Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
File Path: target\test-classes\annogen-0.1.0.jar
MD5: ff275c3491ac6715ad9f6c22a9660503
SHA1: a8de34ea7aa93765d24dc16ec9c61af5160bb899
File Path: target\test-classes\ant-1.8.2.jar
MD5: 9463f65940f928d650a95aeb057a4e0a
SHA1: fc33bf7cd8c5309dd7b81228e8626515ee42efd9
Description: AOP Alliance
License:
Public DomainFile Path: target\test-classes\aopalliance-1.0.jar
Description: The runtime needed to execute a program using AspectJ
License:
Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.htmlFile Path: target\test-classes\aspectjrt-1.6.5.jar
Description: The AspectJ weaver introduces advices to java classes
License:
Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.htmlFile Path: target\test-classes\aspectjweaver-1.6.5.jar
Description: The Axiom API
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\axiom-api-1.2.7.jar
Description: The Axiom DOM implementation.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\axiom-dom-1.2.7.jar
Description: The Axiom default implementation.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\axiom-impl-1.2.7.jar
Description:
An implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\axis-1.4.jar
Severity:
Medium
CVSS Score: 5.8
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-20 Improper Input Validation
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions: (show all)
Description: Core Parts of Axis 2.0. This includes Axis 2.0 engine, Client API, Addressing support, etc.,
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\axis2-kernel-1.4.1.jar
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-20 Improper Input Validation
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.4
CWE: CWE-287 Improper Authentication
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-287 Improper Authentication
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
CWE: CWE-20 Improper Input Validation
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 10.0
CWE: CWE-255 Credentials Management
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
Vulnerable Software & Versions: (show all)
Description: Dawid Kurzyniec's backport of JSR 166
License:
Public Domain: http://creativecommons.org/licenses/publicdomainFile Path: target\test-classes\backport-util-concurrent-3.1.jar
Description:
Commons CLI provides a simple API for presenting, processing and validating a command line interface.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\commons-cli-1.2.jar
Description: The codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
File Path: target\test-classes\commons-codec-1.2.jar
MD5: 2617b220009f952bb9542af167d040cf
SHA1: 397f4731a9f9b6eb1907e224911c77ea3aa27a8b
Description:
The FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\commons-fileupload-1.2.1.jar
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 3.3
CWE: CWE-264 Permissions, Privileges, and Access Controls
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Vulnerable Software & Versions: (show all)
Description: The HttpClient component supports the client-side of RFC 1945 (HTTP/1.0) and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily.
License:
Apache License: http://www.apache.org/licenses/LICENSE-2.0File Path: target\test-classes\commons-httpclient-3.1.jar
Severity:
Medium
CVSS Score: 5.8
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerable Software & Versions: (show all)
Description: Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems.
File Path: target\test-classes\commons-logging-1.1.1.jar
MD5: ed448347fc0104034aa14c8189bf37de
SHA1: 5043bfebc3db072ed80fbd362e7caf00e885d8ae
Description: Commons Object Pooling Library
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\commons-pool-1.5.3.jar
Description:
Commons Validator provides the building blocks for both client side validation and server side data validation.
It may be used standalone or with a framework like Struts.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\commons-validator-1.4.0.jar
File Path: target\test-classes\daytrader-ear-2.1.7.ear
MD5: 9fa8c4e8072904589fc0d1a12e8eb291
SHA1: 61868609eb138c41c0298373c9f8c19713fefa54
Description: Daytrader EJBs
File Path: target\test-classes\daytrader-ear-2.1.7.ear\dt-ejb.jar
MD5: 26e92dbacad11c73f03ede043b113653
SHA1: f2f7c05243ec8e5fb93efb35f5908bba88651bf3
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\daytrader-ear-2.1.7.ear\geronimo-jaxrpc_1.1_spec-2.0.0.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
CWE: CWE-287 Improper Authentication
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 10.0
CWE: CWE-287 Improper Authentication
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
Vulnerable Software & Versions:
Description: Streamer Application for Day Trader
File Path: target\test-classes\daytrader-ear-2.1.7.ear\streamer.jar
MD5: 5bc6de1a34935d20331ef777463fd28b
SHA1: ec631c926ab667182840b3e5e32bd3d2f8a808ac
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
File Path: target\test-classes\daytrader-ear-2.1.7.ear\web.war
MD5: 857655bb1ddb4204f09d63e5ca8c56bc
SHA1: 7a7455f5d78bb4e1b8e66cd3e6c1f964d18705f9
Description: Client demonstrating Web Services
File Path: target\test-classes\daytrader-ear-2.1.7.ear\wsappclient.jar
MD5: c343646c162fdd19156400fe83f41ce2
SHA1: ece01974be048ba75e2b344c39efb176915a1c16
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
File Path: target\test-classes\dojo-war-1.3.0.war
MD5: cd00cb6bc15004638548148a21d799aa
SHA1: 36572b4e096421becab9346da41bbc4ec1316a54
Severity:
High
CVSS Score: 10.0
CWE: CWE-16 Configuration
The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Vulnerable Software & Versions:
Description: DWR is easy Ajax for Java.
