Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: com.github.pmonks/tools-licenses 2.0.188

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
aopalliance-1.0.jarpkg:maven/aopalliance/aopalliance@1.0 019
api-0.8.612.jarpkg:maven/com.cognitect.aws/api@0.8.612 020
asf-cat-2.0.116.jarpkg:maven/com.github.pmonks/asf-cat@2.0.116 020
asm-9.2.jarpkg:maven/org.ow2.asm/asm@9.2 052
checker-qual-3.12.0.jarpkg:maven/org.checkerframework/checker-qual@3.12.0 045
clj-base62-0.1.1.jarpkg:maven/miikka/clj-base62@0.1.1 012
clj-spdx-1.0.126.jarpkg:maven/com.github.pmonks/clj-spdx@1.0.126 020
clj-wcwidth-1.0.85.jarpkg:maven/com.github.pmonks/clj-wcwidth@1.0.85 020
clj-xml-validation-1.0.2.jarpkg:maven/clj-xml-validation/clj-xml-validation@1.0.2 012
clojure-1.11.1.jarpkg:maven/org.clojure/clojure@1.11.1 021
commons-beanutils-1.9.4.jarcpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*pkg:maven/commons-beanutils/commons-beanutils@1.9.4 0Highest167
commons-codec-1.11.jarpkg:maven/commons-codec/commons-codec@1.11 0102
commons-collections-3.2.2.jarcpe:2.3:a:apache:commons_collections:3.2.2:*:*:*:*:*:*:*pkg:maven/commons-collections/commons-collections@3.2.2 0Highest83
commons-digester-2.1.jarpkg:maven/commons-digester/commons-digester@2.1 097
commons-io-2.11.0.jarcpe:2.3:a:apache:commons_io:2.11.0:*:*:*:*:*:*:*pkg:maven/commons-io/commons-io@2.11.0 0Highest122
commons-lang3-3.12.0.jarpkg:maven/org.apache.commons/commons-lang3@3.12.0 0138
commons-logging-1.3.0.jarpkg:maven/commons-logging/commons-logging@1.3.0 0128
commons-validator-1.8.0.jarpkg:maven/commons-validator/commons-validator@1.8.0 0129
core.async-1.6.673.jarpkg:maven/org.clojure/core.async@1.6.673 019
core.cache-1.0.225.jarpkg:maven/org.clojure/core.cache@1.0.225 017
core.memoize-1.0.253.jarpkg:maven/org.clojure/core.memoize@1.0.253 017
core.specs.alpha-0.2.62.jarcpe:2.3:a:alex_project:alex:0.2.62:*:*:*:*:*:*:*pkg:maven/org.clojure/core.specs.alpha@0.2.62 0Low17
data.json-2.4.0.jarpkg:maven/org.clojure/data.json@2.4.0 019
data.priority-map-1.1.0.jarpkg:maven/org.clojure/data.priority-map@1.1.0 014
data.xml-0.2.0-alpha8.jarpkg:maven/org.clojure/data.xml@0.2.0-alpha8 028
embroidery-0.1.13.jarpkg:maven/com.github.pmonks/embroidery@0.1.13 020
endpoints-1.1.12.321.jarpkg:maven/com.cognitect.aws/endpoints@1.1.12.321 020
error_prone_annotations-2.11.0.jarpkg:maven/com.google.errorprone/error_prone_annotations@2.11.0 022
failureaccess-1.0.1.jarpkg:maven/com.google.guava/failureaccess@1.0.1 027
gson-2.8.9.jarcpe:2.3:a:google:gson:2.8.9:*:*:*:*:*:*:*pkg:maven/com.google.code.gson/gson@2.8.9 0Highest28
guava-31.1-android.jarcpe:2.3:a:google:guava:31.1:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@31.1-androidHIGH2Highest24
guice-4.2.2-no_aop.jarpkg:maven/com.google.inject/guice@4.2.2 042
hato-0.9.0.jarpkg:maven/hato/hato@0.9.0 017
http-client-1.0.115.jarpkg:maven/com.cognitect/http-client@1.0.115 024
httpclient-4.5.13.jarcpe:2.3:a:apache:httpclient:4.5.13:*:*:*:*:*:*:*pkg:maven/org.apache.httpcomponents/httpclient@4.5.13 0Highest31
httpcore-4.4.15.jarpkg:maven/org.apache.httpcomponents/httpcore@4.4.15 031
instaparse-1.4.12.jarpkg:maven/instaparse/instaparse@1.4.12 017
j2objc-annotations-1.3.jarpkg:maven/com.google.j2objc/j2objc-annotations@1.3 023
jansi-2.4.1.jarpkg:maven/org.fusesource.jansi/jansi@2.4.1 049
jansi-clj-1.0.3.jarpkg:maven/jansi-clj/jansi-clj@1.0.3 017
java-spdx-library-1.1.10.jarpkg:maven/org.spdx/java-spdx-library@1.1.10 036
java.classpath-1.0.0.jarpkg:maven/org.clojure/java.classpath@1.0.0 015
javax.annotation-api-1.3.2.jarpkg:maven/javax.annotation/javax.annotation-api@1.3.2 047
javax.inject-1.jarpkg:maven/javax.inject/javax.inject@1 019
jcl-over-slf4j-1.7.36.jarpkg:maven/org.slf4j/jcl-over-slf4j@1.7.36 032
jetty-io-9.4.48.v20220622.jarcpe:2.3:a:eclipse:jetty:9.4.48:20220622:*:*:*:*:*:*
cpe:2.3:a:jetty:jetty:9.4.48:20220622:*:*:*:*:*:*
cpe:2.3:a:mortbay_jetty:jetty:9.4.48:20220622:*:*:*:*:*:*		pkg:maven/org.eclipse.jetty/jetty-io@9.4.48.v20220622HIGH*7Highest38
jsoup-1.15.3.jarcpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*pkg:maven/org.jsoup/jsoup@1.15.3 0Highest39
jsr305-3.0.2.jarpkg:maven/com.google.code.findbugs/jsr305@3.0.2 016
lice-comb-2.0.247.jarpkg:maven/com.github.pmonks/lice-comb@2.0.247 020
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jarpkg:maven/com.google.guava/listenablefuture@9999.0-empty-to-avoid-conflict-with-guava 012
maven-artifact-3.8.6.jarpkg:maven/org.apache.maven/maven-artifact@3.8.6 025
maven-builder-support-3.8.6.jarpkg:maven/org.apache.maven/maven-builder-support@3.8.6 023
maven-core-3.8.6.jarcpe:2.3:a:apache:maven:3.8.6:*:*:*:*:*:*:*pkg:maven/org.apache.maven/maven-core@3.8.6 0Highest23
maven-model-3.8.6.jarpkg:maven/org.apache.maven/maven-model@3.8.6 025
maven-model-builder-3.8.6.jarpkg:maven/org.apache.maven/maven-model-builder@3.8.6 031
maven-plugin-api-3.8.6.jarpkg:maven/org.apache.maven/maven-plugin-api@3.8.6 025
maven-repository-metadata-3.8.6.jarpkg:maven/org.apache.maven/maven-repository-metadata@3.8.6 025
maven-resolver-api-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-api@1.8.2 033
maven-resolver-connector-basic-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-connector-basic@1.8.2 033
maven-resolver-impl-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-impl@1.8.2 031
maven-resolver-named-locks-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-named-locks@1.8.2 032
maven-resolver-provider-3.8.6.jarpkg:maven/org.apache.maven/maven-resolver-provider@3.8.6 025
maven-resolver-spi-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-spi@1.8.2 031
maven-resolver-transport-file-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-transport-file@1.8.2 033
maven-resolver-transport-http-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-transport-http@1.8.2 033
maven-resolver-util-1.8.2.jarpkg:maven/org.apache.maven.resolver/maven-resolver-util@1.8.2 035
maven-settings-3.8.6.jarpkg:maven/org.apache.maven/maven-settings@3.8.6 025
maven-settings-builder-3.8.6.jarpkg:maven/org.apache.maven/maven-settings-builder@3.8.6 025
maven-shared-utils-3.3.4.jarcpe:2.3:a:apache:maven_shared_utils:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:utils_project:utils:3.3.4:*:*:*:*:*:*:*		pkg:maven/org.apache.maven.shared/maven-shared-utils@3.3.4 0Highest28
medley-1.7.0.jarpkg:maven/dev.weavejester/medley@1.7.0 015
org.eclipse.sisu.inject-0.3.5.jarpkg:maven/org.eclipse.sisu/org.eclipse.sisu.inject@0.3.5 027
org.eclipse.sisu.plexus-0.3.5.jarpkg:maven/org.eclipse.sisu/org.eclipse.sisu.plexus@0.3.5 026
plexus-cipher-2.0.jarcpe:2.3:a:codehaus-plexus_project:codehaus-plexus:2.0:*:*:*:*:*:*:*pkg:maven/org.codehaus.plexus/plexus-cipher@2.0HIGH2Highest19
plexus-classworlds-2.6.0.jarcpe:2.3:a:codehaus-plexus_project:codehaus-plexus:2.6.0:*:*:*:*:*:*:*pkg:maven/org.codehaus.plexus/plexus-classworlds@2.6.0HIGH2Highest25
plexus-component-annotations-2.1.0.jarcpe:2.3:a:codehaus-plexus_project:codehaus-plexus:2.1.0:*:*:*:*:*:*:*pkg:maven/org.codehaus.plexus/plexus-component-annotations@2.1.0HIGH2Highest26
plexus-interpolation-1.26.jarcpe:2.3:a:codehaus-plexus_project:codehaus-plexus:1.26:*:*:*:*:*:*:*pkg:maven/org.codehaus.plexus/plexus-interpolation@1.26HIGH2Highest24
plexus-sec-dispatcher-2.0.jarcpe:2.3:a:codehaus-plexus_project:codehaus-plexus:2.0:*:*:*:*:*:*:*
cpe:2.3:a:sec_project:sec:2.0:*:*:*:*:*:*:*		pkg:maven/org.codehaus.plexus/plexus-sec-dispatcher@2.0HIGH2Highest19
plexus-utils-3.4.1.jarcpe:2.3:a:codehaus-plexus_project:codehaus-plexus:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:plexus-utils_project:plexus-utils:3.4.1:*:*:*:*:*:*:*		pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1 0Highest25
rencg-1.0.34.jarpkg:maven/com.github.pmonks/rencg@1.0.34 020
s3-822.2.1145.0.jarpkg:maven/com.cognitect.aws/s3@822.2.1145.0 020
slf4j-api-2.0.9.jarpkg:maven/org.slf4j/slf4j-api@2.0.9 028
slf4j-nop-1.7.36.jarpkg:maven/org.slf4j/slf4j-nop@1.7.36 028
spec.alpha-0.3.218.jarpkg:maven/org.clojure/spec.alpha@0.3.218 026
tools-convenience-1.0.142.jarpkg:maven/com.github.pmonks/tools-convenience@1.0.142 020
tools.analyzer-1.1.0.jarpkg:maven/org.clojure/tools.analyzer@1.1.0 016
tools.analyzer.jvm-1.2.2.jarpkg:maven/org.clojure/tools.analyzer.jvm@1.2.2 017
tools.build-0.9.6.jarcpe:2.3:a:alex_project:alex:0.9.6:*:*:*:*:*:*:*pkg:maven/io.github.clojure/tools.build@0.9.6 0Low19
tools.cli-1.0.214.jarpkg:maven/org.clojure/tools.cli@1.0.214 019
tools.deps-0.18.1354.jarcpe:2.3:a:alex_project:alex:0.18.1354:*:*:*:*:*:*:*pkg:maven/org.clojure/tools.deps@0.18.1354 0Low29
tools.gitlibs-2.5.197.jarcpe:2.3:a:alex_project:alex:2.5.197:*:*:*:*:*:*:*pkg:maven/org.clojure/tools.gitlibs@2.5.197 0Low17
tools.logging-1.2.4.jarcpe:2.3:a:alex_project:alex:1.2.4:*:*:*:*:*:*:*pkg:maven/org.clojure/tools.logging@1.2.4 0Low15
tools.namespace-1.4.4.jarpkg:maven/org.clojure/tools.namespace@1.4.4 015
tools.reader-1.3.6.jarpkg:maven/org.clojure/tools.reader@1.3.6 019
xml-in-0.1.1.jarpkg:maven/tolitius/xml-in@0.1.1 012

