From 332392b7bafe129c830ed06fc07375d5b89f3a3c Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 18 Jan 2014 16:13:39 -0500 Subject: [PATCH] Added sample report to site Former-commit-id: 83a931b4cbdb541d1aa76ced0d0a0d620fa16be6 --- src/site/resources/SampleReport.html | 8824 ++++++++++++++++++++++++++ 1 file changed, 8824 insertions(+) create mode 100644 src/site/resources/SampleReport.html diff --git a/src/site/resources/SampleReport.html b/src/site/resources/SampleReport.html new file mode 100644 index 000000000..75a2b1409 --- /dev/null +++ b/src/site/resources/SampleReport.html @@ -0,0 +1,8824 @@ + + + + + + + + Dependency-Check Report + + + + + + + + + +
+

Dependency-Check Report

+ +

Project: Sample Application

+
+ + Scan Information (more):
+
    +
  • dependency-check version: 1.1.0-SNAPSHOT
  • +
  • Report Generated On: Jan 18, 2014 3:48:19 PM
  • +
  • Dependencies Scanned: 89
  • +
  • Vulnerable Dependencies: 17
  • +
  • ...
  • +
  • NVD CVE 2002: 17/01/2014 10:12:08
  • +
  • NVD CVE 2003: 17/01/2014 09:26:25
  • +
  • NVD CVE 2004: 17/01/2014 09:14:34
  • +
  • NVD CVE 2005: 17/01/2014 08:55:34
  • +
  • NVD CVE 2006: 17/01/2014 08:29:28
  • +
  • NVD CVE 2007: 17/01/2014 07:50:24
  • +
  • NVD CVE 2008: 17/01/2014 07:10:02
  • +
  • NVD CVE 2009: 17/01/2014 06:28:34
  • +
  • NVD CVE 2010: 17/01/2014 05:56:24
  • +
  • NVD CVE 2011: 17/01/2014 05:12:40
  • +
  • NVD CVE 2012: 17/01/2014 04:33:24
  • +
  • NVD CVE 2013: 17/01/2014 03:47:00
  • +
  • NVD CVE 2014: 17/01/2014 03:00:54
  • +
  • NVD CVE Modified: 18/01/2014 14:08:55
  • +
  • NVD CVE test: 31/12/1969 19:00:01
  • +

+ Dependency Display: show all

+ +

Dependencies

+

activation-1.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\activation-1.1.jar
+ MD5: 8AE38E87CD4F86059C0294A8FE3E0B18
+ SHA1: E6CB541461C2834BDEA3EB920F1884D1EB508B50 +

+ + + +

Identifiers

+
+ +
+
+

annogen-0.1.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\annogen-0.1.0.jar
+ MD5: FF275C3491AC6715AD9F6C22A9660503
+ SHA1: A8DE34EA7AA93765D24DC16EC9C61AF5160BB899 +

+ + + + + +

Identifiers

+
+
  • None
+
+
+

ant-1.7.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\ant-1.7.0.jar
+ MD5: 133E8979E9C11450F557CA890177FE0A
+ SHA1: 9746AF1A485E50CF18DCB232489032A847067066 +

+ + + +

Identifiers

+
+ +
+
+

ant-launcher-1.7.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\ant-launcher-1.7.0.jar
+ MD5: E0C8B3F9390A5D784BBDB6A21F2ABD1D
+ SHA1: E7E30789211E074AA70EF3EAEA59BD5B22A7FA7A +

+ + + +

Identifiers

+
+ +
+
+

aopalliance-1.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\aopalliance-1.0.jar
+ MD5: 04177054E180D09E3998808EFA0401C7
+ SHA1: 0235BA8B489512805AC13A8F9EA77A1CA5EBE3E8 +

+ + + +

Identifiers

+
+ +
+
+

axiom-api-1.2.7.jar

+
+

Description: The Axiom API

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\axiom-api-1.2.7.jar
+ MD5: B06E716D6E5C3A0E3289D28126D01121
+ SHA1: AA260A5F3FCAEE3B95B551A9BBCBE63F56E5A2AD +

+ + + +

Identifiers

+
+ +
+
+

axiom-dom-1.2.7.jar

+
+

Description: The Axiom DOM implementation.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\axiom-dom-1.2.7.jar
+ MD5: 9D1FF1229A42B8A93FC1DB8C349CE830
+ SHA1: 34F6D22244963BC617F3971A826104162EEF1DA4 +