File Path: target\test-classes\dwr-1.1.1.jar
MD5: acf4c23760ecb7377ee5047cd89afc90
SHA1: 52fa2a12084cef04a5ce4e99d6dd63ba3fbf1071
Severity:
Medium
CVSS Score: 5.0
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input."
Vulnerable Software & Versions:
Description: This is the ehcache core module. Pair it with other modules for added
functionality.
License:
The Apache Software License, Version 2.0: src/assemble/LICENSE.txtFile Path: target\test-classes\ehcache-core-2.2.0.jar
File Path: target\test-classes\FileHelpers.2.0.0.0.nupkg
MD5: 0bf948b505852a2af8a597b8a129ef9a
SHA1: 30fb37d6163cf16e3ba740343becdd14d5457619
File Path: target\test-classes\FileHelpers.2.0.0.0.nupkg\FileHelpers.nuspec
MD5: 9e2287f0174bcd79cf7e2427d73a1197
SHA1: d14a722b66388d84ac3b57c4de56e702aa5fea96
File Path: target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\FileHelpers.dll
MD5: 4829fa768de37c315a3a3b7bca027b64
SHA1: a256f622a6209ec21a13d490443ffd6dbda4f5b7
File Path: target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\FileHelpers.ExcelStorage.dll
MD5: d22aeca6ee71a2e6f5b3d296280ba98a
SHA1: e416350e2ee0e0711e2716cf7efce54168accc52
File Path: target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\Interop.Excel.dll
MD5: 728ff3aeae71cbd8d303f442e3843c4c
SHA1: cdaa993485f737951fd91c71f41c929cd06dffa3
File Path: target\test-classes\FileHelpers.2.0.0.0.nupkg\lib\Interop.Office.dll
MD5: 7b55e3bf19775b7a6fa5bf3c271e2c0c
SHA1: eefcfe4b0c90b6f4232d07d588a08bc04fd32e84
Description:
FreeMarker is a "template engine"; a generic tool to generate text output based on templates.
License:
BSD-style license: http://www.freemarker.org/LICENSE.txtFile Path: target\test-classes\freemarker-2.3.12.jar
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\geronimo-javamail_1.4_spec-1.2.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\geronimo-jms_1.1_spec-1.1.1.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Description: Implementation of Sun JSR-317 JPA 2.0 Spec API
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\geronimo-jpa_2.0_spec-1.1.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\geronimo-stax-api_1.0_spec-1.0.1.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Description: Guice is a lightweight dependency injection framework for Java 5 and above
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\guice-3.0.jar
Description: Hazelcast In-Memory DataGrid
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\hazelcast-2.5.jar
File Path: target\test-classes\hibernate3.jar
MD5: b22bbafa38341db968033f1acbfa8dd9
SHA1: 826da9fc452e7009116dffc2d348ba705fe2aa82
Description: C3P0-based implementation of the Hibernate ConnectionProvder contract
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-c3p0/pom.xml
MD5: 301251db8497b5100b7d6e9efb0afc44
SHA1: 55119c84a43a9af05482e077ab241cacd1910d93
Description: Common reflection code used in support of annotation processing
License:
GNU LESSER GENERAL PUBLIC LICENSE: http://www.gnu.org/licenses/lgpl.txtFile Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-commons-annotations/pom.xml
Description: The core functionality of Hibernate
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-core/pom.xml
MD5: bd41ed501d7218dc30403320127372f2
SHA1: 7d8f09aa7d0100318d826625cb42dbc358e07abd
Description: Integration of Hibernate with Ehcache
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-ehcache/pom.xml
MD5: 19610cc4510ae1067e83e910590ca011
SHA1: 9218f8cd87f3e28c49d4947361b4c6f66757cc25
Description: Hibernate Entity Manager
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-entitymanager/pom.xml
MD5: 68c7e92964df6fab1e9082d29a78d9c4
SHA1: 38d087e745fa330ad03fd5ab3e2d029845913de7
