vulnerable Software & Versions:
File Path: /home/runner/.m2/repository/org/sonatype/plexus/plexus-cipher/1.4/plexus-cipher-1.4.jarMD5: 7b2d6fcf0d5800d5b1ce09d98d98dcafSHA1: 50ade46f23bb38cd984b4ec560c46223432aac38SHA256: 5a15fdba22669e0fdd06e10dcce6320879e1f7398fbc910cd0677b50672a78c4Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name plexus Low Vendor pom parent-artifactid spice-parent Low Vendor jar package name sonatype Highest Vendor jar package name cipher Highest Vendor jar package name components Low Vendor jar package name sonatype Low Vendor pom parent-groupid org.sonatype.spice Medium Vendor pom groupid org.sonatype.plexus Highest Vendor pom artifactid plexus-cipher Low Vendor pom url http://spice.sonatype.org/${project.artifactId} Highest Vendor jar package name plexus Highest Vendor file name plexus-cipher High Vendor pom groupid sonatype.plexus Highest Vendor pom name Plexus Cipher: encryption/decryption Component High Product jar package name plexus Low Product pom parent-artifactid spice-parent Medium Product jar package name sonatype Highest Product pom url http://spice.sonatype.org/${project.artifactId} Medium Product jar package name cipher Highest Product jar package name components Low Product pom parent-groupid org.sonatype.spice Medium Product jar package name plexus Highest Product jar package name cipher Low Product file name plexus-cipher High Product pom groupid sonatype.plexus Highest Product pom name Plexus Cipher: encryption/decryption Component High Product pom artifactid plexus-cipher Highest Version file version 1.4 High Version pom version 1.4 Highest Version pom parent-version 1.4 Low
Description:
A class loader framework File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-classworlds/2.4/plexus-classworlds-2.4.jarMD5: 4b6ec19d96af7d901c1aad7d2415d498SHA1: ef38ff5c25f83a4a02fcd9843d85f3e47012873eSHA256: 259d528a29722cab6349d7e7d432e3fd4877c087ffcb04985a6612e97023bba8Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor file name plexus-classworlds High Vendor jar package name codehaus Low Vendor jar package name plexus Low Vendor pom artifactid plexus-classworlds Low Vendor pom parent-groupid org.codehaus.plexus Medium Vendor pom groupid org.codehaus.plexus Highest Vendor pom name Plexus Classworlds High Vendor jar package name classworlds Highest Vendor pom groupid codehaus.plexus Highest Vendor jar package name plexus Highest Vendor jar package name codehaus Highest Vendor jar package name classworlds Low Vendor pom parent-artifactid plexus Low Product file name plexus-classworlds High Product jar package name plexus Low Product pom artifactid plexus-classworlds Highest Product pom name Plexus Classworlds High Product jar package name classworlds Highest Product pom groupid codehaus.plexus Highest Product jar package name plexus Highest Product jar package name codehaus Highest Product pom parent-artifactid plexus Medium Product pom parent-groupid org.codehaus.plexus Medium Product jar package name classworlds Low Version pom parent-version 2.4 Low Version file version 2.4 High Version pom version 2.4 Highest
Description:
Plexus Component "Java 5" Annotations, to describe plexus components properties in java sources with
standard annotations instead of javadoc annotations.
