File Path: ..\..\..\..\dependency-check-core\target\test-classes\activation-1.1.jar
MD5: 8AE38E87CD4F86059C0294A8FE3E0B18
SHA1: E6CB541461C2834BDEA3EB920F1884D1EB508B50
File Path: ..\..\..\..\dependency-check-core\target\test-classes\annogen-0.1.0.jar
MD5: FF275C3491AC6715AD9F6C22A9660503
SHA1: A8DE34EA7AA93765D24DC16EC9C61AF5160BB899
File Path: ..\..\..\..\dependency-check-core\target\test-classes\ant-1.7.0.jar
MD5: 133E8979E9C11450F557CA890177FE0A
SHA1: 9746AF1A485E50CF18DCB232489032A847067066
File Path: ..\..\..\..\dependency-check-core\target\test-classes\ant-launcher-1.7.0.jar
MD5: E0C8B3F9390A5D784BBDB6A21F2ABD1D
SHA1: E7E30789211E074AA70EF3EAEA59BD5B22A7FA7A
File Path: ..\..\..\..\dependency-check-core\target\test-classes\aopalliance-1.0.jar
MD5: 04177054E180D09E3998808EFA0401C7
SHA1: 0235BA8B489512805AC13A8F9EA77A1CA5EBE3E8
Description: The Axiom API
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\axiom-api-1.2.7.jar
Description: The Axiom DOM implementation.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\axiom-dom-1.2.7.jar
Description: The Axiom default implementation.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\axiom-impl-1.2.7.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\axis-1.4.jar
MD5: 03DCFDD88502505CC5A805A128BFDD8D
SHA1: 94A9CE681A42D0352B3AD22659F67835E560D107
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-20 Improper Input Validation
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions:
Description: Core Parts of Axis 2.0. This includes Axis 2.0 engine, Client API, Addressing support, etc.,
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\axis2-kernel-1.4.1.jar
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-20 Improper Input Validation
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
CWE: CWE-20 Improper Input Validation
Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 10.0
CWE: CWE-255 Credentials Management
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\backport-util-concurrent-3.1.jar
MD5: 748BB0CBF4780B2E3121DC9C12E10CD9
SHA1: 682F7AC17FED79E92F8E87D8455192B63376347B
Description:
Commons CLI provides a simple API for presenting, processing and validating a command line interface.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-cli-1.2.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-codec-1.2.jar
MD5: 2617B220009F952BB9542AF167D040CF
SHA1: 397F4731A9F9B6EB1907E224911C77EA3AA27A8B
Description:
The FileUpload component provides a simple yet flexible means of adding support for multipart
file upload functionality to servlets and web applications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-fileupload-1.2.1.jar
Severity:
Low
CVSS Score: 3.3
CWE: CWE-264 Permissions, Privileges, and Access Controls
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-httpclient-3.1.jar
MD5: 8AD8C9229EF2D59AB9F59F7050E846A5
SHA1: 964CD74171F427720480EFDEC40A7C7F6E58426A
Description:
Commons Validator provides the building blocks for both client side validation and server side data validation.
It may be used standalone or with a framework like Struts.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\commons-validator-1.4.0.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\data.zip
MD5: C3CF69C4F564283D27BFD11866891BD3
SHA1: B1962018C35BEBB2C2C63A82704751A45C09FAF0
File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear
MD5: 9FA8C4E8072904589FC0D1A12E8EB291
SHA1: 61868609EB138C41C0298373C9F8C19713FEFA54
Description: Daytrader EJBs
File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\dt-ejb.jar
MD5: 26E92DBACAD11C73F03EDE043B113653
SHA1: F2F7C05243EC8E5FB93EFB35F5908BBA88651BF3
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions:
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\geronimo-jaxrpc_1.1_spec-2.0.0.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
CWE: CWE-287 Improper Authentication
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 10.0
CWE: CWE-287 Improper Authentication
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
Vulnerable Software & Versions:
Description: Streamer Application for Day Trader
File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\streamer.jar
MD5: 5BC6DE1A34935D20331EF777463FD28B
SHA1: EC631C926AB667182840B3E5E32BD3D2F8A808AC
File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\web.war
MD5: 857655BB1DDB4204F09D63E5CA8C56BC
SHA1: 7A7455F5D78BB4E1B8E66CD3E6C1F964D18705F9
Description: Client demonstrating Web Services
File Path: ..\..\..\..\dependency-check-core\target\test-classes\daytrader-ear-2.1.7.ear\wsappclient.jar
MD5: C343646C162FDD19156400FE83F41CE2
SHA1: ECE01974BE048BA75E2B344C39EFB176915A1C16
File Path: ..\..\..\..\dependency-check-core\target\test-classes\dojo-war-1.3.0.war
MD5: CD00CB6BC15004638548148A21D799AA
SHA1: 36572B4E096421BECAB9346DA41BBC4EC1316A54
Severity:
High
CVSS Score: 10.0
CWE: CWE-16 Configuration
The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact via a request to a (1) test or (2) demo component.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in dijit/tests/_testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/test_Button.html.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, util/buildscripts/jslib/buildUtil.js, and util/doh/runner.html.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
Vulnerable Software & Versions:
Description: This is the ehcache core module. Pair it with other modules for added
functionality.