Description: Support for entity auditing
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-envers/pom.xml
MD5: 897a79ec7b20d46002f0bbc441ed1ca9
SHA1: 02094fd8813c1b0b43b0e4d36df791ea80cfced1
Description: Integration of Hibernate with Infinispan
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-infinispan/pom.xml
MD5: 2cc34e9876b4c73c4d9876e784e78e5d
SHA1: bd2454348c57618c3e02b329a6822d5979d3c871
Description: Integration of Hibernate with JBossCache 3.x (though 2.x sould work as well)
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-jbosscache/pom.xml
MD5: 339d8af2672ed9e1bef0e04649a33f46
SHA1: ef975161e9c45b177283d9105220f791ed512aea
Description: Integration of Hibernate with OSCache
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-oscache/pom.xml
MD5: 97443939f6f7e9c45375397aac16e0b9
SHA1: 4aadcf3391317e2a62332e9fd801b8284c3d985c
Description: Proxool-based implementation of the Hibernate ConnectionProvder contract
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-proxool/pom.xml
MD5: d1749afd6014c4465a13a87583429af2
SHA1: 5a4af64267474034f5d844e6a0af599aea7b746f
Description: Integration of Hibernate with SwarmCache
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-swarmcache/pom.xml
MD5: 6e1b739de3e65236403d0eb82db58243
SHA1: aa700e6e775c476182a1e1ad0f15c63cdb537fe0
Description: Hibernate JUnit test utilities
File Path: target\test-classes\hibernate3.jar\META-INF/maven/org.hibernate/hibernate-testing/pom.xml
MD5: 6cad956c9362f77504bf2d9aaf1731ee
SHA1: b8710fde765268f33442497aace2848f4fa986f4
Description:
HttpComponents Core (Java 1.3 compatible)
License:
Apache License: ../LICENSE.txtFile Path: target\test-classes\httpcore-4.0-beta1.jar
Description:
HttpComponents Core (NIO extensions)
License:
Apache License: ../LICENSE.txtFile Path: target\test-classes\httpcore-nio-4.0-beta1.jar
Description: The javax.inject API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\javax.inject-1.jar
File Path: target\test-classes\jaxb-xercesImpl-1.5.jar
MD5: 8cd074364c830fc8ff40a8a19c0a74c8
SHA1: 73a51faadb407dccdbd77234e0d5a0a648665692
Description: Jaxen is a universal Java XPath engine.
File Path: target\test-classes\jaxen-1.1.1.jar
MD5: 261d1aa59865842ecc32b3848b0c6538
SHA1: 9f5d3c5974dbe5cf69c2c2ec7d8a4eb6e0fce7f9
File Path: target\test-classes\jetty-6.1.0.jar
MD5: 121a72b1dea1a9adf83079a44ca08e7b
SHA1: fb39ebc0cdccea6b54ad87d229a352a894eebecc
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-310 Cryptographic Issues
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
CWE: CWE-20 Improper Input Validation
Mort Bay Jetty 6.x and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
Vulnerable Software & Versions: (show all)
File Path: target\test-classes\log4net.2.0.3.nuspec
MD5: d95207bfd2539c046ba7271b695b08f7
SHA1: b82102a0767f56525926698fbba4b7c47e96d4ab
File Path: target\test-classes\log4net.dll
MD5: e873f47ff9ed73a7ed7054aaf4e7601a
SHA1: 44d7ee86c72be615da883a24f0b54fd0725ad298
Description:
The JavaMail API provides a platform-independent and protocol-independent framework to build mail and messaging applications.
License:
Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.htmlFile Path: target\test-classes\mail-1.4.jar
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-399 Resource Management Errors
** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products."
Vulnerable Software & Versions:
Description: The SCM API provides mechanisms to manage all SCM tools.
File Path: target\test-classes\maven-scm-api-1.8.1.jar
MD5: c409fc1a6c9baf928cc37b2ffb852c83
SHA1: d72bcdc54a873e8bfbc53fde6200e53911c3d9fe
Description: Common library for SCM CVS Provider.