+ + + +

Identifiers

+
+ +
+
+

axiom-impl-1.2.7.jar

+
+

Description: The Axiom default implementation.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\axiom-impl-1.2.7.jar
+ MD5: B58763085089FE3D4D106386323CCD63
+ SHA1: 378B814D1A6129A3E8175D95CF60D48C60AE9D51 +

+ + + +

Identifiers

+
+ +
+
+

axis-1.4.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\axis-1.4.jar
+ MD5: 03DCFDD88502505CC5A805A128BFDD8D
+ SHA1: 94A9CE681A42D0352B3AD22659F67835E560D107 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2012-5784  

+

Severity: + Medium +
CVSS Score: 5.8 +
CWE: CWE-20 Improper Input Validation +

+

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. +

+

+

Vulnerable Software & Versions:

+
+
+

axis2-kernel-1.4.1.jar

+
+

Description: Core Parts of Axis 2.0. This includes Axis 2.0 engine, Client API, Addressing support, etc., +

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\axis2-kernel-1.4.1.jar
+ MD5: F5F5255626BE01918CECE10D14F937DF
+ SHA1: FD59331A4BBC734C290744316E627EA343329F49 +

+ + + + + +

Identifiers

+
+ +
+ +
+

CVE-2012-5785  

+

Severity: + Medium +
CVSS Score: 5.8 +
CWE: CWE-20 Improper Input Validation +

+

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-2103  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-1632  

+

Severity: + High +
CVSS Score: 7.5 +
CWE: CWE-20 Improper Input Validation +

+

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-0219  

+

Severity: + High +
CVSS Score: 10.0 +
CWE: CWE-255 Credentials Management +

+

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. +

+

+

Vulnerable Software & Versions:

+
+
+

backport-util-concurrent-3.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\backport-util-concurrent-3.1.jar
+ MD5: 748BB0CBF4780B2E3121DC9C12E10CD9
+ SHA1: 682F7AC17FED79E92F8E87D8455192B63376347B +

+ + + +

Identifiers

+
+ +
+
+

commons-cli-1.2.jar

+
+

Description:  + Commons CLI provides a simple API for presenting, processing and validating a command line interface. +

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-cli-1.2.jar
+ MD5: BFDCAE1FF93F0C07D733F03BDCE28C9E
+ SHA1: 2BF96B7AA8B611C177D329452AF1DC933E14501C +

+ + + +

Identifiers

+
+ +
+
+

commons-codec-1.2.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-codec-1.2.jar
+ MD5: 2617B220009F952BB9542AF167D040CF
+ SHA1: 397F4731A9F9B6EB1907E224911C77EA3AA27A8B +

+ + + +

Identifiers

+
+ +
+
+

commons-fileupload-1.2.1.jar

+
+

Description:  + The FileUpload component provides a simple yet flexible means of adding support for multipart + file upload functionality to servlets and web applications. +

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-fileupload-1.2.1.jar
+ MD5: 951B36984148FC4F4E901F06AB382273
+ SHA1: 384FAA82E193D4E4B0546059CA09572654BC3970 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2013-0248  

+

Severity: + Low +
CVSS Score: 3.3 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack. +

+

+

Vulnerable Software & Versions:

+
+
+

commons-httpclient-3.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-httpclient-3.1.jar
+ MD5: 8AD8C9229EF2D59AB9F59F7050E846A5
+ SHA1: 964CD74171F427720480EFDEC40A7C7F6E58426A +

+ + + +

Identifiers

+
+
    +
  • maven: commons-httpclient:commons-httpclient:3.1 +   Confidence:HIGHEST +
  • +
  • cpe: cpe:/a:apache:commons-httpclient:3.1 +   Confidence:LOW +    +
  • +
  • cpe: cpe:/a:apache:httpclient:3.1 +   Confidence:LOW +    +
  • +
+
+
+

commons-validator-1.4.0.jar

+
+

Description:  + Commons Validator provides the building blocks for both client side validation and server side data validation. + It may be used standalone or with a framework like Struts. +

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-validator-1.4.0.jar
+ MD5: 8F381C168688704A85C550CF343A5CA2
+ SHA1: 42FA1046955ADE59F5354A1876CFC523CEA33815 +

+ + + +

Identifiers

+
+ +
+
+

data.zip

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\data.zip
+ MD5: C3CF69C4F564283D27BFD11866891BD3
+ SHA1: B1962018C35BEBB2C2C63A82704751A45C09FAF0 +

+ + + +

Identifiers

+
+
  • None
+
+
+

daytrader-ear-2.1.7.ear

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear
+ MD5: 9FA8C4E8072904589FC0D1A12E8EB291
+ SHA1: 61868609EB138C41C0298373C9F8C19713FEFA54 +

+ + + +

Identifiers

+
+
  • None
+
+
+

daytrader-ear-2.1.7.ear\dt-ejb.jar

+
+

Description: Daytrader EJBs

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\dt-ejb.jar
+ MD5: 26E92DBACAD11C73F03EDE043B113653
+ SHA1: F2F7C05243EC8E5FB93EFB35F5908BBA88651BF3 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2011-5034  

+

Severity: + High +
CVSS Score: 7.8 +
CWE: CWE-20 Improper Input Validation +

+

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461. +

+

+

Vulnerable Software & Versions:

+
+
+

daytrader-ear-2.1.7.ear\geronimo-jaxrpc_1.1_spec-2.0.0.jar

+
+

Description: Provides open-source implementations of Sun specifications.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\geronimo-jaxrpc_1.1_spec-2.0.0.jar
+ MD5: 89B6273486A7C78353D919941F9F843C
+ SHA1: 4FAD4B521E38EF8D9A2434A2421A9A1DC7910285 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2011-5034  

+

Severity: + High +
CVSS Score: 7.8 +
CWE: CWE-20 Improper Input Validation +

+

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5797  

+

Severity: + High +
CVSS Score: 7.5 +
CWE: CWE-287 Improper Authentication +

+

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-4548  

+

Severity: + High +
CVSS Score: 10.0 +
CWE: CWE-287 Improper Authentication +

+

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module. +

+

+

Vulnerable Software & Versions:

+
+
+

daytrader-ear-2.1.7.ear\streamer.jar

+
+

Description: Streamer Application for Day Trader

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\streamer.jar
+ MD5: 5BC6DE1A34935D20331EF777463FD28B
+ SHA1: EC631C926AB667182840B3E5E32BD3D2F8A808AC +

+ + + +

Identifiers

+
+ +
+
+

daytrader-ear-2.1.7.ear\web.war

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\web.war
+ MD5: 857655BB1DDB4204F09D63E5CA8C56BC
+ SHA1: 7A7455F5D78BB4E1B8E66CD3E6C1F964D18705F9 +

+ + + +

Identifiers

+
+
  • None
+
+
+

daytrader-ear-2.1.7.ear\wsappclient.jar

+
+

Description: Client demonstrating Web Services

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\wsappclient.jar
+ MD5: C343646C162FDD19156400FE83F41CE2
+ SHA1: ECE01974BE048BA75E2B344C39EFB176915A1C16 +

+ + + +

Identifiers

+
+ +
+
+

dojo-war-1.3.0.war

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\dojo-war-1.3.0.war
+ MD5: CD00CB6BC15004638548148A21D799AA
+ SHA1: 36572B4E096421BECAB9346DA41BBC4EC1316A54 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2010-2276  

+

Severity: + High +
CVSS Score: 10.0 +
CWE: CWE-16 Configuration +

+

The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-2275  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-2274  

+

Severity: + Medium +
CVSS Score: 4.3 +

+

Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-2273  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-2376  

+

Severity: + Medium +
CVSS Score: 5.0 +

+

The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking." +

+

+

Vulnerable Software & Versions:

+
+
+

ehcache-core-2.2.0.jar

+
+

Description: This is the ehcache core module. Pair it with other modules for added + functionality. +

+

+ License:

The Apache Software License, Version 2.0: src/assemble/LICENSE.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\ehcache-core-2.2.0.jar
+ MD5: 2C95E83B612691BA2A54E0C56CB9177F
+ SHA1: C3FBA1F00073A38D370990CE7D8B5D4F9B05A11A +

+ + + +

Identifiers

+
+ +
+
+

file.tar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\file.tar
+ MD5: 14BBD058FE7ACFD79E6DA6321F72BFB7
+ SHA1: 2A084055AC2AB180A7D9DED265E9504BF3AA856A +

+ + + + + +

Identifiers

+
+
    +
  • cpe: cpe:/a:file:file:- +   Confidence:LOW +    +
  • +
+
+
+

freemarker-2.3.12.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\freemarker-2.3.12.jar
+ MD5: 719554BBC3D8A98582A8A93328134FE2
+ SHA1: 3501B670AA7E3822DDF7693082F621B1CD8CE086 +

+ + + + + +

Identifiers

+
+
  • None
+
+
+

geronimo-javamail_1.4_spec-1.2.jar

+
+

Description: Provides open-source implementations of Sun specifications.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\geronimo-javamail_1.4_spec-1.2.jar
+ MD5: F9F0465816F2DB5FA9F409FB1D9700C8
+ SHA1: 0F6B07582A3D6BA452B10527FB508809AFF8B353 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2011-5034  

+

Severity: + High +
CVSS Score: 7.8 +
CWE: CWE-20 Improper Input Validation +

+

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461. +

+

+

Vulnerable Software & Versions:

+
+
+

geronimo-jms_1.1_spec-1.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\geronimo-jms_1.1_spec-1.1.jar
+ MD5: 10E163BDD905D1C16D7E1C48427B5853
+ SHA1: BBD68F90D445DE37050B1E9FB9D7114E83757E73 +

+ + + +

Identifiers

+
+ +
+
+

geronimo-stax-api_1.0_spec-1.0.1.jar

+
+

Description: Provides open-source implementations of Sun specifications.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\geronimo-stax-api_1.0_spec-1.0.1.jar
+ MD5: B7C2A715CD3D1C43DC4CCFAE426E8E2E
+ SHA1: 1C171093A8B43AA550C6050AC441ABE713EBB4F2 +

+ + + + + +

Identifiers

+
+ +
+ +
+

CVE-2008-0732  

+

Severity: + Low +
CVSS Score: 2.1 +
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following') +

+

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories. +

+

+

Vulnerable Software & Versions:

+
+
+

hazelcast-2.5.jar

+
+

Description: Hazelcast In-Memory DataGrid

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\hazelcast-2.5.jar
+ MD5: CECB9F89CF60F8947451F620E542CBC8
+ SHA1: 3614FA9E42E8CD4D124CA37A2EDB36D0E926959D +

+ + + +

Identifiers

+
+ +
+
+

httpcore-4.0-beta1.jar

+
+

Description:  + HttpComponents Core (Java 1.3 compatible) +

+

+ License:

Apache License: ../LICENSE.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\httpcore-4.0-beta1.jar
+ MD5: 7515CFFF71E32CE55D5BA6B73251D93A
+ SHA1: C642A5F7C20539840957584B1AF2AD798CD1BA52 +

+ + + +

Identifiers

+
+ +
+
+

httpcore-nio-4.0-beta1.jar

+
+

Description:  + HttpComponents Core (NIO extensions) +

+

+ License:

Apache License: ../LICENSE.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\httpcore-nio-4.0-beta1.jar
+ MD5: 926965BC84B5F5F138DF66DDD05BAED0
+ SHA1: A0D825BEAA0BC0B03FCF11315ABC4B7FD60FE2E8 +

+ + + +

Identifiers

+
+ +
+
+

jaxb-xercesImpl-1.5.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\jaxb-xercesImpl-1.5.jar
+ MD5: 8CD074364C830FC8FF40A8A19C0A74C8
+ SHA1: 73A51FAADB407DCCDBD77234E0D5A0A648665692 +

+ + + + + +

Identifiers

+
+
  • None
+
+
+

jaxen-1.1.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\jaxen-1.1.1.jar
+ MD5: 261D1AA59865842ECC32B3848B0C6538
+ SHA1: 9F5D3C5974DBE5CF69C2C2EC7D8A4EB6E0FCE7F9 +

+ + + +

Identifiers

+
+ +
+
+

jetty-6.1.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\jetty-6.1.0.jar
+ MD5: 121A72B1DEA1A9ADF83079A44CA08E7B
+ SHA1: FB39EBC0CDCCEA6B54AD87D229A352A894EEBECC +

+ + + + + +

Identifiers

+
+ +
+ +
+

CVE-2011-4461  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-310 Cryptographic Issues +

+

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-4612  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-4611  