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-component-annotations/1.5.5/plexus-component-annotations-1.5.5.jarMD5: ef37dcdb84030422db428b63c4354e5bSHA1: c72f2660d0cbed24246ddb55d7fdc4f7374d2078SHA256: 4df7a6a7be64b35bbccf60b5c115697f9ea3421d22674ae67135dde375fcca1fReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name codehaus Low Vendor jar package name plexus Low Vendor file name plexus-component-annotations High Vendor pom parent-groupid org.codehaus.plexus Medium Vendor jar package name annotations Highest Vendor pom name Plexus :: Component Annotations High Vendor pom groupid org.codehaus.plexus Highest Vendor pom groupid codehaus.plexus Highest Vendor jar package name plexus Highest Vendor jar package name codehaus Highest Vendor jar package name component Highest Vendor pom artifactid plexus-component-annotations Low Vendor pom parent-artifactid plexus-containers Low Vendor jar package name component Low Product jar package name plexus Low Product pom parent-artifactid plexus-containers Medium Product file name plexus-component-annotations High Product pom parent-groupid org.codehaus.plexus Medium Product jar package name annotations Highest Product pom name Plexus :: Component Annotations High Product jar package name annotations Low Product pom artifactid plexus-component-annotations Highest Product pom groupid codehaus.plexus Highest Product jar package name plexus Highest Product jar package name codehaus Highest Product jar package name component Highest Product jar package name component Low Version file version 1.5.5 High Version pom version 1.5.5 Highest
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-interpolation/1.14/plexus-interpolation-1.14.jarMD5: f92db8b194fc417d72cc74c428afacf8SHA1: c88dd864fe8b8256c25558ce7cd63be66ba07693SHA256: 7fc63378d3e84663619b9bedace9f9fe78b276c2be3c62ca2245449294c84176Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name codehaus Low Vendor jar package name plexus Low Vendor jar package name interpolation Highest Vendor pom name Plexus Interpolation API High Vendor pom parent-groupid org.codehaus.plexus Medium Vendor jar package name interpolation Low Vendor pom groupid org.codehaus.plexus Highest Vendor pom groupid codehaus.plexus Highest Vendor jar package name plexus Highest Vendor jar package name codehaus Highest Vendor file name plexus-interpolation High Vendor pom artifactid plexus-interpolation Low Vendor pom parent-artifactid plexus-components Low Product jar package name plexus Low Product pom groupid codehaus.plexus Highest Product jar package name plexus Highest Product jar package name codehaus Highest Product file name plexus-interpolation High Product pom parent-artifactid plexus-components Medium Product jar package name interpolation Highest Product pom name Plexus Interpolation API High Product pom parent-groupid org.codehaus.plexus Medium Product pom artifactid plexus-interpolation Highest Product jar package name interpolation Low Version file version 1.14 High Version pom parent-version 1.14 Low Version pom version 1.14 Highest
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-io/2.7.1/plexus-io-2.7.1.jarMD5: 34115f3dad3322f24be2682c45302540SHA1: e1cce34eca8f2c5fc053e1a15d1405984b527b32SHA256: 20aa9dd74536ad9ce65d1253b5c4386747483a7a65c48008c9affb51854539cfReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name codehaus Low Vendor jar package name plexus Low Vendor jar package name io Highest Vendor pom parent-groupid org.codehaus.plexus Medium Vendor jar package name components Low Vendor jar package name components Highest Vendor pom name Plexus IO Components High Vendor pom groupid org.codehaus.plexus Highest Vendor pom groupid codehaus.plexus Highest Vendor jar package name plexus Highest Vendor jar package name codehaus Highest Vendor pom artifactid plexus-io Low Vendor file name plexus-io High Vendor pom parent-artifactid plexus Low Product jar package name plexus Low Product pom artifactid plexus-io Highest Product jar package name io Highest Product pom parent-artifactid plexus Medium Product pom parent-groupid org.codehaus.plexus Medium Product jar package name components Low Product jar package name components Highest Product jar package name io Low Product pom name Plexus IO Components High Product pom groupid codehaus.plexus Highest Product jar package name plexus Highest Product jar package name codehaus Highest Product file name plexus-io High Version pom version 2.7.1 Highest Version file version 2.7.1 High Version pom parent-version 2.7.1 Low
File Path: /home/runner/.m2/repository/org/sonatype/plexus/plexus-sec-dispatcher/1.3/plexus-sec-dispatcher-1.3.jarMD5: 53160199f5667de3fca69b723173639bSHA1: dedc02034fb8fcd7615d66593228cb71709134b4SHA256: 3b0559bb8432f28937efe6ca193ef54a8506d0075d73fd7406b9b116c6a11063Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name plexus Low Vendor pom parent-artifactid spice-parent Low Vendor jar package name sec Highest Vendor jar package name sonatype Highest Vendor jar package name components Low Vendor jar package name sonatype Low Vendor file name plexus-sec-dispatcher High Vendor pom parent-groupid org.sonatype.spice Medium Vendor pom groupid org.sonatype.plexus Highest Vendor pom url http://spice.sonatype.org/${project.artifactId} Highest Vendor jar package name plexus Highest Vendor pom name Plexus Security Dispatcher Component High Vendor pom artifactid plexus-sec-dispatcher Low Vendor pom groupid sonatype.plexus Highest Product jar package name plexus Low Product jar package name sec Highest Product pom parent-artifactid spice-parent Medium Product jar package name sonatype Highest Product pom url http://spice.sonatype.org/${project.artifactId} Medium Product jar package name components Low Product file name plexus-sec-dispatcher High Product pom parent-groupid org.sonatype.spice Medium Product jar package name plexus Highest Product pom name Plexus Security Dispatcher Component High Product pom artifactid plexus-sec-dispatcher Highest Product jar package name sec Low Product pom groupid sonatype.plexus Highest Version file version 1.3 High Version pom parent-version 1.3 Low Version pom version 1.3 Highest
Description:
A collection of various utility classes to ease working with strings, files, command lines, XML and more. File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-utils/2.0.6/plexus-utils-2.0.6.jarMD5: 64523c08c852c1ffb7650f207baca314SHA1: 3a20c424a712a7c02b02af61dcad5f001b29a9fdSHA256: 8b909f4ca9788647942f883d4e559bcc642123f7c6bcd3846983a2e465469c33Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name codehaus Low Vendor jar package name plexus Low Vendor pom url http://plexus.codehaus.org/plexus-utils Highest Vendor pom parent-groupid org.codehaus.plexus Medium Vendor pom artifactid plexus-utils Low Vendor jar package name xml Highest Vendor pom groupid org.codehaus.plexus Highest Vendor jar package name util Low Vendor pom groupid codehaus.plexus Highest Vendor jar package name plexus Highest Vendor jar package name codehaus Highest Vendor pom name Plexus Common Utilities High Vendor pom parent-artifactid plexus Low Vendor file name plexus-utils High Product jar package name plexus Low Product pom parent-artifactid plexus Medium Product pom parent-groupid org.codehaus.plexus Medium Product jar package name xml Highest Product jar package name util Low Product pom groupid codehaus.plexus Highest Product jar package name plexus Highest Product pom url http://plexus.codehaus.org/plexus-utils Medium Product jar package name codehaus Highest Product pom name Plexus Common Utilities High Product pom artifactid plexus-utils Highest Product file name plexus-utils High Version pom version 2.0.6 Highest Version pom parent-version 2.0.6 Low Version file version 2.0.6 High
Published Vulnerabilities CVE-2017-1000487 suppress
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv2:
Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References:
Vulnerable Software & Versions:
Directory traversal in org.codehaus.plexus.util.Expand (OSSINDEX)suppress
> org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- [github.com](https://github.com/codehaus-plexus/plexus-utils/issues/4) Unscored:
References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.codehaus.plexus:plexus-utils:2.0.6:*:*:*:*:*:*:* Possible XML Injection (OSSINDEX)suppress
> `org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int)` does not check if the comment includes a `"-->"` sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- [github.com](https://github.com/codehaus-plexus/plexus-utils/issues/3) Unscored:
References:
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:org.codehaus.plexus:plexus-utils:2.0.6:*:*:*:*:*:*:* Description:
Patched build of Guava: Google Core Libraries for Java 1.5+ License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/sonatype/sisu/sisu-guava/0.9.9/sisu-guava-0.9.9.jar
MD5: 36484b30beda10de99c56801db4657e0
SHA1: 91395a7816ad64c5ef68e1a1b5b861463f0eb3e2
SHA256: 9897e80ff6c08fc45b5b5ebd81d9e943a1087bdf0ad50cda457d616abbdaacd9
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest bundle-copyright Copyright (C) 2009 Google Inc. Low Vendor pom groupid sonatype.sisu Highest Vendor pom parent-groupid org.sonatype.sisu.inject Medium Vendor pom name Sisu Guava - Core Library High Vendor pom artifactid sisu-guava Low Vendor file name sisu-guava High Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Vendor Manifest bundle-docurl http://code.google.com/p/guava-libraries/ Low Vendor Manifest bundle-symbolicname org.sonatype.sisu.guava;singleton:=true Medium Vendor pom groupid org.sonatype.sisu Highest Vendor pom parent-artifactid guava-parent Low Product Manifest Bundle-Name sisu-guava Medium Product Manifest bundle-copyright Copyright (C) 2009 Google Inc. Low Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Product pom artifactid sisu-guava Highest Product pom parent-artifactid guava-parent Medium Product pom groupid sonatype.sisu Highest Product pom parent-groupid org.sonatype.sisu.inject Medium Product pom name Sisu Guava - Core Library High Product jar package name google Highest Product file name sisu-guava High Product Manifest bundle-docurl http://code.google.com/p/guava-libraries/ Low Product Manifest bundle-symbolicname org.sonatype.sisu.guava;singleton:=true Medium Version Manifest Bundle-Version 0.9.9 High Version pom version 0.9.9 Highest Version file version 0.9.9 High
Published Vulnerabilities CVE-2020-8908 suppress
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv2:
Base Score: LOW (2.1) Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N CVSSv3:
Base Score: LOW (3.3) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N References:
Vulnerable Software & Versions: (show all )
Description:
Patched build of Guice: a lightweight dependency injection framework for Java 5 and above License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/sonatype/sisu/sisu-guice/3.1.0/sisu-guice-3.1.0-no_aop.jar
MD5: 19f877ae736fa153a545d0cf801dcec9
SHA1: 97c87d15d749c86b2be1b9809b28321a1d926c7f
SHA256: 4b76079f35407e5682aac1ecbe67afd5f430ae619044a9d6a413666a45750c25
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest bundle-symbolicname org.sonatype.sisu.guice;singleton:=true Medium Vendor Manifest bundle-docurl http://code.google.com/p/google-guice/ Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Vendor jar package name singleton Highest Vendor Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low Vendor pom groupid org.sonatype.sisu Highest Vendor file name sisu-guice High Vendor jar package name inject Low Vendor jar package name google Low Vendor jar package name internal Low Vendor jar package name guice Highest Vendor Manifest eclipse-extensibleapi true Low Product Manifest bundle-symbolicname org.sonatype.sisu.guice;singleton:=true Medium Product pom artifactid sisu-guice Highest Product Manifest bundle-docurl http://code.google.com/p/google-guice/ Low Product Manifest Bundle-Name sisu-guice (no_aop) Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Product jar package name singleton Highest Product Manifest bundle-copyright Copyright (C) 2006 Google Inc. Low Product file name sisu-guice High Product jar package name google Highest Product jar package name inject Low Product jar package name dependency Highest Product jar package name internal Low Product jar package name guice Highest Product Manifest eclipse-extensibleapi true Low Version file version 3.1.0 High Version pom version 3.1.0 Highest
License:
http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.eclipse.org/legal/epl-v10.html File Path: /home/runner/.m2/repository/org/sonatype/sisu/sisu-inject-bean/2.3.0/sisu-inject-bean-2.3.0.jar
MD5: 27a128e32326472ebfec3a7b8cb2cdf9
SHA1: 4767ee22f0b84fc0fe3af2095c30bfbdafba9459
SHA256: 75819b29737c2bee1bfbda1011d455c7036738e0ef32ffbf85ba1d8fa157ceb2