File Path: target\test-classes\maven-scm-provider-cvs-commons-1.8.1.jar
MD5: 7d35f493a22226b821b5d5363e85765c
SHA1: 97411239d474ecafcc2ab89facaf2593eb0de49b
Description: Executable implementation for SCM CVS Provider.
File Path: target\test-classes\maven-scm-provider-cvsexe-1.8.1.jar
MD5: 8900abe1192b79b35aedb0f683a8b412
SHA1: 5c7bf6d2c741885d2a6c17cb044ff8e2966f69ca
Description: Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\neethi-2.0.4.jar
File Path: target\test-classes\ognl-2.6.11.jar
MD5: 1173ec5f8b1f6fb1473f4546d4b83bba
SHA1: 0c3f31f4a65461c44e6697bf29070e638bef09d8
Description: Apache OpenJPA implementation of JSR-317 JPA 2.0
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\openjpa-2.0.1.jar
Severity:
High
CVSS Score: 7.5
CWE: CWE-264 Permissions, Privileges, and Access Controls
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
Vulnerable Software & Versions: (show all)
Description:
Jetty is an open-source, standards-based, full-featured web server implemented entirely in Java. It is released under the Apache 2.0 licence and is therefore free for commercial use and distribution. First created in 1995, Jetty has benefitted from input from a vast user community and consistent and focused development by a stable core of lead developers. There are many more examples of Jetty in action on the Jetty Powered Page that has selections from among the tens of thousands of production Jetty instances. However, as Jetty aims to be as unobtrusive as possible, countless websites and products are based around Jetty, but Jetty is invisible!
License:
Apache 2.0: http://jetty.mortbay.org/LICENSE.TXTFile Path: target\test-classes\org.mortbay.jetty.jar
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-310 Cryptographic Issues
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758.
Vulnerable Software & Versions: (show all)
File Path: target\test-classes\org.mortbay.jmx.jar
MD5: 82d35b88a6caecb9ad5cc8a0ca2c6c81
SHA1: 938031afdf33d3c5fee6077312fb44be25a9725c
Description: A collection of various utility classes to ease working with strings, files, command lines, XML and more.
File Path: target\test-classes\plexus-utils-3.0.7.jar
MD5: c22b393490a46da89d91dd6322446e40
SHA1: eb10e9cb2b2326fbf0cb68249b10a5c89e0642ef
Description: Simple project for producing an .egg.
File Path: target\test-classes\python\dist\EggTest-0.0.1-py2.7.egg
MD5: d314004a75bb4fe6907c016126ee0c7f
SHA1: 7cb9966e32f5d53564ec4c90868b31794ffa6130
Description: Simple project for producing an .egg.
File Path: target\test-classes\python\dist\EggTest-0.0.1-py2.7.zip\eggtest\__init__.py
MD5: d7a0966daf5b65237aabf1bdc07ceea7
SHA1: 44869d68deff98ba535291755fd2d8f3fc7e5ea7
Description: A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
File Path: target\test-classes\python\Django-1.7.2-py2.py3-none-any.whl
MD5: dc54b224746c157e89df31c886412a40
SHA1: 3aff2fabdd09e00b51bd0522a2c3ad672958d361
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-399 Resource Management Errors
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-17 Code
ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-399 Resource Management Errors
The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-17 Code
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.
Vulnerable Software & Versions: (show all)
Description: Simple project for producing an .egg.
File Path: target\test-classes\python\eggtest\__init__.py
MD5: ee53cac6173f2233cb2dd6dac4413b67
SHA1: e55fa8e5d163a2e3d1044d1bf17dd2c09d7f4d43
Description: A high-level Python Web framework that encourages rapid development and clean, pragmatic design.
File Path: target\test-classes\python\site-packages\Django-1.7.2.dist-info\METADATA
MD5: d77b67751477ae5bfb425e707222c275
SHA1: 7f928e5ecbf0fa6d65d51d84d7d3abb3be7cf50d
Description: Simple project for producing an .egg.
File Path: target\test-classes\python\site-packages\EggTest.egg-info\PKG-INFO
MD5: 583b6174a81fc2428ea51510ea082a69
SHA1: 7b80ef725101822f447a3f85b39ed7f00263e98c
File Path: target\test-classes\regexp-1.3.jar
MD5: 6dcdc325850e40b843cac2a25fb2121e
SHA1: 973df2b78b67bcd3144c3dbbb88da691065a3f8d
Description: Serp is an open source framework for manipulating Java bytecode.