+

Severity: + High +
CVSS Score: 7.5 +
CWE: CWE-20 Improper Input Validation +

+

Mort Bay Jetty 6.x and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-4610  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-4609  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-200 Information Exposure +

+

The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-1524  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-1523  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +

+

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5615  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5614  

+

Severity: + High +
CVSS Score: 7.5 +

+

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5613  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies. +

+

+

Vulnerable Software & Versions:

+
+
+

mail-1.4.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\mail-1.4.jar
+ MD5: 2E64A3805D543BDB86E6E5EECA5529F8
+ SHA1: 1AA1579AE5ECD41920C4F355B0A9EF40B68315DD +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2007-6059  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-399 Resource Management Errors +

+

** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products." +

+

+

Vulnerable Software & Versions:

+
+
+

maven-scm-api-1.8.1.jar

+
+

Description: The SCM API provides mechanisms to manage all SCM tools.

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\maven-scm-api-1.8.1.jar
+ MD5: C409FC1A6C9BAF928CC37B2FFB852C83
+ SHA1: D72BCDC54A873E8BFBC53FDE6200E53911C3D9FE +

+ + + +

Identifiers

+
+ +
+
+

maven-scm-provider-cvs-commons-1.8.1.jar

+
+

Description: Common library for SCM CVS Provider.

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\maven-scm-provider-cvs-commons-1.8.1.jar
+ MD5: 7D35F493A22226B821B5D5363E85765C
+ SHA1: 97411239D474ECAFCC2AB89FACAF2593EB0DE49B +

+ + + + + +

Identifiers

+
+
  • None
+
+
+

maven-scm-provider-cvsexe-1.8.1.jar

+
+

Description: Executable implementation for SCM CVS Provider.

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\maven-scm-provider-cvsexe-1.8.1.jar
+ MD5: 8900ABE1192B79B35AEDB0F683A8B412
+ SHA1: 5C7BF6D2C741885D2A6C17CB044FF8E2966F69CA +

+ + + + + +

Identifiers

+
+
  • None
+
+
+

neethi-2.0.4.jar

+
+

Description: Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.

+

+ License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\neethi-2.0.4.jar
+ MD5: 3F0948A3B1316DFC94F9ABCE02DA8901
+ SHA1: C5BBF05C56EF0D68EEC17A7EB1ED9241052FD763 +

+ + + +

Identifiers

+
+ +
+
+

ognl-2.6.11.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\ognl-2.6.11.jar
+ MD5: 1173EC5F8B1F6FB1473F4546D4B83BBA
+ SHA1: 0C3F31F4A65461C44E6697BF29070E638BEF09D8 +

+ + + +

Identifiers

+
+ +
+
+

org.mortbay.jetty.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\org.mortbay.jetty.jar
+ MD5: 8ABFD9EF03680C5B9B418ABD918CE525
+ SHA1: 7B11E767B884D5B872310CE390219B59FFD64A1E +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2011-4461  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-310 Cryptographic Issues +

+

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-1524  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character. +

+

+

Vulnerable Software & Versions:

+

CVE-2009-1523  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +

+

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5615  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5614  

+

Severity: + High +
CVSS Score: 7.5 +

+

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors. +

+

+

Vulnerable Software & Versions:

+

CVE-2007-5613  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies. +

+

+

Vulnerable Software & Versions:

+

CVE-2005-3747  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-200 Information Exposure +

+

Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758. +

+

+

Vulnerable Software & Versions:

+
+
+

org.mortbay.jmx.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\org.mortbay.jmx.jar
+ MD5: 82D35B88A6CAECB9AD5CC8A0CA2C6C81
+ SHA1: 938031AFDF33D3C5FEE6077312FB44BE25A9725C +

+ + + + + +

Identifiers

+
+
  • None
+
+
+

plexus-utils-3.0.7.jar

+
+

Description: A collection of various utility classes to ease working with strings, files, command lines, XML and more.