* indicates the dependency has a known exploited vulnerability

Dependencies (vulnerable)

aopalliance-1.0.jar

Description:

AOP Alliance

License:

Public Domain
File Path: /home/runner/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
SHA256:0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08

Identifiers

api-0.8.612.jar

Description:

A Clojure API for the AWS API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/cognitect/aws/api/0.8.612/api-0.8.612.jar
MD5: 206f03c833e3c693e4907dde5485833d
SHA1: 6bf53a6a318693e086bec6246a63b193f981b386
SHA256:744fc527fe5bf32cb1063a6755d3c04339deef5141597b03c7d8412ee2d28c9c

Identifiers

asf-cat-2.0.116.jar

Description:

A micro library that provides a Clojure implementation of the Apache Software Foundation's 3rd Party License Policy (https://www.apache.org/legal/resolved.html).

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/asf-cat/2.0.116/asf-cat-2.0.116.jar
MD5: 5e49866c64820238b12651568267c8a2
SHA1: 5bdddea8fce7e45cd92c32c0579added18f44ca2
SHA256:5a727067c274d84992efdcc55e0a2837c55964c1cbb419365667df835914fa16

Identifiers

asm-9.2.jar

Description:

ASM, a very small and fast Java bytecode manipulation framework

License:

BSD-3-Clause: https://asm.ow2.io/license.html
File Path: /home/runner/.m2/repository/org/ow2/asm/asm/9.2/asm-9.2.jar
MD5: 8f184dce9b1bedc675d4a3640d43ddf0
SHA1: 81a03f76019c67362299c40e0ba13405f5467bff
SHA256:b9d4fe4d71938df38839f0eca42aaaa64cf8b313d678da036f0cb3ca199b47f5

Identifiers

checker-qual-3.12.0.jar

Description:

checker-qual contains annotations (type qualifiers) that a programmer
writes to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT
File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/3.12.0/checker-qual-3.12.0.jar
MD5: ab1ae0e2f2f63601597a5a96fca8a54f
SHA1: d5692f0526415fcc6de94bb5bfbd3afd9dd3b3e5
SHA256:ff10785ac2a357ec5de9c293cb982a2cbb605c0309ea4cc1cb9b9bc6dbe7f3cb

Identifiers

clj-base62-0.1.1.jar

Description:

Base62 encoding and decoding for Clojure

File Path: /home/runner/.m2/repository/miikka/clj-base62/0.1.1/clj-base62-0.1.1.jar
MD5: 4d1ff2cba176169428c21fb9ddab0528
SHA1: e983866be496ce97fc442c07561be31cf1d95ecd
SHA256:b835393a3ef4d3f45574824f42d1fcc7980378971b484cd1994d70cbb0d54862

Identifiers

clj-spdx-1.0.126.jar

Description:

Clojure wrapper around spdx/Spdx-Java-Library.

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/clj-spdx/1.0.126/clj-spdx-1.0.126.jar
MD5: 65201a17402214c8e3e84a9b15df914a
SHA1: b1ea26cc9d31ebdd877b1b25c6193075a9f31f01
SHA256:2432c7285aad096932d89e434690de065de4fe586a48efdb4aec4ecba8dc9094

Identifiers

clj-wcwidth-1.0.85.jar

Description:

Pure Clojure implementations of wcwidth/wcswidth.

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/clj-wcwidth/1.0.85/clj-wcwidth-1.0.85.jar
MD5: eded898b7bb757f97ffaa811a712b3a0
SHA1: f060ccb00b0f5a97330644b137e1ea72578cbf61
SHA256:985eba01524d6147107e4d56b10163d255edb47a8b353e2653033be764fba978

Identifiers

clj-xml-validation-1.0.2.jar

Description:

Simple XML Schema validation library for Clojure

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/clj-xml-validation/clj-xml-validation/1.0.2/clj-xml-validation-1.0.2.jar
MD5: ab69483eecdcab00c0eaa011b056c351
SHA1: be28bbe42941f00acfa073e986fa7b386a7c4f2d
SHA256:e4210b7290f38bf90ce0dfb6c4398b74f54c7636baef37598c05e2852b59bf43

Identifiers

clojure-1.11.1.jar

Description:

Clojure core environment and runtime library.

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/clojure/1.11.1/clojure-1.11.1.jar
MD5: 88321e4272aa5e10d2b803f47944e27c
SHA1: 2896bc72c90da8125026c0e61df0470a084f9ec3
SHA256:2381b6e9423ab465151455944903d13a56243d6006b9194afc1bf4f8710cb4de

Identifiers

commons-beanutils-1.9.4.jar

Description:

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-beanutils/commons-beanutils/1.9.4/commons-beanutils-1.9.4.jar
MD5: 07dc532ee316fe1f2f0323e9bd2f8df4
SHA1: d52b9abcd97f38c81342bb7e7ae1eee9b73cba51
SHA256:7d938c81789028045c08c065e94be75fc280527620d5bd62b519d5838532368a

Identifiers

commons-codec-1.11.jar

Description:

     The Apache Commons Codec package contains simple encoder and decoders for
     various formats such as Base64 and Hexadecimal.  In addition to these
     widely used encoders and decoders, the codec package also maintains a
     collection of phonetic encoding utilities.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar
MD5: 567159b1ae257a43e1391a8f59d24cfe
SHA1: 3acb4705652e16236558f0f4f2192cc33c3bd189
SHA256:e599d5318e97aa48f42136a2927e6dfa4e8881dff0e6c8e3109ddbbff51d7b7d

Identifiers

commons-collections-3.2.2.jar

Description:

Types that extend and augment the Java Collections Framework.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
SHA256:eeeae917917144a68a741d4c0dff66aa5c5c5fd85593ff217bced3fc8ca783b8

Identifiers

commons-digester-2.1.jar

Description:

    The Digester package lets you configure an XML to Java object mapping module
    which triggers certain actions called rules whenever a particular 
    pattern of nested XML elements is recognized.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-digester/commons-digester/2.1/commons-digester-2.1.jar
MD5: 528445033f22da28f5047b6abcd1c7c9
SHA1: 73a8001e7a54a255eef0f03521ec1805dc738ca0
SHA256:e0b2b980a84fc6533c5ce291f1917b32c507f62bcad64198fff44368c2196a3d

Identifiers

commons-io-2.11.0.jar

Description:

The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-io/commons-io/2.11.0/commons-io-2.11.0.jar
MD5: 3b4b7ccfaeceeac240b804839ee1a1ca
SHA1: a2503f302b11ebde7ebc3df41daebe0e4eea3689
SHA256:961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908

Identifiers

commons-lang3-3.12.0.jar

Description:

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar
MD5: 19fe50567358922bdad277959ea69545
SHA1: c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e
SHA256:d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e

Identifiers

commons-logging-1.3.0.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.3.0/commons-logging-1.3.0.jar
MD5: 522cc4b1f42b7db1554474cb989adfb2
SHA1: f5e064b541f5c5fbc5e4fb49c4e8cd4eabb3afd6
SHA256:66d3c980470b99b0c511dad3dfc0ae7b265ec1fb144e96bc0253a8a175fd34d9

Identifiers

commons-validator-1.8.0.jar

Description:

    Apache Commons Validator provides the building blocks for both client side validation and server side data validation.
    It may be used standalone or with a framework like Struts.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-validator/commons-validator/1.8.0/commons-validator-1.8.0.jar
MD5: 28fac5309e05b1ce9d83285a8500cad2
SHA1: 49bb9f45e0aa3c8b2261394c76675fba6f20d2e4
SHA256:1292e4bd956936461a6096b094400f5c2a946267c2e20324512ac7532c0c6eb3

Identifiers

core.async-1.6.673.jar

Description:

Facilities for async programming and communication in Clojure

File Path: /home/runner/.m2/repository/org/clojure/core.async/1.6.673/core.async-1.6.673.jar
MD5: a15f627ec7281bd3c551e209f0ec1d34
SHA1: 667594fa2f9ce315d24c6ac0c98a5c2913a4b4bf
SHA256:1681dd1888c75401f444b511c8353fbda3ceb1a7608810a23ddd25d1045f907a

Identifiers

core.cache-1.0.225.jar

Description:

Cache library for Clojure.

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/core.cache/1.0.225/core.cache-1.0.225.jar
MD5: 3820b6de04123c74459e2216d794e24c
SHA1: ddd58c0d29cf1515d13351cc0770634ecac884f0
SHA256:c153aa947eda5cdbd8a93882c8fbabd5037d4ad7311802b4bcd8015469f6a5b1

Identifiers

core.memoize-1.0.253.jar

Description:

A memoization library for Clojure

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/core.memoize/1.0.253/core.memoize-1.0.253.jar
MD5: 5b317b3cd92d01b08757de9d00033991
SHA1: bfa3ac940d93d50a14e4301b4cf8295e451b97c4
SHA256:4a910585182ab326c1d0a20d34315be1563b5a58437d41c021dd7fe9911e1ed6

Identifiers

core.specs.alpha-0.2.62.jar

Description:

Specs for clojure.core

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/core.specs.alpha/0.2.62/core.specs.alpha-0.2.62.jar
MD5: b1e37e6e8efdade6b7c2a4dd17c0d437
SHA1: a2a7ea21a695561924bc8506f3feb5d8c8f894d5
SHA256:06eea8c070bbe45c158567e443439681bc8c46e9123414f81bfa32ba42d6cbc8

Identifiers

data.json-2.4.0.jar

Description:

Generating/parsing JSON from/to Clojure data structures

File Path: /home/runner/.m2/repository/org/clojure/data.json/2.4.0/data.json-2.4.0.jar
MD5: eb7fd6a50acd70bf82494992880d6450
SHA1: d779823f78d614897df79cd1823cb1cef840fa5b
SHA256:ec3f2f994e1eedd420313c452ba5518c5f5c97be5152dfed5650bc6611486adf

Identifiers

data.priority-map-1.1.0.jar

File Path: /home/runner/.m2/repository/org/clojure/data.priority-map/1.1.0/data.priority-map-1.1.0.jar
MD5: 1d7258593b5e40bb5484727da24cb728
SHA1: fc412d06788c1ea186117f8ea656d44fba654788
SHA256:fe51af4472fa0f1bfd66f3871de55076402ff6615a74bcb17b37c402a0ea6f4c

Identifiers

data.xml-0.2.0-alpha8.jar

Description:

Functions to parse XML into lazy sequences and lazy trees and emit these as text

File Path: /home/runner/.m2/repository/org/clojure/data.xml/0.2.0-alpha8/data.xml-0.2.0-alpha8.jar
MD5: ecf740cd730cad5fdbaf16e401027290
SHA1: c3dd8907b0a63a67082bc3091e304d9e1676d4b0
SHA256:b5b10c4f6df654c36c610f2b218cd8f52af3b2677ef9ffb5a3f901ab9fbb3a95

Identifiers

embroidery-0.1.13.jar

Description:

A Clojure micro-library for leveraging virtual threads on JVMs that support them.

License:

Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/embroidery/0.1.13/embroidery-0.1.13.jar
MD5: 47e473a21f2003906f55c691b711995c
SHA1: 91ab777ab08a60d6453e36fe93fbdc390f9ce6b0
SHA256:89f8fb60be5164b96e6066cb7d389ebc775672605e99dca0f9658197805bdc4f

Identifiers

endpoints-1.1.12.321.jar

Description:

endpoints resources for com.cognitect.aws/api

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/cognitect/aws/endpoints/1.1.12.321/endpoints-1.1.12.321.jar
MD5: 92db952b60c537ee621b0439fb01c8d0
SHA1: 3bec2d7c7fe3b22b709e3ef8244d8f34406f3a8d
SHA256:2e501f14e1c7cb7594638926d5bc720240977806669f5d6019711ee0903dbfa2

Identifiers

error_prone_annotations-2.11.0.jar

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.11.0/error_prone_annotations-2.11.0.jar
MD5: 656ad66261b7e7ea472ed0ffeea773ea
SHA1: c5a0ace696d3f8b1c1d8cc036d8c03cc0cbe6b69
SHA256:721cb91842b46fa056847d104d5225c8b8e1e8b62263b993051e1e5a0137b7ec

Identifiers

failureaccess-1.0.1.jar

Description:

    Contains
    com.google.common.util.concurrent.internal.InternalFutureFailureAccess and
    InternalFutures. Most users will never need to use this artifact. Its
    classes is conceptually a part of Guava, but they're in this separate
    artifact so that Android libraries can use them without pulling in all of
    Guava (just as they can use ListenableFuture by depending on the
    listenablefuture artifact).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar
MD5: 091883993ef5bfa91da01dcc8fc52236
SHA1: 1dcf1de382a0bf95a3d8b0849546c88bac1292c9
SHA256:a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26

Identifiers

gson-2.8.9.jar

Description:

Gson JSON library

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/gson/gson/2.8.9/gson-2.8.9.jar
MD5: e67627f67e03301092dc7de0a2d7cef8
SHA1: 8a432c1d6825781e21a02db2e2c33c5fde2833b9
SHA256:d3999291855de495c94c743761b8ab5176cfeabe281a5ab0d8e8d45326fd703e

Identifiers

guava-31.1-android.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, Google's collections, I/O classes, and
    much more.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/guava/guava/31.1-android/guava-31.1-android.jar
MD5: 22585f87f08f0d5b2e737eb71c8a5d9f
SHA1: 9222c47cc3ae890f07f7c961bbb3cb69050fe4aa
SHA256:32ac2ed709d96d278b5d2e3e5cea178fa4939939c525fb647532f013308db309

Identifiers

CVE-2023-2976  

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
CWE-552 Files or Directories Accessible to External Parties

CVSSv3:
  • Base Score: HIGH (7.1)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2020-8908  

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CWE-732 Incorrect Permission Assignment for Critical Resource

CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: LOW (3.3)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

guice-4.2.2-no_aop.jar

Description:

Guice is a lightweight dependency injection framework for Java 6 and above

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/inject/guice/4.2.2/guice-4.2.2-no_aop.jar
MD5: 57d2b333c34d0f834189d54b6e59d1a6
SHA1: fa13659f9128f4c011c8e1d06f137083b4876377
SHA256:0f4f5fb28609a4d2b38b7f7128be7cf9b541f25283d71b4e56066d99683aafff

Identifiers

hato-0.9.0.jar

Description:

An HTTP client for Clojure, wrapping JDK 11's HttpClient.

License:

The MIT License: http://opensource.org/licenses/mit-license.php
File Path: /home/runner/.m2/repository/hato/hato/0.9.0/hato-0.9.0.jar
MD5: 3439dcca378712fa26e9927acf1f7bc8
SHA1: d47dec2b0e8fb631d95e89864df4abc1fdcd7bc3
SHA256:5e798c88abc14aaf3f6664dfdc2677b2d5ad366d000df8714adbba0dfcd00c9b

Identifiers

http-client-1.0.115.jar

Description:

HTTP client

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/cognitect/http-client/1.0.115/http-client-1.0.115.jar
MD5: 772657dbda5016fde4c541497de9f3b2
SHA1: 1a84a105c286d00557cc6c3e96932e40439b387a
SHA256:1b0d88365d80d21bb615d743bff1fa9b11b0c5f229a6ffa3fb8f7b49bab74d4c

Identifiers

httpclient-4.5.13.jar

Description:

   Apache HttpComponents Client

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar
MD5: 40d6b9075fbd28fa10292a45a0db9457
SHA1: e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cada
SHA256:6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743

Identifiers

httpcore-4.4.15.jar

Description:

   Apache HttpComponents Core (blocking I/O)

File Path: /home/runner/.m2/repository/org/apache/httpcomponents/httpcore/4.4.15/httpcore-4.4.15.jar
MD5: be7c67929df007fcac6c8eff5322d3a0
SHA1: 7f2e0c573eaa7a74bac2e89b359e1f73d92a0a1d
SHA256:3cbaed088c499a10f96dde58f39dc0e7985171abd88138ca1655a872011bb142

Identifiers

instaparse-1.4.12.jar

Description:

Instaparse: No grammar left behind

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/instaparse/instaparse/1.4.12/instaparse-1.4.12.jar
MD5: ef15595aeb81ea2592a624a4c8fb30a9
SHA1: fdb360826edec1cc2c13c6c8a5397f115bdcf952
SHA256:139f78bff278f1b2d9804d785911d23451e5bcb042580ecadec4400ceb55decd

Identifiers

j2objc-annotations-1.3.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.jar
MD5: 5fa4ec4ec0c5aa70af8a7d4922df1931
SHA1: ba035118bc8bac37d7eff77700720999acd9986d
SHA256:21af30c92267bd6122c0e0b4d20cccb6641a37eaf956c6540ec471d584e64a7b

Identifiers

jansi-2.4.1.jar

Description:

Jansi is a java library for generating and interpreting ANSI escape sequences.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/fusesource/jansi/jansi/2.4.1/jansi-2.4.1.jar
MD5: 10c1033cc584325f020e2f9d231c0764
SHA1: d5774f204d990c9f5da2809b88f928515577beb4
SHA256:2e5e775a9dc58ffa6bbd6aa6f099d62f8b62dcdeb4c3c3bbbe5cf2301bc2dcc1

Identifiers

jansi-clj-1.0.3.jar

Description:

Clojure Wrapper around Jansi.