License:
BSD: LICENSE.txtFile Path: target\test-classes\serp-1.13.1.jar
File Path: target\test-classes\servlet-api-2.5.jar
MD5: 69ca51af4e9a67a1027a7f95b52c3e8f
SHA1: 5959582d97d8b61f4d154ca9e495aafd16726e34
Description: The slf4j API
File Path: target\test-classes\slf4j-api-1.5.11.jar
MD5: 30cb7bee9b52fcb5f5b03d2a006e26e8
SHA1: d6a855b608971025b4fbb0970f829391cc6f727a
Description: Spring Framework: Core
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\spring-core-2.5.5.jar
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-352
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
CWE: CWE-16 Configuration
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.1
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Vulnerable Software & Versions: (show all)
File Path: target\test-classes\spring-core-3.0.0.RELEASE.jar
MD5: 2d52a505f093291e4a2c7e1a28f34557
SHA1: 4f268922155ff53fb7b28aeca24fb28d5a439d95
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-352
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
CWE: CWE-16 Configuration
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.1
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Vulnerable Software & Versions: (show all)
Description: Spring Retry provides an abstraction around retrying failed operations, with an emphasis on declarative control of the process and policy-based bahaviour that is easy to extend and customize. For instance, you can configure a plain POJO operation to retry if it fails, based on the type of exception, and with a fixed or exponential backoff.
License:
Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\spring-retry-1.1.0.RELEASE.jar
File Path: target\test-classes\spring-security-core-3.0.0.RELEASE.jar
MD5: 740649fa36b65f4bfe7d2a57e2b2807e
SHA1: 23dd919891e86a1b74b9198bd67a4ae9f4849c28
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.1
CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
Vulnerable Software & Versions: (show all)
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\commons-httpclient-2.0.jar
MD5: e0c0c1f887a8b1025a8bed9bff6ab771
SHA1: 19f1cb5ffd50c37b7ee43b8bc7a185b421ea3e9c
Severity:
Medium
CVSS Score: 5.8
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerable Software & Versions: (show all)
Description: Commons Logging
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\commons-logging.jar
MD5: 5bc8bdd15b18018e84fd862993aaca42
SHA1: 760c711c71588bc273d3e56d196d720a7678cd93
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\dom4j.jar
MD5: 85e3e7dfd9d039da0b8ea0a46129323f
SHA1: 8decb7e2c04c9340375aaf7dd43a7a6a9b9a46b1
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\jgroups-all.jar
MD5: 06b44a40f4215af9a534ace65c51a2ca
SHA1: 15201a98948972d4e890a1d9bd6b728b917ef21c
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\log4j.jar
MD5: 91e6a0cd2788d69808c05fae11d69679
SHA1: c28b336aa1547a885ddef944af6bfb7bff25abf0
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\mail.jar
MD5: 3ad3cde613b7e9700fed08d979bcccc7
SHA1: 6d16579c99ea9fd5ca5fd2dbe45a5144c2873681
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-399 Resource Management Errors
** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
** DISPUTED ** JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the Content-Disposition header.
Vulnerable Software & Versions:
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\serializer.jar
MD5: 35aa6a56662458d9dc28a9b628f84847
SHA1: 85ddd38e4cdbc22fb6c518f3d35744336da6fbfd
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\xalan.jar
MD5: 126c0c876a6b9726cfdd43f052923660
SHA1: 10f170da8dfbcdcc4098131ba773710f0ba7aef1
Description:
The XML Security project is aimed at providing implementation of security standards for XML
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\xmlsec-1.3.0.jar
MD5: ed82e8662f1823e70ba8f468f57eb11b
SHA1: 59c4b71e0a5871f26db91eaab236e5b9bf41122e
File Path: target\test-classes\stagedhttp-modified.tar\WEB-INF\lib\xss4j.jar
MD5: 3572ac321c3a854ec49d8594a17e3699
SHA1: d0f4126b39370c3fad93163ca17fd3caa3d29e97
Description: The core of the Struts framework is a flexible control layer based on
standard technologies like Java Servlets, JavaBeans, ResourceBundles,
and Extensible Markup Language (XML), as well as various Jakarta Commons
packages.
Struts encourages application architectures based on the Model
2 approach, a variation of the classic Model-View-Controller (MVC) design
paradigm. Struts provides its own Controller component and integrates with
other technologies to provide the Model and the View.
For the Model, Struts can interact with any standard data access technology,
including Enterprise Java Beans, JDBC, and Object Relational Bridge.
For the View, Struts works well with JavaServer Pages, including JSTL and
JSF, as well as Velocity Templates, XSLT, and other presentation systems.
The Struts framework provides the invisible underpinnings every professional
web application needs to survive. Struts helps you create an extensible
development environment for your application, based on published standards
and proven design patterns.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0File Path: target\test-classes\struts.jar
Severity:
High
CVSS Score: 7.5
CWE: CWE-20 Improper Input Validation
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-20 Improper Input Validation
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.8
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Vulnerable Software & Versions:
Description: Apache Struts 2
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\struts2-core-2.1.2.jar
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-352
Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
CookieInterceptor in Apache Struts 2.x before 2.3.16.3, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
CWE: CWE-264 Permissions, Privileges, and Access Controls
CookieInterceptor in Apache Struts before 2.3.16.2, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 7.5
CWE: CWE-264 Permissions, Privileges, and Access Controls
ParametersInterceptor in Apache Struts before 2.3.16.2 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
The ParametersInterceptor in Apache Struts before 2.3.16.1 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 10.0
CWE: CWE-16 Configuration
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-20 Improper Input Validation
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-20 Improper Input Validation
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-352
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 10.0
CWE: CWE-20 Improper Input Validation
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.4
CWE: CWE-264 Permissions, Privileges, and Access Controls
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-264 Permissions, Privileges, and Access Controls
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Vulnerable Software & Versions: (show all)
Severity:
High
CVSS Score: 9.3
CWE: CWE-20 Improper Input Validation
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.6
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-20 Improper Input Validation
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Vulnerable Software & Versions: (show all)
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar
MD5: 634d5cc32238fc3d023941d265189ddd
SHA1: e9a3159254a01777f536d556bcdb539c7617b0e5
Description:
Guava is a suite of core and expanded libraries that include
utility classes, google's collections, io classes, and much
much more.
This project is a complete packaging of all the Guava libraries
into a single jar. Individual portions of Guava can be used
by downloading the appropriate module and its dependencies.
Guava (complete) has only one code dependency - javax.annotation,
per the JSR-305 spec.
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.google.guava/guava/pom.xml
MD5: 76e749cc3e65c708116326959af90f64
SHA1: b7f1e532b79c7e1c09849c89460798d9a7c59eaf
Description: Library for working with the Java 5 type system
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.googlecode.jtype/jtype/pom.xml
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-core/pom.xml
MD5: ff77b5aceaf6d73a121bcb471444f071
SHA1: e1c1339fa2c342aa5a24dcdd3658c00a2139263a
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-server/pom.xml
MD5: 07a7be16c32692944c7fe8dcc8685d3c
SHA1: baffe4cdc261e43b5e727d47a5f92691a473ca78
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.sun.jersey/jersey-servlet/pom.xml
MD5: ed005c0838de5f8a6e0fe6ef31b827a0
SHA1: f1c4462e1f967afe6c150b3955b72c71780e2916
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.dropwizard/dropwizard-core/pom.xml
MD5: 818fd048671bd58716cd687cdcd79ba4
SHA1: 905a71014bc2ba9e893107268ba8227528f31617
Description:
A dependency-less package of just the annotations used by other Metrics modules.
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-annotation/pom.xml
MD5: fac7425f6b8789ee45f7a7ad56711af0
SHA1: f28c170c7fbff96de88602d1d11afd9b618e6c59
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-core/pom.xml
MD5: 726812bd630cb75b3cadf40346c669e9
SHA1: c04a80a736ae29268265e22aa7e21dea68c63d1b
Description:
A set of class providing Metrics integration for Jersey, the reference JAX-
implementation.
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jersey/pom.xml
MD5: 0b751b9e702fbd84c41644d71ba55862
SHA1: 8f90c99a87e2e1c67a1056c387bbe3ff1e92f2aa
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-jetty/pom.xml
MD5: 994485bf6db4621a698290e213f0838e
SHA1: 3d4c7ee060f83ca829ee3ef22900e3af49579f53
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-log4j/pom.xml
MD5: 72b71c62a25ec1c934d7b1463fe9790d
SHA1: 66c0601572c4ea1df2aa24e69ff0a7c16a42623b
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/com.yammer.metrics/metrics-servlet/pom.xml
MD5: f71c2da1da38a5d505d892c2fe6022d2
SHA1: 838aaae3f56141a6e35e87003d90f1c7132f839c
Description:
Commons-IO contains utility classes, stream implementations, file filters, and endian classes.