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest bundle-activationpolicy lazy Low Vendor jar package name bean Highest Vendor pom name Sisu-Inject-Bean : Aggregate OSGi bundle High Vendor jar package name sonatype Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Vendor jar package name singleton Highest Vendor pom groupid org.sonatype.sisu Highest Vendor pom artifactid sisu-inject-bean Low Vendor file name sisu-inject-bean High Vendor pom parent-artifactid guice-bean Low Vendor Manifest bundle-symbolicname org.sonatype.inject;singleton:=true Medium Vendor pom groupid sonatype.sisu Highest Vendor pom parent-groupid org.sonatype.sisu.inject Medium Vendor Manifest bundle-copyright Copyright (C) 2010 Sonatype Inc. Low Vendor Manifest bundle-docurl https://github.com/sonatype/sisu/ Low Vendor jar package name inject Highest Vendor jar package name guice Highest Vendor jar package name sisu Highest Product pom artifactid sisu-inject-bean Highest Product Manifest bundle-activationpolicy lazy Low Product jar package name bean Highest Product pom name Sisu-Inject-Bean : Aggregate OSGi bundle High Product jar package name sonatype Highest Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Product jar package name singleton Highest Product Manifest Bundle-Name sisu-inject-bean Medium Product file name sisu-inject-bean High Product pom parent-artifactid guice-bean Medium Product Manifest bundle-symbolicname org.sonatype.inject;singleton:=true Medium Product pom groupid sonatype.sisu Highest Product pom parent-groupid org.sonatype.sisu.inject Medium Product Manifest bundle-copyright Copyright (C) 2010 Sonatype Inc. Low Product Manifest bundle-docurl https://github.com/sonatype/sisu/ Low Product jar package name inject Highest Product jar package name guice Highest Product jar package name sisu Highest Version file version 2.3.0 High Version Manifest Bundle-Version 2.3.0 High Version pom version 2.3.0 Highest
License:
http://www.eclipse.org/legal/epl-v10.html File Path: /home/runner/.m2/repository/org/sonatype/sisu/sisu-inject-plexus/2.3.0/sisu-inject-plexus-2.3.0.jar
MD5: 5c35e512b479cc0d1c830c0cc9452504
SHA1: 7d8ecdce497bf361b83cfbc890670ca50d6ec299
SHA256: bf9083fb846993689409b2bdbc735048e53bac6cc32707cde7ef84817b6e9365
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name sonatype Highest Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Vendor file name sisu-inject-plexus High Vendor pom groupid org.sonatype.sisu Highest Vendor jar package name plexus Highest Vendor pom groupid sonatype.sisu Highest Vendor pom parent-groupid org.sonatype.sisu.inject Medium Vendor pom artifactid sisu-inject-plexus Low Vendor Manifest bundle-symbolicname org.sonatype.inject.plexus;singleton:=true Medium Vendor Manifest bundle-copyright Copyright (C) 2010 Sonatype Inc. Low Vendor Manifest bundle-docurl https://github.com/sonatype/sisu/ Low Vendor pom parent-artifactid guice-plexus Low Vendor pom name Sisu-Inject-Plexus : Aggregate OSGi bundle High Vendor jar package name guice Highest Product pom parent-artifactid guice-plexus Medium Product jar package name sonatype Highest Product Manifest bundle-requiredexecutionenvironment J2SE-1.5,JavaSE-1.6 Low Product pom artifactid sisu-inject-plexus Highest Product file name sisu-inject-plexus High Product jar package name plexus Highest Product pom groupid sonatype.sisu Highest Product pom parent-groupid org.sonatype.sisu.inject Medium Product Manifest bundle-symbolicname org.sonatype.inject.plexus;singleton:=true Medium Product Manifest bundle-copyright Copyright (C) 2010 Sonatype Inc. Low Product Manifest bundle-docurl https://github.com/sonatype/sisu/ Low Product Manifest Bundle-Name sisu-inject-plexus Medium Product pom name Sisu-Inject-Plexus : Aggregate OSGi bundle High Product jar package name guice Highest Version file version 2.3.0 High Version Manifest Bundle-Version 2.3.0 High Version pom version 2.3.0 Highest
Description:
The slf4j API File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jarMD5: caafe376afb7086dcbee79f780394ca3SHA1: da76ca59f6a57ee3102f8f9bd9cee742973efa8aSHA256: 18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom groupid org.slf4j Highest Vendor Manifest bundle-symbolicname slf4j.api Medium Vendor pom parent-groupid org.slf4j Medium Vendor file name slf4j-api High Vendor jar package name slf4j Highest Vendor pom groupid slf4j Highest Vendor pom artifactid slf4j-api Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor pom name SLF4J API Module High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product pom url http://www.slf4j.org Medium Product Manifest bundle-symbolicname slf4j.api Medium Product pom parent-groupid org.slf4j Medium Product file name slf4j-api High Product jar package name slf4j Highest Product pom name SLF4J API Module High Product pom parent-artifactid slf4j-parent Medium Product Manifest Implementation-Title slf4j-api High Product pom artifactid slf4j-api Highest Product Manifest Bundle-Name slf4j-api Medium Product pom groupid slf4j Highest Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Version file version 1.7.25 High Version Manifest Implementation-Version 1.7.25 High Version pom version 1.7.25 Highest Version Manifest Bundle-Version 1.7.25 High