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\plexus-utils-3.0.7.jar
+ MD5: C22B393490A46DA89D91DD6322446E40
+ SHA1: EB10E9CB2B2326FBF0CB68249B10A5C89E0642EF +

+ + + +

Identifiers

+
+ +
+
+

regexp-1.3.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\regexp-1.3.jar
+ MD5: 6DCDC325850E40B843CAC2A25FB2121E
+ SHA1: 973DF2B78B67BCD3144C3DBBB88DA691065A3F8D +

+ + + +

Identifiers

+
+ +
+
+

servlet-api-2.5.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\servlet-api-2.5.jar
+ MD5: 69CA51AF4E9A67A1027A7F95B52C3E8F
+ SHA1: 5959582D97D8B61F4D154CA9E495AAFD16726E34 +

+ + + +

Identifiers

+
+ +
+
+

slf4j-api-1.5.11.jar

+
+

Description: The slf4j API

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\slf4j-api-1.5.11.jar
+ MD5: 30CB7BEE9B52FCB5F5B03D2A006E26E8
+ SHA1: D6A855B608971025B4FBB0970F829391CC6F727A +

+ + + +

Identifiers

+
+ +
+
+

spring-core-2.5.5.jar

+
+

Description: Spring Framework

+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\spring-core-2.5.5.jar
+ MD5: 05432EF3BF4EFA1394B127563CB1DD8C
+ SHA1: 1B3B0FAD8E30EBB9560A81989F5B5BFB28915109 +

+ + + + + +

Identifiers

+
+ +
+ +
+

CVE-2011-2730  

+

Severity: + High +
CVSS Score: 7.5 +
CWE: CWE-16 Configuration +

+

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection." +

+

+

Vulnerable Software & Versions:

+

CVE-2010-1622  

+

Severity: + Medium +
CVSS Score: 5.1 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file. +

+

+

Vulnerable Software & Versions:

+
+
+

spring-core-3.0.0.RELEASE.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\spring-core-3.0.0.RELEASE.jar
+ MD5: 2D52A505F093291E4A2C7E1A28F34557
+ SHA1: 4F268922155FF53FB7B28AECA24FB28D5A439D95 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2011-2894  

+

Severity: + Medium +
CVSS Score: 6.8 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class. +

+

+

Vulnerable Software & Versions:

+

CVE-2011-2730  

+

Severity: + High +
CVSS Score: 7.5 +
CWE: CWE-16 Configuration +

+

VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection." +

+

+

Vulnerable Software & Versions:

+

CVE-2010-1622  

+

Severity: + Medium +
CVSS Score: 5.1 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file. +

+

+

Vulnerable Software & Versions:

+
+
+

struts.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\struts.jar
+ MD5: AA4AE098EC87FBCD6591402E5CBD781A
+ SHA1: F69E6119EB01F9AD064BD358ED0315618FB1CB5C +

+ + + + + +

Identifiers

+
+ +
+ +
+

CVE-2008-2025  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters." +

+

+

Vulnerable Software & Versions:

+

CVE-2006-1548  

+

Severity: + Medium +
CVSS Score: 4.3 +

+

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message. +

+

+

Vulnerable Software & Versions:

+

CVE-2006-1547  

+

Severity: + High +
CVSS Score: 7.8 +

+

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils. +

+

+

Vulnerable Software & Versions:

+

CVE-2006-1546  

+

Severity: + High +
CVSS Score: 7.5 +

+

Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check. +

+

+

Vulnerable Software & Versions:

+

CVE-2005-3745  

+

Severity: + Medium +
CVSS Score: 4.3 +

+

Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message. +

+

+

Vulnerable Software & Versions:

+
+
+

struts2-core-2.1.2.jar

+
+

Description: Apache Struts 2

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\struts2-core-2.1.2.jar
+ MD5: C30B57142E1CCBC1EFD5CD15F307358F
+ SHA1: 89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2013-4316  

+

Severity: + High +
CVSS Score: 10.0 +
CWE: CWE-16 Configuration +

+

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-4310  

+

Severity: + Medium +
CVSS Score: 5.8 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-2251  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-20 Improper Input Validation +

+

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-2248  

+

Severity: + Medium +
CVSS Score: 5.8 +
CWE: CWE-20 Improper Input Validation +

+

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-2135  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-2134  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-2115  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-1966  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. +

+

+

Vulnerable Software & Versions:

+

CVE-2013-1965  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect. +

+

+

Vulnerable Software & Versions:

+

CVE-2012-4387  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression. +

+

+

Vulnerable Software & Versions:

+

CVE-2012-4386  

+

Severity: + Medium +
CVSS Score: 6.8 +
CWE: CWE-352 +

+

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute. +

+

+

Vulnerable Software & Versions:

+

CVE-2012-0838  

+

Severity: + High +
CVSS Score: 10.0 +
CWE: CWE-20 Improper Input Validation +

+

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field. +

+

+

Vulnerable Software & Versions:

+

CVE-2012-0394  

+

Severity: + Medium +
CVSS Score: 6.8 +
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection') +

+

** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself." +

+

+

Vulnerable Software & Versions:

+

CVE-2012-0393  

+

Severity: + Medium +
CVSS Score: 6.4 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. +

+

+

Vulnerable Software & Versions:

+

CVE-2012-0392  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. +

+

+

Vulnerable Software & Versions:

+

CVE-2012-0391  

+

Severity: + High +
CVSS Score: 9.3 +
CWE: CWE-20 Improper Input Validation +

+

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter. +

+

+

Vulnerable Software & Versions:

+

CVE-2011-5057  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor." +

+

+

Vulnerable Software & Versions:

+

CVE-2011-2087  

+

Severity: + Medium +
CVSS Score: 4.3 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java. +

+

+

Vulnerable Software & Versions:

+

CVE-2011-1772  

+

Severity: + Low +
CVSS Score: 2.6 +
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +

+

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element. +

+

+

Vulnerable Software & Versions:

+

CVE-2010-1870  

+

Severity: + Medium +
CVSS Score: 5.0 +

+

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504. +

+

+

Vulnerable Software & Versions:

+
+
+

test.zip

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\test.zip
+ MD5: 0F6467C8BCDD13071EAE47B60428814A
+ SHA1: E7DD6959DB16462CC4ABC26AC122EAC69F56FD3E +

+ + + +

Identifiers

+
+
  • None
+
+
+

velocity-1.7.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\velocity-1.7.jar
+ MD5: 3692DD72F8367CB35FB6280DC2916725
+ SHA1: 2CEB567B8F3F21118ECDEC129FE1271DBC09AA7A +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war
+ MD5: 54070E31AA8E6256EA8C850642A3C434
+ SHA1: EAEDE5596599912D70CB9B517CB87FFF336A8422 +

+ + + +

Identifiers

+
+
  • None
+
+
+

war-4.0.war\commons-fileupload-1.1.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\commons-fileupload-1.1.1.jar
+ MD5: ADB15D9A4DA4A30D77E88B32A45CBDDB
+ SHA1: D587A50727BA905AAD13DE9EA119081403BF6823 +

+ + + +

Identifiers

+
+ +
+ +
+

CVE-2013-0248  

+

Severity: + Low +
CVSS Score: 3.3 +
CWE: CWE-264 Permissions, Privileges, and Access Controls +

+

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack. +

+

+

Vulnerable Software & Versions:

+
+
+

war-4.0.war\commons-io-1.3.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\commons-io-1.3.1.jar
+ MD5: 2E55C05D3386889AF97CAAE4517AC9DF
+ SHA1: B90B6AC57CF27A2858EAA490D02BA7945D18CA7B +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war\console-core-4.0.jar

+
+

Description: Java.net - The Source for Java Technology Collaboration

+

+ License:

http://glassfish.java.net/nonav/public/CDDL+GPL.html
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\lib\console-core-4.0.jar
+ MD5: 34989EF1706408666EE87EEC5B55C09B
+ SHA1: 165C3DF4D1EDE6F2850E44730CB547DCFDB45A08 +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war\dojo-ajax-nodemo-0.4.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\dojo-ajax-nodemo-0.4.1.jar
+ MD5: 91FDA9E8B3C95EEE6F566567CF790A9E
+ SHA1: 0E77D6BB7687A7084A1B92DA563DFDA6324BA83F +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war\json-1.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\json-1.0.jar
+ MD5: A7AA9A187CB901EC6E299F65F583F140
+ SHA1: 0FE8CE55B9F83F16185192821A385916B0EEF38E +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war\prototype-1.5.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\prototype-1.5.0.jar
+ MD5: 206BD786024ECA29E41A12E44C055C0A
+ SHA1: B02B002F0E9BB289B311DB49C561C58AFB8EB58C +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war\webui-jsf-4.0.2.10.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-4.0.2.10.jar
+ MD5: 411E6E13BC190D58E10337E502371CFC
+ SHA1: 977A6FA7F65F8EA68101AA1252C05E8193DE97B5 +

