Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: com.github.pmonks/clj-spdx 1.0.262-SNAPSHOT

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
clojure-1.12.1.jarcpe:2.3:a:clojure:clojure:1.12.1:*:*:*:*:*:*:*pkg:maven/org.clojure/clojure@1.12.1 0Highest22
commons-lang3-3.5.jarpkg:maven/org.apache.commons/commons-lang3@3.5MEDIUM1138
core.specs.alpha-0.4.74.jarcpe:2.3:a:alex_project:alex:0.4.74:*:*:*:*:*:*:*pkg:maven/org.clojure/core.specs.alpha@0.4.74 0Low17
gson-2.8.9.jarcpe:2.3:a:google:gson:2.8.9:*:*:*:*:*:*:*pkg:maven/com.google.code.gson/gson@2.8.9 0Highest28
instaparse-1.5.0.jarpkg:maven/instaparse/instaparse@1.5.0 017
java-spdx-library-2.0.0.jarpkg:maven/org.spdx/java-spdx-library@2.0.0 034
jsoup-1.15.3.jarcpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*pkg:maven/org.jsoup/jsoup@1.15.3 0Highest39
jsr305-3.0.2.jarpkg:maven/com.google.code.findbugs/jsr305@3.0.2 016
rencg-1.0.64.jarpkg:maven/com.github.pmonks/rencg@1.0.64 020
slf4j-api-2.0.17.jarpkg:maven/org.slf4j/slf4j-api@2.0.17 028
spdx-java-core-1.0.0.jarpkg:maven/org.spdx/spdx-java-core@1.0.0 034
spdx-java-model-2_X-1.0.0.jarcpe:2.3:a:x.org:x.org:1.0.0:*:*:*:*:*:*:*pkg:maven/org.spdx/spdx-java-model-2_X@1.0.0MEDIUM1Highest36
spdx-java-model-3_0-1.0.0.jarpkg:maven/org.spdx/spdx-java-model-3_0@1.0.0 034
spec.alpha-0.5.238.jarpkg:maven/org.clojure/spec.alpha@0.5.238 026
wreck-0.1.66.jarpkg:maven/com.github.pmonks/wreck@0.1.66 020

Dependencies (vulnerable)

clojure-1.12.1.jar

Description:

Clojure core environment and runtime library.

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/clojure/1.12.1/clojure-1.12.1.jar
MD5: 8c3e8e01592478d8296140682a3c8bc5
SHA1: 9280a39f8342673eac582e8909fd4f46026bfd50
SHA256:87eeea9e355d86c045738af494d683e09e914cb0467ae40d46a66b87a36c72d4

Identifiers

commons-lang3-3.5.jar

Description:

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.5/commons-lang3-3.5.jar
MD5: 780b5a8b72eebe6d0dbff1c11b5658fa
SHA1: 6c6c702c89bfff3cd9e80b04d668c5e190d588c6
SHA256:8ac96fc686512d777fca85e144f196cd7cfe0c0aec23127229497d1a38ff651c

Identifiers

CVE-2025-48924 (OSSINDEX)  

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a 
StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.
CWE-674 Uncontrolled Recursion

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.apache.commons:commons-lang3:3.5:*:*:*:*:*:*:*

core.specs.alpha-0.4.74.jar

Description:

Specs for clojure.core

License:

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/
File Path: /home/runner/.m2/repository/org/clojure/core.specs.alpha/0.4.74/core.specs.alpha-0.4.74.jar
MD5: ebd37b9a3c39e6b769fc1463737cb8d4
SHA1: d56a8d4c666ff8140e6d0a62d41263134be39254
SHA256:eb73ac08cf49ba840c88ba67beef11336ca554333d9408808d78946e0feb9ddb

Identifiers

gson-2.8.9.jar

Description:

Gson JSON library

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/gson/gson/2.8.9/gson-2.8.9.jar
MD5: e67627f67e03301092dc7de0a2d7cef8
SHA1: 8a432c1d6825781e21a02db2e2c33c5fde2833b9
SHA256:d3999291855de495c94c743761b8ab5176cfeabe281a5ab0d8e8d45326fd703e

Identifiers

instaparse-1.5.0.jar

Description:

Instaparse: No grammar left behind

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/instaparse/instaparse/1.5.0/instaparse-1.5.0.jar
MD5: b858977bcb62c8913768cfb0fb01a4c9
SHA1: edc617bd20362b2fc870df88f1687426a69fe007
SHA256:c2bcd6f3a74d1a114973e6ac71e3536f6b035f29f769e9d1ec528ffe5e56cc27

Identifiers

java-spdx-library-2.0.0.jar

Description:

Java library which implements the Java object model for SPDX and provides useful helper functions.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/spdx/java-spdx-library/2.0.0/java-spdx-library-2.0.0.jar
MD5: 7fd3cffb9bada9f7db62a5ad851eef45
SHA1: 4d099087814c4d9806689cdfca0de6a58cb22a88
SHA256:0186ddd72174fc6846a27f679392de6ed7fcc35598eb638cc7cf4d7eef604462

Identifiers

jsoup-1.15.3.jar

Description:

jsoup is a Java library for working with real-world HTML. It provides a very convenient API for fetching URLs and extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.