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/commons-io/commons-io/pom.xml
MD5: 92beb726a369cb3ce2503796f98e2f3b
SHA1: d30e29bee45e6da52a776266a460f10b51ceca98
Description:
Bean Validation (JSR-303) API.
License:
Apache License, Version 2.0: license.txtFile Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/javax.validation/validation-api/pom.xml
Description: Apache Log4j 1.2
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/log4j/log4j/pom.xml
Description: Asynchronous API
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-continuation/pom.xml
MD5: 74919244c9ca106d221f23a832e1076d
SHA1: b59985a1ba1b93fbbd5d90b6ff5ed9f44cc91ac7
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-http/pom.xml
MD5: f1b6db43b8a499e66ddf58c8165714a5
SHA1: 885e6e766ec3452c085324a9759de5ad8a1c8971
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-io/pom.xml
MD5: 941c55f8ac0d6c14971d20be7b60ec19
SHA1: f8f0907153f891113bdee011063e540d7d57a496
Description: Jetty security infrastructure
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-security/pom.xml
MD5: 266a3467a1d03bce12e34fda16dfa615
SHA1: 53b54057b58ae7d3c4c12b520b048889a2c28ad8
Description: The core jetty server artifact.
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-server/pom.xml
MD5: 55a7034666834be8a62b8db044ac8d70
SHA1: a9ae16cb473f1797940dd58ed3d5541c88b34396
Description: Jetty Servlet Container
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-servlet/pom.xml
MD5: e662a30ea722c442a57a83c478fd7d7e
SHA1: 4a2d357d991aff1ee18e617b7c1076dbcfe89986
Description: Utility classes for Jetty
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.eclipse.jetty/jetty-util/pom.xml
MD5: c147343fa7f11c15a5f99ddf8a830b20
SHA1: 9a86a0c493d3834471b7a03e174a9f4d469cbd98
Description:
Hibernate's Bean Validation (JSR-303) reference implementation.
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.hibernate/hibernate-validator/pom.xml
MD5: 80f5387c7495664fc4ba31138829b0b8
SHA1: 02ae7dae4450b00f78d8bc458590221e7401eee7
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
Vulnerable Software & Versions: (show all)
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.owasp.dependency-check/uber/pom.xml
MD5: 2c67a7108125ede340218e9deba58e82
SHA1: 52fb11f0fc1666a343aa5c5ea0f756ba54934c1f
Description:
JUL to SLF4J bridge
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/jul-to-slf4j/pom.xml
MD5: ae2b577066d99bea42b1e1f2f0aaf45d
SHA1: bd08211dd5fa0ab44a0a3b04c1ec0c5f67348334
Description: The slf4j API
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-api/pom.xml
MD5: d000b772974fbe3ad9e1a68ad8f484e7
SHA1: 93c66c9afd6cf7b91bd4ecf38a60ca48fc5f2078
Description:
The slf4j log4j-12 binding
File Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.slf4j/slf4j-log4j12/pom.xml
MD5: 228315739fc30a7eb2403bcc8aaca619
SHA1: ab93dfaa2fb9619d91fb31a64bb65802b56ed0fb
Description: YAML 1.1 parser and emitter for Java
License:
Apache License Version 2.0: LICENSE.txtFile Path: target\test-classes\uber-1.0-SNAPSHOT.jar\META-INF/maven/org.yaml/snakeyaml/pom.xml
Description: Apache Velocity is a general purpose template engine.
File Path: target\test-classes\velocity-1.7.jar
MD5: 3692dd72f8367cb35fb6280dc2916725
SHA1: 2ceb567b8f3f21118ecdec129fe1271dbc09aa7a
File Path: target\test-classes\war-4.0.war
MD5: 54070e31aa8e6256ea8c850642a3c434
SHA1: eaede5596599912d70cb9b517cb87fff336a8422
Description: The FileUpload component provides a simple yet flexible means of adding
support for multipart file upload functionality to servlets and web
applications.
License:
The Apache Software License, Version 2.0: /LICENSE.txtFile Path: target\test-classes\war-4.0.war\WEB-INF\extra\commons-fileupload-1.1.1.jar
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 3.3
CWE: CWE-264 Permissions, Privileges, and Access Controls
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Vulnerable Software & Versions: (show all)
Description: Commons-IO contains utility classes, stream implementations, file filters, and endian classes.