License:

MIT: https://choosealicense.com/licenses/mit
File Path: /home/runner/.m2/repository/jansi-clj/jansi-clj/1.0.3/jansi-clj-1.0.3.jar
MD5: 816a76445cc28ee6de02418428cfda28
SHA1: 987b5981748f75d9ab1b9ba5f38c4d4614448303
SHA256:2bff5fe8348b3ef6eed84b8fc162efc4f4d3887a42340508501a1f8fa805f3c6

Identifiers

java-spdx-library-1.1.10.jar

Description:

Java library which implements the Java object model for SPDX and provides useful helper functions.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/spdx/java-spdx-library/1.1.10/java-spdx-library-1.1.10.jar
MD5: 9bf5e91b0e94b6bdf21291d8d73ab2b7
SHA1: 0dc9e7af93007c88b98388209d231be2f838cb45
SHA256:ef116816a4d221933d34d9f113fd47f6780bca2b0c826545081d742f4e7178fb

Identifiers

java.classpath-1.0.0.jar

File Path: /home/runner/.m2/repository/org/clojure/java.classpath/1.0.0/java.classpath-1.0.0.jar
MD5: 4c04bfbab2e7cfbb75698021ce7e6b00
SHA1: 015d06d1b304ac23104333bc8492a11bcc2e87e4
SHA256:c14e0e10304a5e5cfd2cc742fbdefac1f5293eec6070c2ffe8903fb5c7fe7d6f

Identifiers

javax.annotation-api-1.3.2.jar

Description:

Common Annotations for the JavaTM Platform API

License:

CDDL + GPLv2 with classpath exception: https://github.com/javaee/javax.annotation/blob/master/LICENSE
File Path: /home/runner/.m2/repository/javax/annotation/javax.annotation-api/1.3.2/javax.annotation-api-1.3.2.jar
MD5: 2ab1973eefffaa2aeec47d50b9e40b9d
SHA1: 934c04d3cfef185a8008e7bf34331b79730a9d43
SHA256:e04ba5195bcd555dc95650f7cc614d151e4bcd52d29a10b8aa2197f3ab89ab9b

Identifiers

javax.inject-1.jar

Description:

The javax.inject API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
SHA256:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff

Identifiers

jcl-over-slf4j-1.7.36.jar

Description:

JCL 1.2 implemented over SLF4J

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.36/jcl-over-slf4j-1.7.36.jar
MD5: 8065610cde33ed9fd5d34367912c1938
SHA1: d877e195a05aca4a2f1ad2ff14bfec1393af4b5e
SHA256:ab57ca8fd223772c17365d121f59e94ecbf0ae59d08c03a3cb5b81071c019195

Identifiers

jetty-io-9.4.48.v20220622.jar

Description:

Jetty module for Jetty :: IO Utility

License:

http://www.apache.org/licenses/LICENSE-2.0, https://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/runner/.m2/repository/org/eclipse/jetty/jetty-io/9.4.48.v20220622/jetty-io-9.4.48.v20220622.jar
MD5: a64fa8ebc74f4c7e846f34b8b9ab0645
SHA1: b09b55209d0a304e542f779750a01f6914dc55e7
SHA256:4d2f60a0348905a0a70bb266d1eb23a29959281391aba54d17d4a3a0460b8b47

Identifiers

CVE-2023-36478  

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.
CWE-400 Uncontrolled Resource Consumption, CWE-190 Integer Overflow or Wraparound

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-44487  

CISA Known Exploited Vulnerability:
  • Product: IETF HTTP/2
  • Name: HTTP/2 Rapid Reset Attack Vulnerability
  • Date Added: 2023-10-10
  • Description: HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
  • Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • Due Date: 2023-10-31
  • Notes: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-26048  

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References:

Vulnerable Software & Versions: (show all)

CVE-2023-26049  

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-40167  

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field.  This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses.  There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
CWE-130 Improper Handling of Length Parameter Inconsistency

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-36479  

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
CWE-149 Improper Neutralization of Quoting Syntax

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-41900  

Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
CWE-1390 Weak Authentication

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

jsoup-1.15.3.jar

Description:

jsoup is a Java library for working with real-world HTML. It provides a very convenient API for fetching URLs and extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.

License:

The MIT License: https://jsoup.org/license
File Path: /home/runner/.m2/repository/org/jsoup/jsoup/1.15.3/jsoup-1.15.3.jar
MD5: 4f16c3b17b8c1b0173b1ed9f99f2c27c
SHA1: f6e1d8a8819f854b681c8eaa57fd59a42329e10c
SHA256:e20a5e78b1372f2a4e620832db4442d5077e5cbde280b24c666a3770844999bc

Identifiers

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7

Identifiers

lice-comb-2.0.247.jar

Description:

A Clojure library for software license detection.

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/lice-comb/2.0.247/lice-comb-2.0.247.jar
MD5: 59357ae3190dc8cc66b924851be848a4
SHA1: 51e185139e0ad084cbd3c2a2a04cc70aa9c640b6
SHA256:7a619cca697f0c365e33c2172770826c0e01941fc82f937feed1fad6ec8edea6

Identifiers

listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar

Description:

    An empty artifact that Guava depends on to signal that it is providing
    ListenableFuture -- but is also available in a second "version" that
    contains com.google.common.util.concurrent.ListenableFuture class, without
    any other Guava classes. The idea is:

    - If users want only ListenableFuture, they depend on listenablefuture-1.0.

    - If users want all of Guava, they depend on guava, which, as of Guava
    27.0, depends on
    listenablefuture-9999.0-empty-to-avoid-conflict-with-guava. The 9999.0-...
    version number is enough for some build systems (notably, Gradle) to select
    that empty artifact over the "real" listenablefuture-1.0 -- avoiding a
    conflict with the copy of ListenableFuture in guava itself. If users are
    using an older version of Guava or a build system other than Gradle, they
    may see class conflicts. If so, they can solve them by manually excluding
    the listenablefuture artifact or manually forcing their build systems to
    use 9999.0-....

File Path: /home/runner/.m2/repository/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
MD5: d094c22570d65e132c19cea5d352e381
SHA1: b421526c5f297295adef1c886e5246c39d4ac629
SHA256:b372a037d4230aa57fbeffdef30fd6123f9c0c2db85d0aced00c91b974f33f99

Identifiers

maven-artifact-3.8.6.jar

File Path: /home/runner/.m2/repository/org/apache/maven/maven-artifact/3.8.6/maven-artifact-3.8.6.jar
MD5: e58778f4d2041b0df8b301303aa4c6d8
SHA1: 1637b7e8fc392e389752e79b827b883629285626
SHA256:de22a4c6f54fe31276a823b1bbd3adfd6823529e732f431b5eff0852c2b9252b

Identifiers

maven-builder-support-3.8.6.jar

Description:

Support for descriptor builders (model, setting, toolchains)

File Path: /home/runner/.m2/repository/org/apache/maven/maven-builder-support/3.8.6/maven-builder-support-3.8.6.jar
MD5: 8648771aa46a6bdbb81de74849ba9385
SHA1: 4d22a3faa8880efef2e960bb8a00c2a0b351c46a
SHA256:3d3d9753f36e88039e63f8757bfe643830d69443e168c4ecdaf5f47a2c1d94ce

Identifiers

maven-core-3.8.6.jar

Description:

Maven Core classes.

File Path: /home/runner/.m2/repository/org/apache/maven/maven-core/3.8.6/maven-core-3.8.6.jar
MD5: 92b05ed72c78a0ddca876d73e9a6b87c
SHA1: f945f1f19452214d360d453d9357275313f1cfd9
SHA256:439550da8d5451f84cbc6806df7cdccc30c4bbf59456659af95aac907bf658e1

Identifiers

maven-model-3.8.6.jar

Description:

Model for Maven POM (Project Object Model)

File Path: /home/runner/.m2/repository/org/apache/maven/maven-model/3.8.6/maven-model-3.8.6.jar
MD5: 7812dccb91cf3e8faaa67ae060ceb7c2
SHA1: 8ad31867c493c63ac60a3fa42356a72d20f8457b
SHA256:13986dc4d0e7eabd0c991c8fd22ef10e44f917f7a218a5a75c51b5620d4c22b0

Identifiers

maven-model-builder-3.8.6.jar

Description:

The effective model builder, with inheritance, profile activation, interpolation, ...

File Path: /home/runner/.m2/repository/org/apache/maven/maven-model-builder/3.8.6/maven-model-builder-3.8.6.jar
MD5: b3a622ed6c8d38d4ac94068db3f34074
SHA1: 8323a726c657becbffc8ea807970935dde3e3903
SHA256:5ca374eb4e6194ec0cd7004366decd39d4d048145a6380f99741a9414f38cebb

Identifiers

maven-plugin-api-3.8.6.jar

Description:

The API for plugins - Mojos - development.

File Path: /home/runner/.m2/repository/org/apache/maven/maven-plugin-api/3.8.6/maven-plugin-api-3.8.6.jar
MD5: c8187986d35b9d8a347e3989402879f3
SHA1: 4138e2e9b39f364902ac263888feb7b2407a298e
SHA256:2c317f6041219f16f34bd47ea7618e57552d4f1f707378701b9efed4adecf70a

Identifiers

maven-repository-metadata-3.8.6.jar

Description:

Per-directory local and remote repository metadata.

File Path: /home/runner/.m2/repository/org/apache/maven/maven-repository-metadata/3.8.6/maven-repository-metadata-3.8.6.jar
MD5: 8e8a0e221a0d970ad64a68f46e5115ab
SHA1: c60a7640e1b829e60f8791b5edf3cf56a6556aca
SHA256:a70e1f662fa81b72eb468d28eec72fd7f2b7b49c4b54d1cf1c14ccd197d4eafd

Identifiers

maven-resolver-api-1.8.2.jar

Description:

    The application programming interface for the repository system.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-api/1.8.2/maven-resolver-api-1.8.2.jar
MD5: 3472778bb4d8bbbc785275a271afd7f6
SHA1: af6c5d8660e3c127c3987c385069d301848800a2
SHA256:f6b8860554f6620cdc539746383264a211d0ae2886770de227b10ced518cf15f

Identifiers

maven-resolver-connector-basic-1.8.2.jar

Description:

      A repository connector implementation for repositories using URI-based layouts.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-connector-basic/1.8.2/maven-resolver-connector-basic-1.8.2.jar
MD5: 49c3dbcfd4a286a719277c0293561ba2
SHA1: 013b77ee054cd269a7e14667419d202799db18a2
SHA256:7631f1d87875d031b141abf99e185652a728a25cdb69be6dd39fca1af9a9f170

Identifiers

maven-resolver-impl-1.8.2.jar

Description:

    An implementation of the repository system.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-impl/1.8.2/maven-resolver-impl-1.8.2.jar
MD5: 1d11314cd969b46e6b7a3474008cb2a8
SHA1: 5f08b1e7d0bc89d8254cd46881a5e228c98303df
SHA256:c702e03dbd4b4f585e807816375fadf81f203b036bbc0c1f0d847628616e9f6a

Identifiers

maven-resolver-named-locks-1.8.2.jar

Description:

      A synchronization utility implementation using Named locks.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-named-locks/1.8.2/maven-resolver-named-locks-1.8.2.jar
MD5: dbe2bc77cd28fe81dfe8fc0347f89f8a
SHA1: 6d81987c220cdb9672f15a1f2ee3e4ba9f80d50f
SHA256:349a057956bedd0ab01f83d55152e06ac79942d1480c506710edb44ef6efc3f1

Identifiers

maven-resolver-provider-3.8.6.jar

Description:

Extensions to Maven Resolver for utilizing Maven POM and repository metadata.

File Path: /home/runner/.m2/repository/org/apache/maven/maven-resolver-provider/3.8.6/maven-resolver-provider-3.8.6.jar
MD5: 78472f13757c6190aea51cce74c9abd4
SHA1: c6dadedc9f6b5c1c02d0a93afd1857460b0f501d
SHA256:fbb1abf0346ba84149a0ffcb7b688a06f6e06b49af9c151f4ca01c0fc5ae3ea9

Identifiers

maven-resolver-spi-1.8.2.jar

Description:

    The service provider interface for repository system implementations and repository connectors.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-spi/1.8.2/maven-resolver-spi-1.8.2.jar
MD5: 47664b1ea8e0ee3d7aff0fe4a7ec01b4
SHA1: 0d0768a341173c2ef88e8dbcab2f30ebfe7ef526
SHA256:a301acbeca7bb42e85bf8be48c677ba70e9107465e4f9438124a2dc623543b84

Identifiers

maven-resolver-transport-file-1.8.2.jar

Description:

      A transport implementation for repositories using file:// URLs.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-transport-file/1.8.2/maven-resolver-transport-file-1.8.2.jar
MD5: d86502b969ca4ac4f9bf1c8266e8f82d
SHA1: b9a7004de9850fe9dcff8325c3d51ef4e387ef70
SHA256:8cb8c14eed09e286996fdad5a961c3660a3a1f1625dad578087c00bcc5182152

Identifiers

maven-resolver-transport-http-1.8.2.jar

Description:

      A transport implementation for repositories using http:// and https:// URLs.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-transport-http/1.8.2/maven-resolver-transport-http-1.8.2.jar
MD5: e0a86145734fa2fb173c679e1be2388a
SHA1: dbc0b6f022c51857fb801ba135c30af056b4c071
SHA256:50534deb9ea6590095179079d5a14e50b20d31d99f19f5f39e9f46c7f9861060

Identifiers

maven-resolver-util-1.8.2.jar

Description:

    A collection of utility classes to ease usage of the repository system.