License:
The Apache Software License, Version 2.0: src/assemble/LICENSE.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\ehcache-core-2.2.0.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\file.tar
MD5: 14BBD058FE7ACFD79E6DA6321F72BFB7
SHA1: 2A084055AC2AB180A7D9DED265E9504BF3AA856A
File Path: ..\..\..\..\dependency-check-core\target\test-classes\freemarker-2.3.12.jar
MD5: 719554BBC3D8A98582A8A93328134FE2
SHA1: 3501B670AA7E3822DDF7693082F621B1CD8CE086
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\geronimo-javamail_1.4_spec-1.2.jar
Severity:
High
CVSS Score: 7.8
CWE: CWE-20 Improper Input Validation
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\geronimo-jms_1.1_spec-1.1.jar
MD5: 10E163BDD905D1C16D7E1C48427B5853
SHA1: BBD68F90D445DE37050B1E9FB9D7114E83757E73
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\geronimo-stax-api_1.0_spec-1.0.1.jar
Severity:
Low
CVSS Score: 2.1
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')
The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
Vulnerable Software & Versions:
Description: Hazelcast In-Memory DataGrid
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\hazelcast-2.5.jar
Description:
HttpComponents Core (Java 1.3 compatible)
License:
Apache License: ../LICENSE.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\httpcore-4.0-beta1.jar
Description:
HttpComponents Core (NIO extensions)
License:
Apache License: ../LICENSE.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\httpcore-nio-4.0-beta1.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\jaxb-xercesImpl-1.5.jar
MD5: 8CD074364C830FC8FF40A8A19C0A74C8
SHA1: 73A51FAADB407DCCDBD77234E0D5A0A648665692
File Path: ..\..\..\..\dependency-check-core\target\test-classes\jaxen-1.1.1.jar
MD5: 261D1AA59865842ECC32B3848B0C6538
SHA1: 9F5D3C5974DBE5CF69C2C2EC7D8A4EB6E0FCE7F9
File Path: ..\..\..\..\dependency-check-core\target\test-classes\jetty-6.1.0.jar
MD5: 121A72B1DEA1A9ADF83079A44CA08E7B
SHA1: FB39EBC0CDCCEA6B54AD87D229A352A894EEBECC
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-310 Cryptographic Issues
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) jspsnoop/, (2) jspsnoop/ERROR/, and (3) jspsnoop/IOException/, and possibly the PATH_INFO to (4) snoop.jsp.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
CWE: CWE-20 Improper Input Validation
Mort Bay Jetty 6.x and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to jsp/dump.jsp in the JSP Dump feature, or the (2) Name or (3) Value parameter to the default URI for the Session Dump Servlet under session/.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other data via a request to a URI ending in /dump/, as demonstrated by discovering the value of the getPathTranslated variable.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\mail-1.4.jar
MD5: 2E64A3805D543BDB86E6E5EECA5529F8
SHA1: 1AA1579AE5ECD41920C4F355B0A9EF40B68315DD
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-399 Resource Management Errors
** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java UnknownHostException error, which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests, resulting in a SQLNestedException. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products."
Vulnerable Software & Versions:
Description: The SCM API provides mechanisms to manage all SCM tools.
File Path: ..\..\..\..\dependency-check-core\target\test-classes\maven-scm-api-1.8.1.jar
MD5: C409FC1A6C9BAF928CC37B2FFB852C83
SHA1: D72BCDC54A873E8BFBC53FDE6200E53911C3D9FE
Description: Common library for SCM CVS Provider.
File Path: ..\..\..\..\dependency-check-core\target\test-classes\maven-scm-provider-cvs-commons-1.8.1.jar
MD5: 7D35F493A22226B821B5D5363E85765C
SHA1: 97411239D474ECAFCC2AB89FACAF2593EB0DE49B
Description: Executable implementation for SCM CVS Provider.