Description:
Port of Snappy to Java License:
Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html File Path: /home/runner/.m2/repository/org/iq80/snappy/snappy/0.4/snappy-0.4.jar
MD5: f0792d1dbe7f90d8b34c7c19961e0073
SHA1: a42b2d92a89efd35bb14738000dabcac6bd07a8d
SHA256: 46a0c87d504ce9d6063e1ff6e4d20738feb49d8abf85b5071a7d18df4f11bac9
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor file name snappy High Vendor pom artifactid snappy Low Vendor jar package name snappy Highest Vendor pom name snappy High Vendor pom groupid org.iq80.snappy Highest Vendor pom url http://github.com/dain/snappy Highest Vendor pom groupid iq80.snappy Highest Vendor jar package name iq80 Low Vendor jar package name iq80 Highest Vendor jar package name snappy Low Product file name snappy High Product jar package name snappy Highest Product pom name snappy High Product pom groupid iq80.snappy Highest Product jar package name iq80 Highest Product pom url http://github.com/dain/snappy Medium Product pom artifactid snappy Highest Product jar package name snappy Low Version pom version 0.4 Highest Version file version 0.4 High
Description:
tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API.
License:
The BSD License: http://www.opensource.org/licenses/bsd-license.php File Path: /home/runner/.m2/repository/org/codehaus/woodstox/stax2-api/4.2/stax2-api-4.2.jar
MD5: 5d22fe6dbb276d1fd6dab40c386a4f0a
SHA1: 13c2b30926bca0429c704c4b4ca0b5d0432b69cd
SHA256: badf6081a0bb526fd2c01951dfefad91b6846b6dd0eb0048587e30d1dd334e68
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest specification-vendor fasterxml.com Low Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor jar package name typed Highest Vendor Manifest bundle-symbolicname stax2-api Medium Vendor Manifest bundle-docurl http://github.com/FasterXML/stax2-api Low Vendor Manifest Implementation-Vendor fasterxml.com High Vendor pom organization url http://fasterxml.com Medium Vendor pom name Stax2 API High Vendor pom url http://github.com/FasterXML/stax2-api Highest Vendor jar package name stax2 Highest Vendor Manifest implementation-build-date 2019-03-13 04:03:16+0000 Low Vendor pom parent-groupid com.fasterxml Medium Vendor pom groupid org.codehaus.woodstox Highest Vendor pom organization name fasterxml.com High Vendor jar package name codehaus Highest Vendor pom artifactid stax2-api Low Vendor Manifest Implementation-Vendor-Id org.codehaus.woodstox Medium Vendor jar package name validation Highest Vendor pom parent-artifactid oss-parent Low Vendor file name stax2-api High Vendor Manifest automatic-module-name org.codehaus.stax2 Medium Vendor pom groupid codehaus.woodstox Highest Product pom organization url http://fasterxml.com Low Product pom artifactid stax2-api Highest Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product jar package name typed Highest Product Manifest bundle-symbolicname stax2-api Medium Product Manifest bundle-docurl http://github.com/FasterXML/stax2-api Low Product pom name Stax2 API High Product jar package name stax2 Highest Product Manifest specification-title Stax2 API Medium Product jar package name osgi Highest Product Manifest implementation-build-date 2019-03-13 04:03:16+0000 Low Product pom parent-groupid com.fasterxml Medium Product pom url http://github.com/FasterXML/stax2-api Medium Product pom parent-artifactid oss-parent Medium Product Manifest Bundle-Name Stax2 API Medium Product jar package name codehaus Highest Product pom organization name fasterxml.com Low Product jar package name validation Highest Product file name stax2-api High Product Manifest Implementation-Title Stax2 API High Product Manifest automatic-module-name org.codehaus.stax2 Medium Product pom groupid codehaus.woodstox Highest Version pom version 4.2 Highest Version file version 4.2 High Version Manifest Implementation-Version 4.2 High Version pom parent-version 4.2 Low
Description:
TXW is a library that allows you to write XML documents.