+ + + +

Identifiers

+
+ +
+
+

war-4.0.war\webui-jsf-suntheme-4.0.2.10.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-suntheme-4.0.2.10.jar
+ MD5: 62A5F094E9832DCE2A7CE138DFEE3507
+ SHA1: 4EC663AE9AB37D9D6504DC5754E1E59D36D2CD9E +

+ + + +

Identifiers

+
+ +
+
+

woden-api-1.0M8.jar

+
+

Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\woden-api-1.0M8.jar
+ MD5: FFA59063E09EE05D3F588ADC0DCE97BF
+ SHA1: E15D817DC457976E9AB5ED5B92E14C6F0FF4BCC9 +

+ + + +

Identifiers

+
+ +
+
+

woden-impl-dom-1.0M8.jar

+
+

Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.

+

+ License:

http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\woden-impl-dom-1.0M8.jar
+ MD5: 6CEFBDE48CF35F36AE20F72B6E58A30A
+ SHA1: A8F543456FC71426E62D003DADF3004B198ACEAF +

+ + + +

Identifiers

+
+ +
+
+

wsdl4j-1.6.2.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\wsdl4j-1.6.2.jar
+ MD5: 2608A8EA3F07B0C08DE8A7D3D0D3FC09
+ SHA1: DEC1669FB6801B7328E01AD72FC9E10B69EA06C1 +

+ + + +

Identifiers

+
+ +
+
+

wstx-asl-3.2.4.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\wstx-asl-3.2.4.jar
+ MD5: F3FAC27A7387452F1C4243C695FA0F0D
+ SHA1: AADA03A08AE547BEE92CAF3B1E0CD756134E9226 +

+ + + +

Identifiers

+
+ +
+
+

xalan-2.7.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\xalan-2.7.0.jar
+ MD5: A018D032C21A873225E702B36B171A10
+ SHA1: A33C0097F1C70B20FA7DED220EA317EB3500515E +

+ + + +

Identifiers

+
+ +
+
+

xercesImpl-2.8.1.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\xercesImpl-2.8.1.jar
+ MD5: E86F321C8191B37BD720FF5679F57288
+ SHA1: 25101E37EC0C907DB6F0612CBF106EE519C1AEF1 +

+ + + +

Identifiers

+
+ +
+
+

xml-apis-1.3.04.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\xml-apis-1.3.04.jar
+ MD5: 9AE9C29E4497FC35A3EADE1E6DD0BBEB
+ SHA1: 90B215F48FE42776C8C7F6E3509EC54E84FD65EF +

+ + + +

Identifiers

+
+ +
+
+

xmlParserAPIs-2.6.0.jar

+
+

+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\xmlParserAPIs-2.6.0.jar
+ MD5: 2651F9F7C39E3524F3E2C394625AC63A
+ SHA1: 065ACEDE1E5305BD2B92213D7B5761328C6F4FD9 +

+ + + +

Identifiers

+
+ +
+
+

XmlSchema-1.4.2.jar

+
+

Description: Commons XMLSchema is a light weight schema object model that can be used to manipualte or + generate a schema. It has a clean, easy to use API and can easily be integrated into an existing project + since it has almost no dependancies on third party libraries.

+

+ License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\XmlSchema-1.4.2.jar
+ MD5: CED8C8555D4E965CF7CE06459730479A
+ SHA1: 7CF868B0D6A5B68BE0DEA014126B986B3387755A +

+ + + +

Identifiers

+
+ +
+
+

xwork-2.1.1.jar

+
+

Description:  + XWork is an command-pattern framework that is used to power WebWork + as well as other applications. XWork provides an Inversion of Control + container, a powerful expression language, data type conversion, + validation, and pluggable configuration. +

+

+ License:

The OpenSymphony Software License 1.1: src/etc/LICENSE.txt
+ File Path: ..\..\..\..\dependency-check-core\target\test-classes\xwork-2.1.1.jar
+ MD5: FED42FC127540DBBF88FB4EE80A2C039
+ SHA1: E509A9C3A66AE7B26B56CCE0657CA2550AA43512 +

+ + + + + +

Identifiers

+
+ +
+ +
+

CVE-2008-6504  

+

Severity: + Medium +
CVSS Score: 5.0 +
CWE: CWE-20 Improper Input Validation +

+

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character. +

+

+

Vulnerable Software & Versions:

+
+
+
+
+


This report contains data retrieved from the National Vulnerability Database.
+ +