License:

The MIT License: https://jsoup.org/license
File Path: /home/runner/.m2/repository/org/jsoup/jsoup/1.15.3/jsoup-1.15.3.jar
MD5: 4f16c3b17b8c1b0173b1ed9f99f2c27c
SHA1: f6e1d8a8819f854b681c8eaa57fd59a42329e10c
SHA256:e20a5e78b1372f2a4e620832db4442d5077e5cbde280b24c666a3770844999bc

Identifiers

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7

Identifiers

rencg-1.0.64.jar

Description:

A micro-library for Clojure that provides first class support for named-capturing groups in regular expressions.

License:

Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/rencg/1.0.64/rencg-1.0.64.jar
MD5: 5fc6641890f0d3c73ae6d8fe32f30908
SHA1: 2420de94e551842b4d6e4749ce49dda9c0547b80
SHA256:32ca868b506b8516b4c295838943b5ea9f30939ca3e9923d3b9a30fd16d94729

Identifiers

slf4j-api-2.0.17.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.17/slf4j-api-2.0.17.jar
MD5: b6480d114a23683498ac3f746f959d2f
SHA1: d9e58ac9c7779ba3bf8142aff6c830617a7fe60f
SHA256:7b751d952061954d5abfed7181c1f645d336091b679891591d63329c622eb832

Identifiers

spdx-java-core-1.0.0.jar

Description:

Core libraries for SPDX

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/spdx/spdx-java-core/1.0.0/spdx-java-core-1.0.0.jar
MD5: ce02c67f029c12f2da5d19a592076213
SHA1: 7bf1850d8d0c205f483e7558a087f434e296cfd3
SHA256:b81c444457cb1e3d91833777330905a62be4e53a618e119fbd1236c67b00d417

Identifiers

spdx-java-model-2_X-1.0.0.jar

Description:

SPDX model versions 2.0, 2.1, and 2.3

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/spdx/spdx-java-model-2_X/1.0.0/spdx-java-model-2_X-1.0.0.jar
MD5: b3513ecc9b3e8c4ba639a03dcd915f69
SHA1: e9157d760e07087a5d155481ea2c0015294c6a88
SHA256:fdd300caeea585191173718506fd9cb4c6c98cf22f9166dcb6dbed140ad98823

Identifiers

CVE-2006-0197  

The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.
NVD-CWE-Other

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

    Vulnerable Software & Versions:

    spdx-java-model-3_0-1.0.0.jar

    Description:

    Generated java model source code

    License:

    The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
    File Path: /home/runner/.m2/repository/org/spdx/spdx-java-model-3_0/1.0.0/spdx-java-model-3_0-1.0.0.jar
    MD5: a65850df6808a6515b8aa2c7845bd12a
    SHA1: 335274ce9df77bd3d5afb46c351f4f72bd8cd1a8
    SHA256:ba0ec6c275e9b1437ce1240802536a44067ce0464b3b87646afafb42e514c2c4

    Identifiers

    spec.alpha-0.5.238.jar

    Description:

    Specification of data and functions

    License:

    Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/
    File Path: /home/runner/.m2/repository/org/clojure/spec.alpha/0.5.238/spec.alpha-0.5.238.jar
    MD5: 9f5ea5239dc04d6a8115add1e4f5f23a
    SHA1: 4eb5dea521c4e6e1f68c2c47517f14a922003e60
    SHA256:94cd99b6ea639641f37af4860a643b6ed399ee5a8be5d717cff0b663c8d75077

    Identifiers

    wreck-0.1.66.jar

    Description:

    A micro-library for Clojure(Script) that provides regular expression construction functions.

    License:

    MPL-2.0: https://www.mozilla.org/en-US/MPL/2.0/
    File Path: /home/runner/.m2/repository/com/github/pmonks/wreck/0.1.66/wreck-0.1.66.jar
    MD5: 93609748b03e1b1e40114171c7f0d15a
    SHA1: 1937426fbd5b90100be53dcbb631e5416f12c381
    SHA256:d22413de6d58f4bbd6090f3857f69d42db82411789edc5f64bf18d1a2f266837

    Identifiers



    This report contains data retrieved from the National Vulnerability Database.
    This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
    This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
    This report may contain data retrieved from RetireJS.
    This report may contain data retrieved from the Sonatype OSS Index.