File Path: /home/runner/.m2/repository/org/glassfish/jaxb/txw2/2.3.2/txw2-2.3.2.jarMD5: 3f278f148c5d27dc608c25cb7d093b94SHA1: ce5be7da2e442c25ec14c766cb60cb802741727bSHA256: 4a6a9f483388d461b81aa9a28c685b8b74c0597993bf1884b04eddbca95f48feReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor jar package name txw2 Highest Vendor pom groupid org.glassfish.jaxb Highest Vendor Manifest git-revision ae93d95 Low Vendor pom parent-artifactid jaxb-txw-parent Low Vendor pom name TXW2 Runtime High Vendor file name txw2 High Vendor jar package name sun Highest Vendor jar package name xml Highest Vendor pom groupid glassfish.jaxb Highest Vendor Manifest Implementation-Vendor-Id com.oracle Medium Vendor pom artifactid txw2 Low Vendor pom parent-groupid com.sun.xml.bind.mvn Medium Vendor Manifest (hint) Implementation-Vendor sun High Vendor Manifest Implementation-Vendor Oracle High Vendor jar (hint) package name oracle Highest Vendor jar package name txw Highest Product pom artifactid txw2 Highest Product jar package name txw2 Highest Product Manifest specification-title Java Architecture for XML Binding Medium Product Manifest git-revision ae93d95 Low Product pom name TXW2 Runtime High Product file name txw2 High Product jar package name xml Highest Product jar package name sun Highest Product pom groupid glassfish.jaxb Highest Product pom parent-artifactid jaxb-txw-parent Medium Product pom parent-groupid com.sun.xml.bind.mvn Medium Product Manifest Implementation-Title TXW Runtime High Product jar package name txw Highest Version pom version 2.3.2 Highest Version Manifest Implementation-Version 2.3.2 High Version Manifest build-id 2.3.2 Medium Version file version 2.3.2 High Version Manifest major-version 2.3.2 Medium
Description:
Woodstox is a high-performance XML processor that
implements Stax (JSR-173), SAX2 and Stax2 APIs
License:
The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/com/fasterxml/woodstox/woodstox-core/6.1.1/woodstox-core-6.1.1.jar
MD5: 992e39013de489a1373f14b7e153f9da
SHA1: 989bb31963ed1758b95c7c4381a91592a9a8df61
SHA256: f250662a245570fdd49c6916c1c3cd3d6511a8e5cd0d7460e989844b1d66ed67
Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor Manifest specification-vendor FasterXML Low Vendor Manifest Implementation-Vendor FasterXML High Vendor pom name Woodstox High Vendor pom url FasterXML/woodstox Highest Vendor Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Vendor pom organization url http://fasterxml.com Medium Vendor Manifest bundle-docurl https://github.com/FasterXML/woodstox Low Vendor pom groupid com.fasterxml.woodstox Highest Vendor pom parent-groupid com.fasterxml Medium Vendor file name woodstox-core High Vendor Manifest bundle-symbolicname com.fasterxml.woodstox.woodstox-core Medium Vendor pom artifactid woodstox-core Low Vendor pom organization name FasterXML High Vendor jar package name stax Highest Vendor pom parent-artifactid oss-parent Low Vendor Manifest implementation-build-date 2020-02-28 02:50:45+0000 Low Vendor pom groupid fasterxml.woodstox Highest Vendor Manifest Implementation-Vendor-Id com.fasterxml.woodstox Medium Product pom organization url http://fasterxml.com Low Product pom name Woodstox High Product Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Low Product Manifest bundle-docurl https://github.com/FasterXML/woodstox Low Product jar package name osgi Highest Product pom parent-groupid com.fasterxml Medium Product pom url FasterXML/woodstox High Product pom parent-artifactid