License:

"Apache License, Version 2.0";link="https://www.apache.org/licenses/LICENSE-2.0.txt"
File Path: /home/runner/.m2/repository/org/apache/maven/resolver/maven-resolver-util/1.8.2/maven-resolver-util-1.8.2.jar
MD5: e7f3441a38bab7861629fbe74d19a41b
SHA1: cfb9b2e4c71d2a819aa4519800c9687c74b71584
SHA256:a2cc000cb37065740f1e8d4857cc81b3ee51d637d68c8b22b95ee303fef97b4a

Identifiers

maven-settings-3.8.6.jar

Description:

Maven Settings model.

File Path: /home/runner/.m2/repository/org/apache/maven/maven-settings/3.8.6/maven-settings-3.8.6.jar
MD5: 942dc05cb4b907a03def39ef227dd93d
SHA1: 9ba5114c6c61c66fbc6b93c73085dc5b15585524
SHA256:66dcefa127254524b9370594cc90c611ae8490e094d28534d1c840f1889d8a61

Identifiers

maven-settings-builder-3.8.6.jar

Description:

The effective settings builder, with inheritance and password decryption.

File Path: /home/runner/.m2/repository/org/apache/maven/maven-settings-builder/3.8.6/maven-settings-builder-3.8.6.jar
MD5: 735e76ad7c32c20bd4e46498492a00be
SHA1: e5c92138dffd1f9e5454cd8224cf8e18253b1803
SHA256:59593889c5056ac5fdcf975143957cdaac8bc8a4260e2bac42136df427e284b8

Identifiers

maven-shared-utils-3.3.4.jar

Description:

Shared utilities for use by Maven core and plugins

File Path: /home/runner/.m2/repository/org/apache/maven/shared/maven-shared-utils/3.3.4/maven-shared-utils-3.3.4.jar
MD5: 908f2a0107ff330ac9b856356a0acaef
SHA1: f87a61adb1e12a00dcc6cc6005a51e693aa7c4ac
SHA256:7925d9c5a0e2040d24b8fae3f612eb399cbffe5838b33ba368777dc7bddf6dda

Identifiers

medley-1.7.0.jar

Description:

A lightweight library of useful, mostly pure functions

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/dev/weavejester/medley/1.7.0/medley-1.7.0.jar
MD5: 249ee290d7e2251e43d8e0ffe5eada0d
SHA1: 5f2d2bec8700ba4fceceb5445afc4024e05c87d0
SHA256:4e620275b5f0f0811262bc0d245f7f2532acb5256848300866a5f5e6f621775a

Identifiers

org.eclipse.sisu.inject-0.3.5.jar

License:

http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/org/eclipse/sisu/org.eclipse.sisu.inject/0.3.5/org.eclipse.sisu.inject-0.3.5.jar
MD5: 1b296b0ddd911ed3750b3df93b395cd5
SHA1: d4265dd4f0f1d7a06d80df5a5f475d5ff9c17140
SHA256:c5994010bcdce1d2bd603a4d50c47191ddbd7875d1157b23aaa26d33c82fda13

Identifiers

org.eclipse.sisu.plexus-0.3.5.jar

License:

http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/org/eclipse/sisu/org.eclipse.sisu.plexus/0.3.5/org.eclipse.sisu.plexus-0.3.5.jar
MD5: 30c4a9fa2137698ed66c8542f1be196a
SHA1: d71996bb2e536f966b3b70e647067fff3b73d32f
SHA256:7e4c61096d70826f20f7a7d55c59a5528e7aa5ad247ee2dfe544e4dd25f6a784

Identifiers

plexus-cipher-2.0.jar

File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-cipher/2.0/plexus-cipher-2.0.jar
MD5: 55d612839faf248cbe3e273969c002c2
SHA1: 425ea8e534716b4bff1ea90f39bd76be951d651b
SHA256:9a7f1b5c5a9effd61eadfd8731452a2f76a8e79111fac391ef75ea801bea203a

Identifiers

CVE-2022-4244  

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-4245  

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CWE-611 Improper Restriction of XML External Entity Reference

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

plexus-classworlds-2.6.0.jar

Description:

A class loader framework

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-classworlds/2.6.0/plexus-classworlds-2.6.0.jar
MD5: 67e722b27e3a33b33c1b263b99dd7c43
SHA1: 8587e80fcb38e70b70fae8d5914b6376bfad6259
SHA256:52f77c5ec49f787c9c417ebed5d6efd9922f44a202f217376e4f94c0d74f3549

Identifiers

CVE-2022-4244  

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-4245  

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CWE-611 Improper Restriction of XML External Entity Reference

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

plexus-component-annotations-2.1.0.jar

Description:

    Plexus Component "Java 5" Annotations, to describe plexus components properties in java sources with
    standard annotations instead of javadoc annotations.

File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-component-annotations/2.1.0/plexus-component-annotations-2.1.0.jar
MD5: 141fd7a2ae613cb17d25ecd54b43eb3f
SHA1: 2f2147a6cc6a119a1b51a96f31d45c557f6244b9
SHA256:bde3617ce9b5bcf9584126046080043af6a4b3baea40a3b153f02e7bbc32acac

Identifiers

CVE-2022-4244  

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-4245  

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CWE-611 Improper Restriction of XML External Entity Reference

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

plexus-interpolation-1.26.jar

Description:

The Plexus project provides a full software stack for creating and executing software projects.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-interpolation/1.26/plexus-interpolation-1.26.jar
MD5: 1049ae9f5cd8cf618abf5bc5805e6b94
SHA1: 25b919c664b79795ccde0ede5cee0fd68b544197
SHA256:b3b5412ce17889103ea564bcdfcf9fb3dfa540344ffeac6b538a73c9d7182662

Identifiers

CVE-2022-4244  

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-4245  

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CWE-611 Improper Restriction of XML External Entity Reference

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

plexus-sec-dispatcher-2.0.jar

File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-sec-dispatcher/2.0/plexus-sec-dispatcher-2.0.jar
MD5: e68635a721630177ac70173e441336b6
SHA1: f89c5080614ffd0764e49861895dbedde1b47237
SHA256:873139960c4c780176dda580b003a2c4bf82188bdce5bb99234e224ef7acfceb

Identifiers

CVE-2022-4244  

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-4245  

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CWE-611 Improper Restriction of XML External Entity Reference

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

plexus-utils-3.4.1.jar

Description:

A collection of various utility classes to ease working with strings, files, command lines, XML and
    more.

File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-utils/3.4.1/plexus-utils-3.4.1.jar
MD5: c155c4135ef7ba134659bf1af31c5156
SHA1: 4de9992988c534efd668bfcca0480ebe13e0c0eb
SHA256:52d85e04b3918722af11d12855b4a8257df96a0e76c8f4e3852e6faa851f357b

Identifiers

rencg-1.0.34.jar

Description:

A micro-library for Clojure that provides first class support for named-capturing groups in regular expressions.