License:
The Apache Software License, Version 2.0: /LICENSE.txtFile Path: target\test-classes\war-4.0.war\WEB-INF\extra\commons-io-1.3.1.jar
File Path: target\test-classes\war-4.0.war\WEB-INF\extra\dojo-ajax-nodemo-0.4.1.jar
MD5: 91fda9e8b3c95eee6f566567cf790a9e
SHA1: 0e77d6bb7687a7084a1b92da563dfda6324ba83f
File Path: target\test-classes\war-4.0.war\WEB-INF\extra\json-1.0.jar
MD5: a7aa9a187cb901ec6e299f65f583f140
SHA1: 0fe8ce55b9f83f16185192821a385916b0eef38e
File Path: target\test-classes\war-4.0.war\WEB-INF\extra\prototype-1.5.0.jar
MD5: 206bd786024eca29e41a12e44c055c0a
SHA1: b02b002f0e9bb289b311db49c561c58afb8eb58c
Description: Project Woodstock
License:
CDDL + GPLv2 with classpath exception: http://glassfish.java.net/nonav/public/CDDL+GPL_1_1.htmlFile Path: target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-4.0.2.10.jar
Description: Project Woodstock
License:
CDDL + GPLv2 with classpath exception: http://glassfish.java.net/nonav/public/CDDL+GPL_1_1.htmlFile Path: target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-suntheme-4.0.2.10.jar
Description: Java.net - The Source for Java Technology Collaboration
License:
http://glassfish.java.net/nonav/public/CDDL+GPL.htmlFile Path: target\test-classes\war-4.0.war\WEB-INF\lib\console-core-4.0.jar
Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\woden-api-1.0M8.jar
Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\woden-impl-dom-1.0M8.jar
Description: Java stub generator for WSDL
License:
CPL: http://www.opensource.org/licenses/cpl1.0.txtFile Path: target\test-classes\wsdl4j-1.6.2.jar
Description: Woodstox is a high-performance XML processor that implements Stax (JSR-173) API
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\wstx-asl-3.2.4.jar
File Path: target\test-classes\xalan-2.7.0.jar
MD5: a018d032c21a873225e702b36b171a10
SHA1: a33c0097f1c70b20fa7ded220ea317eb3500515e
Description: Xerces2 is the next generation of high performance, fully
compliant XML parsers in the Apache Xerces family. This new
version of Xerces introduces the Xerces Native Interface (XNI),
a complete framework for building parser components and
configurations that is extremely modular and easy to program.
File Path: target\test-classes\xercesImpl-2.8.1.jar
MD5: e86f321c8191b37bd720ff5679f57288
SHA1: 25101e37ec0c907db6f0612cbf106ee519c1aef1
Description: xml-commons provides an Apache-hosted set of DOM, SAX, and
JAXP interfaces for use in other xml-based projects. Our hope is that we
can standardize on both a common version and packaging scheme for these
critical XML standards interfaces to make the lives of both our developers
and users easier. The External Components portion of xml-commons contains
interfaces that are defined by external standards organizations. For DOM,
that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for
JAXP it's Sun.
File Path: target\test-classes\xml-apis-1.3.04.jar
MD5: 9ae9c29e4497fc35a3eade1e6dd0bbeb
SHA1: 90b215f48fe42776c8c7f6e3509ec54e84fd65ef
File Path: target\test-classes\xmlParserAPIs-2.6.0.jar
MD5: 2651f9f7c39e3524f3e2c394625ac63a
SHA1: 065acede1e5305bd2b92213d7b5761328c6f4fd9
Description: Commons XMLSchema is a light weight schema object model that can be used to manipualte or
generate a schema. It has a clean, easy to use API and can easily be integrated into an existing project
since it has almost no dependancies on third party libraries.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: target\test-classes\XmlSchema-1.4.2.jar
Description:
XWork is an command-pattern framework that is used to power WebWork
as well as other applications. XWork provides an Inversion of Control
container, a powerful expression language, data type conversion,
validation, and pluggable configuration.
License:
The OpenSymphony Software License 1.1: src/etc/LICENSE.txtFile Path: target\test-classes\xwork-2.1.1.jar
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
Vulnerable Software & Versions: (show all)
Severity:
Low
CVSS Score: 2.6
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-20 Improper Input Validation
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Vulnerable Software & Versions: (show all)