oss-parent Medium Product pom artifactid woodstox-core Highest Product file name woodstox-core High Product Manifest Bundle-Name Woodstox Medium Product pom organization name FasterXML Low Product Manifest bundle-symbolicname com.fasterxml.woodstox.woodstox-core Medium Product jar package name stax Highest Product Manifest specification-title Woodstox Medium Product Manifest implementation-build-date 2020-02-28 02:50:45+0000 Low Product Manifest Implementation-Title Woodstox High Product pom groupid fasterxml.woodstox Highest Version Manifest Implementation-Version 6.1.1 High Version Manifest Bundle-Version 6.1.1 High Version pom version 6.1.1 Highest Version pom parent-version 6.1.1 Low Version file version 6.1.1 High
Description:
Unknown version of isorelax library used in JAXB project File Path: /home/runner/.m2/repository/com/fasterxml/woodstox/woodstox-core/6.1.1/woodstox-core-6.1.1.jar/META-INF/maven/com.sun.xml.bind.jaxb/isorelax/pom.xmlMD5: 6fbb4bc95fbf2072bc6e3b790553fe81SHA1: 314ec72948d5c1fc71d553cbbd7a130caa6f9f13SHA256: cda6451d0231a973352b592ff950e39224ba6ba1a2f35eeab66511b5c225dff1Referenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom groupid sun.xml.bind.jaxb Highest Vendor pom artifactid isorelax Low Vendor pom name JAXB isorelax library High Vendor pom parent-groupid net.java Medium Vendor pom parent-artifactid jvnet-parent Low Product pom groupid sun.xml.bind.jaxb Highest Product pom name JAXB isorelax library High Product pom parent-groupid net.java Medium Product pom artifactid isorelax Highest Product pom parent-artifactid jvnet-parent Medium Version pom parent-version 20090621 Low Version pom version 20090621 Highest
Related Dependencies org.apache.jackrabbit.vault-3.5.6.jar (shaded: com.sun.xml.bind.jaxb:isorelax:20090621)File Path: /home/runner/.m2/repository/org/apache/jackrabbit/vault/org.apache.jackrabbit.vault/3.5.6/org.apache.jackrabbit.vault-3.5.6.jar/META-INF/maven/com.sun.xml.bind.jaxb/isorelax/pom.xml MD5: 6fbb4bc95fbf2072bc6e3b790553fe81 SHA1: 314ec72948d5c1fc71d553cbbd7a130caa6f9f13 SHA256: cda6451d0231a973352b592ff950e39224ba6ba1a2f35eeab66511b5c225dff1 pkg:maven/com.sun.xml.bind.jaxb/isorelax@20090621 Description:
XML Schema datatypes library File Path: /home/runner/.m2/repository/com/fasterxml/woodstox/woodstox-core/6.1.1/woodstox-core-6.1.1.jar/META-INF/maven/net.java.dev.msv/xsdlib/pom.xmlMD5: aaf872ed9d1aabee25e03c2a132ffd8eSHA1: 47f218a999411ed028f089d59ebef8f14e0fe914SHA256: d6e83c124436049d83238fc532a26c5d8ccd7e4ab10eba6d96043c850ac82f3cReferenced In Project/Scope: Content Package Maven Plugin:compile
Evidence Type Source Name Value Confidence Vendor pom parent-artifactid msv Low Vendor pom name MSV XML Schema Library High Vendor pom artifactid xsdlib Low Vendor pom groupid net.java.dev.msv Highest Product pom name MSV XML Schema Library High Product pom parent-artifactid msv Medium Product pom artifactid xsdlib Highest Product pom groupid net.java.dev.msv Highest Version pom version 2013.6.1 Highest
Related Dependencies org.apache.jackrabbit.vault-3.5.6.jar (shaded: net.java.dev.msv:xsdlib:2013.6.1)File Path: /home/runner/.m2/repository/org/apache/jackrabbit/vault/org.apache.jackrabbit.vault/3.5.6/org.apache.jackrabbit.vault-3.5.6.jar/META-INF/maven/net.java.dev.msv/xsdlib/pom.xml MD5: aaf872ed9d1aabee25e03c2a132ffd8e SHA1: 47f218a999411ed028f089d59ebef8f14e0fe914 SHA256: d6e83c124436049d83238fc532a26c5d8ccd7e4ab10eba6d96043c850ac82f3c pkg:maven/net.java.dev.msv/xsdlib@2013.6.1