File Path: ..\..\..\..\dependency-check-core\target\test-classes\maven-scm-provider-cvsexe-1.8.1.jar
MD5: 8900ABE1192B79B35AEDB0F683A8B412
SHA1: 5C7BF6D2C741885D2A6C17CB044FF8E2966F69CA
Description: Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\neethi-2.0.4.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\ognl-2.6.11.jar
MD5: 1173EC5F8B1F6FB1473F4546D4B83BBA
SHA1: 0C3F31F4A65461C44E6697BF29070E638BEF09D8
File Path: ..\..\..\..\dependency-check-core\target\test-classes\org.mortbay.jetty.jar
MD5: 8ABFD9EF03680C5B9B418ABD918CE525
SHA1: 7B11E767B884D5B872310CE390219B59FFD64A1E
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-310 Cryptographic Issues
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Mort Bay Jetty before 6.1.17 allows remote attackers to inject arbitrary web script or HTML via a directory listing request containing a ; (semicolon) character.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-200 Information Exposure
Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\org.mortbay.jmx.jar
MD5: 82D35B88A6CAECB9AD5CC8A0CA2C6C81
SHA1: 938031AFDF33D3C5FEE6077312FB44BE25A9725C
Description: A collection of various utility classes to ease working with strings, files, command lines, XML and more.
File Path: ..\..\..\..\dependency-check-core\target\test-classes\plexus-utils-3.0.7.jar
MD5: C22B393490A46DA89D91DD6322446E40
SHA1: EB10E9CB2B2326FBF0CB68249B10A5C89E0642EF
File Path: ..\..\..\..\dependency-check-core\target\test-classes\regexp-1.3.jar
MD5: 6DCDC325850E40B843CAC2A25FB2121E
SHA1: 973DF2B78B67BCD3144C3DBBB88DA691065A3F8D
File Path: ..\..\..\..\dependency-check-core\target\test-classes\servlet-api-2.5.jar
MD5: 69CA51AF4E9A67A1027A7F95B52C3E8F
SHA1: 5959582D97D8B61F4D154CA9E495AAFD16726E34
Description: The slf4j API
File Path: ..\..\..\..\dependency-check-core\target\test-classes\slf4j-api-1.5.11.jar
MD5: 30CB7BEE9B52FCB5F5B03D2A006E26E8
SHA1: D6A855B608971025B4FBB0970F829391CC6F727A
Description: Spring Framework
File Path: ..\..\..\..\dependency-check-core\target\test-classes\spring-core-2.5.5.jar
MD5: 05432EF3BF4EFA1394B127563CB1DD8C
SHA1: 1B3B0FAD8E30EBB9560A81989F5B5BFB28915109
Severity:
High
CVSS Score: 7.5
CWE: CWE-16 Configuration
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.1
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\spring-core-3.0.0.RELEASE.jar
MD5: 2D52A505F093291E4A2C7E1A28F34557
SHA1: 4F268922155FF53FB7B28AECA24FB28D5A439D95
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
CWE: CWE-16 Configuration
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.1
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\struts.jar
MD5: AA4AE098EC87FBCD6591402E5CBD781A
SHA1: F69E6119EB01F9AD064BD358ED0315618FB1CB5C
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.8
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 7.5
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Vulnerable Software & Versions:
Description: Apache Struts 2
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\struts2-core-2.1.2.jar
Severity:
High
CVSS Score: 10.0
CWE: CWE-16 Configuration
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-20 Improper Input Validation
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.8
CWE: CWE-20 Improper Input Validation
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-352
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 10.0
CWE: CWE-20 Improper Input Validation
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 6.8
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 6.4
CWE: CWE-264 Permissions, Privileges, and Access Controls
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-264 Permissions, Privileges, and Access Controls
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Vulnerable Software & Versions:
Severity:
High
CVSS Score: 9.3
CWE: CWE-20 Improper Input Validation
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 4.3
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
Vulnerable Software & Versions:
Severity:
Low
CVSS Score: 2.6
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.0
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\test.zip
MD5: 0F6467C8BCDD13071EAE47B60428814A
SHA1: E7DD6959DB16462CC4ABC26AC122EAC69F56FD3E
File Path: ..\..\..\..\dependency-check-core\target\test-classes\velocity-1.7.jar
MD5: 3692DD72F8367CB35FB6280DC2916725
SHA1: 2CEB567B8F3F21118ECDEC129FE1271DBC09AA7A