License:

Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/rencg/1.0.34/rencg-1.0.34.jar
MD5: 5d0dd6a9dd68c9307e0acf0a54e380e7
SHA1: 68cef55ad7c6cc3ac4149b3ac05ab15ccfd65755
SHA256:542310b5862368809b238b3d15c9b04eb21d1b44c79750beee14de11bb48a5f6

Identifiers

s3-822.2.1145.0.jar

Description:

s3 resources for com.cognitect.aws/api

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/cognitect/aws/s3/822.2.1145.0/s3-822.2.1145.0.jar
MD5: c1d5fcf7d0334d847d7ad49f30d23bc9
SHA1: 0c4d7c1bc3baa4a05c7ebdf6b672259f56a16d7e
SHA256:703241a6ffc159ed85b1e1cd6d75e834ea92207bc807ac1e49445b62ef8c0f3a

Identifiers

slf4j-api-2.0.9.jar

Description:

The slf4j API

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar
MD5: 45630e54b0f0ac2b3c80462515ad8fda
SHA1: 7cf2726fdcfbc8610f9a71fb3ed639871f315340
SHA256:0818930dc8d7debb403204611691da58e49d42c50b6ffcfdce02dadb7c3c2b6c

Identifiers

slf4j-nop-1.7.36.jar

Description:

SLF4J NOP Binding

File Path: /home/runner/.m2/repository/org/slf4j/slf4j-nop/1.7.36/slf4j-nop-1.7.36.jar
MD5: 3e75636a9ddc51bd87782a3ea2313209
SHA1: a3c1eb685d59414527faa93623acae311c184032
SHA256:c214958b07816cb4412b30c7bdbd4308ffdc6ba2a83767b8f3a9229cbd9274d6

Identifiers

spec.alpha-0.3.218.jar

Description:

Specification of data and functions

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/spec.alpha/0.3.218/spec.alpha-0.3.218.jar
MD5: ecdbb58e7a95163c1369ef9fa054013d
SHA1: a7dad492f8d6cf657d82dcd6b31bda0899f1ac0e
SHA256:67ec898eb55c66a957a55279dd85d1376bb994bd87668b2b0de1eb3b97e8aae0

Identifiers

tools-convenience-1.0.142.jar

Description:

Convenience fns for tools.build scripts

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/runner/.m2/repository/com/github/pmonks/tools-convenience/1.0.142/tools-convenience-1.0.142.jar
MD5: 6b62c5c5b46df7e44f367b69c5ba8ecf
SHA1: 80c16ce1b9ecb8de1b3654566a6a31a9b5ce36f9
SHA256:5e426e4b48b6b1b3af8ce7aaa8aba3a93adeb521b00629647f08e29f89e8d5ff

Identifiers

tools.analyzer-1.1.0.jar

Description:

An analyzer for Clojure code, written in Clojure and producing AST in EDN

File Path: /home/runner/.m2/repository/org/clojure/tools.analyzer/1.1.0/tools.analyzer-1.1.0.jar
MD5: 2b5104ad396a2ac87dae57cde9c933c2
SHA1: 692882a35d7b50947d6e4852fba8a51d8d5e3646
SHA256:1368b6bc3bddf7c398d5784d10548f44c4ed2d7c01ea105ac0efde9cf5e0df21

Identifiers

tools.analyzer.jvm-1.2.2.jar

Description:

Additional jvm-specific passes for tools.analyzer

File Path: /home/runner/.m2/repository/org/clojure/tools.analyzer.jvm/1.2.2/tools.analyzer.jvm-1.2.2.jar
MD5: 9921397e0605c6c44ccc1245e863ff06
SHA1: 449691b55d7d526258ce02c69b4699f2897c494d
SHA256:910cff0238931ed88862cb665a677e95d93e8480f2233200886d331d7ed00e5e

Identifiers

tools.build-0.9.6.jar

File Path: /home/runner/.m2/repository/io/github/clojure/tools.build/0.9.6/tools.build-0.9.6.jar
MD5: a2b756c95e9011c92669e8992c64fe99
SHA1: 61acd8e18bdc07f2354e0db457e7ae768909ee70
SHA256:66d835464dc23b3880c98358c00bed09593b918c0657aa343348a23278a43fc7

Identifiers

tools.cli-1.0.214.jar

File Path: /home/runner/.m2/repository/org/clojure/tools.cli/1.0.214/tools.cli-1.0.214.jar
MD5: 5cc8e3861adeb0e3eefadcf0a2e41750
SHA1: 0f97ee19649fd751043d325ef06fc70ecebf947e
SHA256:ee1e224e8c00bfac21b76b520b70f9585d278f86a5d7ac0c7a55e91adf0f4ea3

Identifiers

tools.deps-0.18.1354.jar

File Path: /home/runner/.m2/repository/org/clojure/tools.deps/0.18.1354/tools.deps-0.18.1354.jar
MD5: 632d749884394877fd94d720fc788ff5
SHA1: d7d99d16383564f2088c700c9b1c801f26f176ce
SHA256:a781653c7f2d85b3c316d0133f90be36c5cf495d42822459e060f3b1deaf4082

Identifiers

tools.gitlibs-2.5.197.jar

File Path: /home/runner/.m2/repository/org/clojure/tools.gitlibs/2.5.197/tools.gitlibs-2.5.197.jar
MD5: 4bf42bf7541a445e7083f5c7477b9e9e
SHA1: d381e5ef0b6312e229a340dc1c5f90217920e8a1
SHA256:260fe1ba0669d9ed318a2ead26424c734e4d1ff11fab90f5fb33b89f99032886

Identifiers

tools.logging-1.2.4.jar

File Path: /home/runner/.m2/repository/org/clojure/tools.logging/1.2.4/tools.logging-1.2.4.jar
MD5: 0c96fb5aa6fc3a19e3a8fd9456968780
SHA1: 3a85764aa30c434a5b0375a2ee72924aa040fa66
SHA256:46fe0a3cd0234980be7fed8e437b1de107beaea4953194be8f71ba3b048f1929

Identifiers

tools.namespace-1.4.4.jar

File Path: /home/runner/.m2/repository/org/clojure/tools.namespace/1.4.4/tools.namespace-1.4.4.jar
MD5: da2a1c4ddd1a8aef9a70355339ef3fbd
SHA1: ba1078e3fe6ebc33119a7c09722afa9f708aef1f
SHA256:047868fd64d54cb0976b82a5452b80373dedd30a300bbb55ce339418abd86305

Identifiers

tools.reader-1.3.6.jar

Description:

A Clojure reader in Clojure

License:

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php
File Path: /home/runner/.m2/repository/org/clojure/tools.reader/1.3.6/tools.reader-1.3.6.jar
MD5: 352308dd69677e1354f81ce61647139d
SHA1: 927809dcb44fa726e4969d993e3e733636d95ebb
SHA256:11d1b31f2c65c3355b292bb9b44b8fcafda54b44da63e34ab97b79a8ab3bb8e0

Identifiers

xml-in-0.1.1.jar

Description:

your friendly XML navigator

License:

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/runner/.m2/repository/tolitius/xml-in/0.1.1/xml-in-0.1.1.jar
MD5: 754502ef9d8c1574d6d893b22f6101dc
SHA1: 0a68865842a0fa7484bca3a7be33f182d8213a97
SHA256:43ab632812fe03b86b1a154723d809bb393e11a0ff0e6677167f14ece40f5543

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.