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war
MD5: 54070E31AA8E6256EA8C850642A3C434
SHA1: EAEDE5596599912D70CB9B517CB87FFF336A8422
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\commons-fileupload-1.1.1.jar
MD5: ADB15D9A4DA4A30D77E88B32A45CBDDB
SHA1: D587A50727BA905AAD13DE9EA119081403BF6823
Severity:
Low
CVSS Score: 3.3
CWE: CWE-264 Permissions, Privileges, and Access Controls
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Vulnerable Software & Versions:
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\commons-io-1.3.1.jar
MD5: 2E55C05D3386889AF97CAAE4517AC9DF
SHA1: B90B6AC57CF27A2858EAA490D02BA7945D18CA7B
Description: Java.net - The Source for Java Technology Collaboration
License:
http://glassfish.java.net/nonav/public/CDDL+GPL.htmlFile Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\lib\console-core-4.0.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\dojo-ajax-nodemo-0.4.1.jar
MD5: 91FDA9E8B3C95EEE6F566567CF790A9E
SHA1: 0E77D6BB7687A7084A1B92DA563DFDA6324BA83F
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\json-1.0.jar
MD5: A7AA9A187CB901EC6E299F65F583F140
SHA1: 0FE8CE55B9F83F16185192821A385916B0EEF38E
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\prototype-1.5.0.jar
MD5: 206BD786024ECA29E41A12E44C055C0A
SHA1: B02B002F0E9BB289B311DB49C561C58AFB8EB58C
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-4.0.2.10.jar
MD5: 411E6E13BC190D58E10337E502371CFC
SHA1: 977A6FA7F65F8EA68101AA1252C05E8193DE97B5
File Path: ..\..\..\..\dependency-check-core\target\test-classes\war-4.0.war\WEB-INF\extra\webui-jsf-suntheme-4.0.2.10.jar
MD5: 62A5F094E9832DCE2A7CE138DFEE3507
SHA1: 4EC663AE9AB37D9D6504DC5754E1E59D36D2CD9E
Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\woden-api-1.0M8.jar
Description: The Woden project is a subproject of the Apache Web Services Project to develop a Java class library for reading, manipulating, creating and writing WSDL documents, initially to support WSDL 2.0 but with the longer term aim of supporting past, present and future versions of WSDL. There are two main deliverables: an API and an implementation. The Woden API consists of a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the W3C WSDL 2.0 specification. The implementation will be a high performance implementation directly usable in other Apache projects such as Axis2.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\woden-impl-dom-1.0M8.jar
File Path: ..\..\..\..\dependency-check-core\target\test-classes\wsdl4j-1.6.2.jar
MD5: 2608A8EA3F07B0C08DE8A7D3D0D3FC09
SHA1: DEC1669FB6801B7328E01AD72FC9E10B69EA06C1
File Path: ..\..\..\..\dependency-check-core\target\test-classes\wstx-asl-3.2.4.jar
MD5: F3FAC27A7387452F1C4243C695FA0F0D
SHA1: AADA03A08AE547BEE92CAF3B1E0CD756134E9226
File Path: ..\..\..\..\dependency-check-core\target\test-classes\xalan-2.7.0.jar
MD5: A018D032C21A873225E702B36B171A10
SHA1: A33C0097F1C70B20FA7DED220EA317EB3500515E
File Path: ..\..\..\..\dependency-check-core\target\test-classes\xercesImpl-2.8.1.jar
MD5: E86F321C8191B37BD720FF5679F57288
SHA1: 25101E37EC0C907DB6F0612CBF106EE519C1AEF1
File Path: ..\..\..\..\dependency-check-core\target\test-classes\xml-apis-1.3.04.jar
MD5: 9AE9C29E4497FC35A3EADE1E6DD0BBEB
SHA1: 90B215F48FE42776C8C7F6E3509EC54E84FD65EF
File Path: ..\..\..\..\dependency-check-core\target\test-classes\xmlParserAPIs-2.6.0.jar
MD5: 2651F9F7C39E3524F3E2C394625AC63A
SHA1: 065ACEDE1E5305BD2B92213D7B5761328C6F4FD9
Description: Commons XMLSchema is a light weight schema object model that can be used to manipualte or
generate a schema. It has a clean, easy to use API and can easily be integrated into an existing project
since it has almost no dependancies on third party libraries.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\XmlSchema-1.4.2.jar
Description:
XWork is an command-pattern framework that is used to power WebWork
as well as other applications. XWork provides an Inversion of Control
container, a powerful expression language, data type conversion,
validation, and pluggable configuration.
License:
The OpenSymphony Software License 1.1: src/etc/LICENSE.txtFile Path: ..\..\..\..\dependency-check-core\target\test-classes\xwork-2.1.1.jar
Severity:
Medium
CVSS Score: 5.0
CWE: CWE-20 Improper Input Validation
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Vulnerable Software & Versions: