Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: Grouper

edu.internet2.middleware.grouper:grouper-parent:2.6.0-SNAPSHOT

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
FastInfoset-1.2.15.jarcpe:2.3:a:fast_ber_project:fast_ber:1.2.15:*:*:*:*:*:*:*pkg:maven/com.sun.xml.fastinfoset/FastInfoset@1.2.15 0Low44
XmlSchema-1.4.7.jarcpe:2.3:a:apache:commons_net:1.4.7:*:*:*:*:*:*:*pkg:maven/org.apache.ws.commons.schema/XmlSchema@1.4.7MEDIUM1Highest38
accessors-smart-2.4.8.jarcpe:2.3:a:json-smart_project:json-smart-v2:2.4.8:*:*:*:*:*:*:*pkg:maven/net.minidev/accessors-smart@2.4.8 0Low43
activation-1.1.1.jarcpe:2.3:a:oracle:java_se:1.1.1:*:*:*:*:*:*:*pkg:maven/javax.activation/activation@1.1.1 0Low26
activemq-core-5.7.0.jarcpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*pkg:maven/org.apache.activemq/activemq-core@5.7.0CRITICAL25Highest33
activemq-protobuf-1.1.jarpkg:maven/org.apache.activemq.protobuf/activemq-protobuf@1.1 029
amqp-client-4.12.0.jarcpe:2.3:a:vmware:rabbitmq:4.12.0:*:*:*:*:*:*:*pkg:maven/com.rabbitmq/amqp-client@4.12.0 0High46
animal-sniffer-annotations-1.9.jarpkg:maven/org.codehaus.mojo/animal-sniffer-annotations@1.9 023
annotations-2.0.1.jarpkg:maven/com.google.code.findbugs/annotations@2.0.1 024
ant-1.10.12.jarcpe:2.3:a:apache:ant:1.10.12:*:*:*:*:*:*:*pkg:maven/org.apache.ant/ant@1.10.12 0Highest24
antlr-2.7.7.jarpkg:maven/antlr/antlr@2.7.7 024
antlr4-runtime-4.7.1.jarpkg:maven/org.antlr/antlr4-runtime@4.7.1 031
aopalliance-1.0.jarpkg:maven/aopalliance/aopalliance@1.0 020
aopalliance-repackaged-2.6.1.jarcpe:2.3:a:oracle:java_se:2.6.1:*:*:*:*:*:*:*pkg:maven/org.glassfish.hk2.external/aopalliance-repackaged@2.6.1 0Low25
apache-mime4j-core-0.7.2.jarpkg:maven/org.apache.james/apache-mime4j-core@0.7.2 035
asm-7.1.jarpkg:maven/org.ow2.asm/asm@7.1 053
aws-java-sdk-core-1.12.267.jarcpe:2.3:a:amazon:aws-sdk-java:1.12.267:*:*:*:*:*:*:*pkg:maven/com.amazonaws/aws-java-sdk-core@1.12.267 0Highest22
axiom-api-1.2.11.jarcpe:2.3:a:apache:commons_net:1.2.11:*:*:*:*:*:*:*pkg:maven/org.apache.ws.commons.axiom/axiom-api@1.2.11MEDIUM1Highest36
axiom-api-1.2.15.jarcpe:2.3:a:apache:commons_net:1.2.15:*:*:*:*:*:*:*pkg:maven/org.apache.ws.commons.axiom/axiom-api@1.2.15MEDIUM1Highest35
axiom-dom-1.2.14.jar (shaded: org.apache.ws.commons.axiom:axiom-common-impl:1.2.14)cpe:2.3:a:apache:commons_net:1.2.14:*:*:*:*:*:*:*pkg:maven/org.apache.ws.commons.axiom/axiom-common-impl@1.2.14MEDIUM1Highest13
axiom-dom-1.2.14.jarcpe:2.3:a:apache:commons_net:1.2.14:*:*:*:*:*:*:*pkg:maven/org.apache.ws.commons.axiom/axiom-dom@1.2.14MEDIUM1Highest33
axiom-impl-1.2.15.jar (shaded: org.apache.ws.commons.axiom:core-aspects:1.2.15)cpe:2.3:a:apache:commons_net:1.2.15:*:*:*:*:*:*:*pkg:maven/org.apache.ws.commons.axiom/core-aspects@1.2.15MEDIUM1Highest13
axis2-adb-1.6.1.jarcpe:2.3:a:apache:axis2:1.6.1:*:*:*:*:*:*:*pkg:maven/org.apache.axis2/axis2-adb@1.6.1MEDIUM1Highest25
axis2-kernel-1.6.4.jarcpe:2.3:a:apache:axis2:1.6.4:*:*:*:*:*:*:*pkg:maven/org.apache.axis2/axis2-kernel@1.6.4 0Highest31
axis2-mtompolicy-1.6.3.jarcpe:2.3:a:apache:axis2:1.6.3:*:*:*:*:*:*:*pkg:maven/org.apache.axis2/axis2-mtompolicy@1.6.3 0Highest27
backport-util-concurrent-3.1.jarpkg:maven/backport-util-concurrent/backport-util-concurrent@3.1 025
bcpkix-jdk15on-1.52.jarcpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.52:*:*:*:*:*:*:*pkg:maven/org.bouncycastle/bcpkix-jdk15on@1.52MEDIUM1Low62
bcpkix-jdk18on-1.72.jarcpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.72:*:*:*:*:*:*:*pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.72 0Low66
bcprov-jdk15on-1.52.jarcpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.52:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.52:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.52:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.52:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.52:*:*:*:*:*:*:*		pkg:maven/org.bouncycastle/bcprov-jdk15on@1.52HIGH15Low54
bcprov-jdk15on-1.59.jarcpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.59:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.59:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.59:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.59:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.59:*:*:*:*:*:*:*		pkg:maven/org.bouncycastle/bcprov-jdk15on@1.59CRITICAL5Low54
bcprov-jdk15on-1.70.jarcpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.70:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.70:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.70:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.70:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.70:*:*:*:*:*:*:*		pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70 0Low60
bcprov-jdk18on-1.72.jarcpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.72:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.72:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.72:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.72:*:*:*:*:*:*:*
cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.72:*:*:*:*:*:*:*		pkg:maven/org.bouncycastle/bcprov-jdk18on@1.72 0Low60
bcutil-jdk18on-1.72.jarcpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.72:*:*:*:*:*:*:*pkg:maven/org.bouncycastle/bcutil-jdk18on@1.72 0Low50
box-java-sdk-2.17.0.jarpkg:maven/com.box/box-java-sdk@2.17.0 026
bsh-2.0b5.jarcpe:2.3:a:beanshell:beanshell:2.0:b5:*:*:*:*:*:*pkg:maven/org.beanshell/bsh@2.0b5HIGH1Highest27
byte-buddy-1.12.9.jar (shaded: net.bytebuddy:byte-buddy-dep:1.12.9)pkg:maven/net.bytebuddy/byte-buddy-dep@1.12.9 09
byte-buddy-1.12.9.jarpkg:maven/net.bytebuddy/byte-buddy@1.12.9 027
c3p0-0.9.5.4.jarcpe:2.3:a:mchange:c3p0:0.9.5.4:*:*:*:*:*:*:*pkg:maven/com.mchange/c3p0@0.9.5.4 0Highest31
c3p0-oracle-thin-extras-0.9.5.jarcpe:2.3:a:mchange:c3p0:0.9.5:*:*:*:*:*:*:*pkg:maven/com.google.code.maven-play-plugin.com.mchange/c3p0-oracle-thin-extras@0.9.5HIGH1Highest29
cglib-3.3.0.jarpkg:maven/cglib/cglib@3.3.0 018
checker-qual-3.5.0.jarpkg:maven/org.checkerframework/checker-qual@3.5.0 060
classmate-1.5.1.jarpkg:maven/com.fasterxml/classmate@1.5.1 057
commons-beanutils-1.9.4.jarcpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_net:1.9.4:*:*:*:*:*:*:*		pkg:maven/commons-beanutils/commons-beanutils@1.9.4MEDIUM1Highest170
commons-cli-1.4.jarcpe:2.3:a:apache:commons_net:1.4:*:*:*:*:*:*:*pkg:maven/commons-cli/commons-cli@1.4MEDIUM1Highest87
commons-codec-1.15.jarcpe:2.3:a:apache:commons_net:1.15:*:*:*:*:*:*:*pkg:maven/commons-codec/commons-codec@1.15MEDIUM1Highest110
commons-collections-3.2.2.jarcpe:2.3:a:apache:commons_collections:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_net:3.2.2:*:*:*:*:*:*:*		pkg:maven/commons-collections/commons-collections@3.2.2MEDIUM1Highest86
commons-collections4-4.0.jarcpe:2.3:a:apache:commons_collections:4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_net:4.0:*:*:*:*:*:*:*		pkg:maven/org.apache.commons/commons-collections4@4.0HIGH1Highest99
commons-csv-1.6.jarcpe:2.3:a:apache:commons_net:1.6:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-csv@1.6MEDIUM1Highest85
commons-dbcp-1.4.jarcpe:2.3:a:apache:commons_net:1.4:*:*:*:*:*:*:*pkg:maven/commons-dbcp/commons-dbcp@1.4MEDIUM1Highest96
commons-digester-2.1.jarcpe:2.3:a:apache:commons_net:2.1:*:*:*:*:*:*:*pkg:maven/commons-digester/commons-digester@2.1MEDIUM1Highest98
commons-digester3-3.2.jarcpe:2.3:a:apache:commons_net:3.2:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-digester3@3.2MEDIUM1Highest105
commons-exec-1.3.jarcpe:2.3:a:apache:commons_net:1.3:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-exec@1.3MEDIUM1Highest61
commons-fileupload-1.4.jarcpe:2.3:a:apache:commons_fileupload:1.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_net:1.4:*:*:*:*:*:*:*		pkg:maven/commons-fileupload/commons-fileupload@1.4MEDIUM1Highest117
commons-httpclient-3.1.jarcpe:2.3:a:apache:commons-httpclient:3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_net:3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:httpclient:3.1:*:*:*:*:*:*:*		pkg:maven/commons-httpclient/commons-httpclient@3.1MEDIUM3Highest91
commons-io-2.11.0.jarcpe:2.3:a:apache:commons_io:2.11.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_net:2.11.0:*:*:*:*:*:*:*		pkg:maven/commons-io/commons-io@2.11.0MEDIUM1Highest125
commons-jaxrs-1.30.jarpkg:maven/edu.psu.swe.commons/commons-jaxrs@1.30 067
commons-jexl-2.1.1.jarcpe:2.3:a:apache:commons_net:2.1.1:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-jexl@2.1.1MEDIUM1Highest90
commons-jexl3-3.0.jarcpe:2.3:a:apache:commons_net:3.0:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-jexl3@3.0MEDIUM1Highest93
commons-lang-2.6.jarcpe:2.3:a:apache:commons_net:2.6:*:*:*:*:*:*:*pkg:maven/commons-lang/commons-lang@2.6MEDIUM1Highest122
commons-lang3-3.12.0.jarcpe:2.3:a:apache:commons_net:3.12.0:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-lang3@3.12.0 0Highest141
commons-logging-1.2.jarcpe:2.3:a:apache:commons_net:1.2:*:*:*:*:*:*:*pkg:maven/commons-logging/commons-logging@1.2MEDIUM1Highest117
commons-math-1.2.jarcpe:2.3:a:apache:commons_net:1.2:*:*:*:*:*:*:*pkg:maven/commons-math/commons-math@1.2MEDIUM1Highest82
commons-net-3.6.jarcpe:2.3:a:apache:commons_net:3.6:*:*:*:*:*:*:*pkg:maven/commons-net/commons-net@3.6MEDIUM1Highest97
commons-pool-1.6.jarcpe:2.3:a:apache:commons_net:1.6:*:*:*:*:*:*:*pkg:maven/commons-pool/commons-pool@1.6MEDIUM1Highest75
commons-text-1.10.0.jarcpe:2.3:a:apache:commons_net:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_text:1.10.0:*:*:*:*:*:*:*		pkg:maven/org.apache.commons/commons-text@1.10.0MEDIUM1Highest73
commons-validator-1.6.jarcpe:2.3:a:apache:commons_net:1.6:*:*:*:*:*:*:*pkg:maven/commons-validator/commons-validator@1.6MEDIUM1Highest127
commons-vfs2-2.4.1.jarcpe:2.3:a:apache:commons_net:2.4.1:*:*:*:*:*:*:*pkg:maven/org.apache.commons/commons-vfs2@2.4.1MEDIUM1Highest42
content-type-2.2.jarpkg:maven/com.nimbusds/content-type@2.2 047
converter-moshi-2.7.2.jarpkg:maven/com.squareup.retrofit2/converter-moshi@2.7.2 021
cron-parser-core-3.4.jarpkg:maven/net.redhogs.cronparser/cron-parser-core@3.4 024
csrfguard-4.1.4.jarcpe:2.3:a:owasp:csrfguard:4.1.4:*:*:*:*:*:*:*pkg:maven/org.owasp/csrfguard@4.1.4HIGH1Highest26
csrfguard-4.1.4.jar: csrfguard.js 00
csrfguard-jsp-tags-4.1.4.jarcpe:2.3:a:owasp:csrfguard:4.1.4:*:*:*:*:*:*:*pkg:maven/org.owasp/csrfguard-jsp-tags@4.1.4 0Highest26
dom4j-2.1.3.jarcpe:2.3:a:dom4j_project:dom4j:2.1.3:*:*:*:*:*:*:*pkg:maven/org.dom4j/dom4j@2.1.3 0Highest20
duo-client-0.3.0.jarpkg:maven/com.duosecurity/duo-client@0.3.0 028
edu.internet2.middleware.grouper:grouper-ui:2.6.0-SNAPSHOTcpe:2.3:a:internet2:grouper:2.6.0:snapshot:*:*:*:*:*:*pkg:maven/edu.internet2.middleware.grouper/grouper-ui@2.6.0-SNAPSHOT 0Highest6
edu.internet2.middleware.grouper:grouper-ws-java-generated-client:2.6.0-SNAPSHOTcpe:2.3:a:internet2:grouper:2.6.0:snapshot:*:*:*:*:*:*pkg:maven/edu.internet2.middleware.grouper/grouper-ws-java-generated-client@2.6.0-SNAPSHOT 0Highest6
edu.internet2.middleware.grouper:grouper-ws:2.6.0-SNAPSHOTcpe:2.3:a:internet2:grouper:2.6.0:snapshot:*:*:*:*:*:*pkg:maven/edu.internet2.middleware.grouper/grouper-ws@2.6.0-SNAPSHOT 0Highest6
edu.internet2.middleware.grouper:grouper:2.6.0-SNAPSHOTcpe:2.3:a:internet2:grouper:2.6.0:snapshot:*:*:*:*:*:*pkg:maven/edu.internet2.middleware.grouper/grouper@2.6.0-SNAPSHOT 0Highest6
edu.internet2.middleware.grouper:grouperClient:2.6.0-SNAPSHOTcpe:2.3:a:internet2:grouper:2.6.0:snapshot:*:*:*:*:*:*pkg:maven/edu.internet2.middleware.grouper/grouperClient@2.6.0-SNAPSHOT 0Highest6
ehcache-core-2.6.10.jarpkg:maven/net.sf.ehcache/ehcache-core@2.6.10 022
ehcache-core-2.6.10.jar: sizeof-agent.jarpkg:maven/net.sf.ehcache/sizeof-agent@1.0.1 028
ezmorph-1.0.6.jarpkg:maven/net.sf.ezmorph/ezmorph@1.0.6 032
geronimo-activation_1.1_spec-1.0.2.jarpkg:maven/org.apache.geronimo.specs/geronimo-activation_1.1_spec@1.0.2 023
geronimo-annotation_1.1_spec-1.0.jarpkg:maven/org.apache.geronimo.specs/geronimo-annotation_1.1_spec@1.0 031
geronimo-j2ee-management_1.1_spec-1.0.1.jarpkg:maven/org.apache.geronimo.specs/geronimo-j2ee-management_1.1_spec@1.0.1 025
geronimo-javamail_1.4_spec-1.6.jarpkg:maven/org.apache.geronimo.specs/geronimo-javamail_1.4_spec@1.6 028
geronimo-javamail_1.4_spec-1.7.1.jarpkg:maven/org.apache.geronimo.specs/geronimo-javamail_1.4_spec@1.7.1 033
geronimo-jaxrs_1.1_spec-1.0.jarpkg:maven/org.apache.geronimo.specs/geronimo-jaxrs_1.1_spec@1.0 035
geronimo-jms_1.1_spec-1.1.1.jarpkg:maven/org.apache.geronimo.specs/geronimo-jms_1.1_spec@1.1.1 023
geronimo-jms_1.1_spec-1.1.jarpkg:maven/org.apache.geronimo.specs/geronimo-jms_1.1_spec@1.1 018
geronimo-jms_2.0_spec-1.0-alpha-2.jarpkg:maven/org.apache.geronimo.specs/geronimo-jms_2.0_spec@1.0-alpha-2 030
geronimo-jta_1.1_spec-1.1.jarpkg:maven/org.apache.geronimo.specs/geronimo-jta_1.1_spec@1.1 016
geronimo-stax-api_1.0_spec-1.0.1.jarpkg:maven/org.apache.geronimo.specs/geronimo-stax-api_1.0_spec@1.0.1 023
geronimo-ws-metadata_2.0_spec-1.1.2.jarcpe:2.3:a:web_project:web:1.1.2:*:*:*:*:*:*:*pkg:maven/org.apache.geronimo.specs/geronimo-ws-metadata_2.0_spec@1.1.2 0Low23
google-api-client-1.25.0.jarpkg:maven/com.google.api-client/google-api-client@1.25.0 033
google-api-services-admin-directory-directory_v1-rev118-1.25.0.jarpkg:maven/com.google.apis/google-api-services-admin-directory@directory_v1-rev118-1.25.0 028
google-api-services-groupssettings-v1-rev82-1.25.0.jarpkg:maven/com.google.apis/google-api-services-groupssettings@v1-rev82-1.25.0 028
google-http-client-1.25.0.jarpkg:maven/com.google.http-client/google-http-client@1.25.0 031
google-http-client-jackson2-1.25.0.jarpkg:maven/com.google.http-client/google-http-client-jackson2@1.25.0 021
google-oauth-client-1.25.0.jarcpe:2.3:a:google:oauth_client_library_for_java:1.25.0:*:*:*:*:*:*:*pkg:maven/com.google.oauth-client/google-oauth-client@1.25.0CRITICAL2Low31
groovy-2.5.18.jarcpe:2.3:a:apache:groovy:2.5.18:*:*:*:*:*:*:*pkg:maven/org.codehaus.groovy/groovy@2.5.18 0Highest294
groovy-xml-2.5.18.jarcpe:2.3:a:apache:groovy:2.5.18:*:*:*:*:*:*:*pkg:maven/org.codehaus.groovy/groovy-xml@2.5.18 0High289
gson-2.9.0.jarcpe:2.3:a:google:gson:2.9.0:*:*:*:*:*:*:*pkg:maven/com.google.code.gson/gson@2.9.0 0Highest33
guava-18.0.jarcpe:2.3:a:google:guava:18.0:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@18.0MEDIUM2Highest20
guava-20.0.jarcpe:2.3:a:google:guava:20.0:*:*:*:*:*:*:*pkg:maven/com.google.guava/guava@20.0MEDIUM2Highest22
hawtbuf-1.9.jarpkg:maven/org.fusesource.hawtbuf/hawtbuf@1.9 028
hawtdispatch-1.11.jarpkg:maven/org.fusesource.hawtdispatch/hawtdispatch@1.11 022
hawtdispatch-transport-1.11.jarpkg:maven/org.fusesource.hawtdispatch/hawtdispatch-transport@1.11 024
hibernate-commons-annotations-5.1.2.Final.jarpkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final 047
hibernate-core-5.6.10.Final.jarcpe:2.3:a:hibernate:hibernate_orm:5.6.10:*:*:*:*:*:*:*pkg:maven/org.hibernate/hibernate-core@5.6.10.Final 0Low48
hk2-api-2.6.1.jarcpe:2.3:a:oracle:java_se:2.6.1:*:*:*:*:*:*:*pkg:maven/org.glassfish.hk2/hk2-api@2.6.1 0Low28
hk2-locator-2.6.1.jarcpe:2.3:a:service_project:service:2.6.1:*:*:*:*:*:*:*pkg:maven/org.glassfish.hk2/hk2-locator@2.6.1 0Low23
hk2-utils-2.6.1.jarcpe:2.3:a:utils_project:utils:2.6.1:*:*:*:*:*:*:*pkg:maven/org.glassfish.hk2/hk2-utils@2.6.1MEDIUM1Highest29
httpclient-4.5.13.jarcpe:2.3:a:apache:httpclient:4.5.13:*:*:*:*:*:*:*pkg:maven/org.apache.httpcomponents/httpclient@4.5.13 0Highest32
httpcore-4.4.14.jarpkg:maven/org.apache.httpcomponents/httpcore@4.4.14 032
httpmime-4.5.13.jarpkg:maven/org.apache.httpcomponents/httpmime@4.5.13 030
ion-java-1.0.2.jarpkg:maven/software.amazon.ion/ion-java@1.0.2 034
istack-commons-runtime-3.0.7.jarcpe:2.3:a:apache:commons_net:3.0.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:3.0.7:*:*:*:*:*:*:*		pkg:maven/com.sun.istack/istack-commons-runtime@3.0.7MEDIUM1Low34
j2objc-annotations-1.1.jarpkg:maven/com.google.j2objc/j2objc-annotations@1.1 024
jackson-annotations-2.9.0.jarcpe:2.3:a:fasterxml:jackson-modules-java8:2.9.0:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.9.0MEDIUM1Low39
jackson-core-2.13.3.jarcpe:2.3:a:fasterxml:jackson-modules-java8:2.13.3:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3 0Low51
jackson-core-2.14.0.jarcpe:2.3:a:fasterxml:jackson-modules-java8:2.14.0:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.0 0Low49
jackson-databind-2.13.3.jarcpe:2.3:a:fasterxml:jackson-databind:2.13.3:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.13.3:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.3HIGH2Highest45
jackson-databind-2.14.0.jarcpe:2.3:a:fasterxml:jackson-databind:2.14.0:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.14.0:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.14.0 0Highest43
jackson-dataformat-cbor-2.12.6.jarcpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.6:*:*:*:*:*:*:*pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.12.6 0Low41
jackson-dataformat-yaml-2.4.2.jar (shaded: org.yaml:snakeyaml:1.12)cpe:2.3:a:snakeyaml_project:snakeyaml:1.12:*:*:*:*:*:*:*
cpe:2.3:a:yaml_project:yaml:1.12:*:*:*:*:*:*:*		pkg:maven/org.yaml/snakeyaml@1.12HIGH10Highest21
jackson-dataformat-yaml-2.4.2.jarcpe:2.3:a:fasterxml:jackson-dataformat-xml:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:yaml_project:yaml:2.4.2:*:*:*:*:*:*:*		pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml@2.4.2 0Highest40
jackson-datatype-joda-2.4.2.jarpkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-joda@2.4.2 040
jackson-jaxrs-base-2.14.0.jarpkg:maven/com.fasterxml.jackson.jaxrs/jackson-jaxrs-base@2.14.0 039
jackson-jaxrs-json-provider-2.14.0.jarpkg:maven/com.fasterxml.jackson.jaxrs/jackson-jaxrs-json-provider@2.14.0 039
jackson-module-jaxb-annotations-2.14.0.jarpkg:maven/com.fasterxml.jackson.module/jackson-module-jaxb-annotations@2.14.0 041
jakarta.activation-api-1.2.2.jarpkg:maven/jakarta.activation/jakarta.activation-api@1.2.2 033
jakarta.annotation-api-1.3.5.jarcpe:2.3:a:oracle:java_se:1.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:projects:1.3.5:*:*:*:*:*:*:*		pkg:maven/jakarta.annotation/jakarta.annotation-api@1.3.5 0Low37
jakarta.inject-2.6.1.jarcpe:2.3:a:oracle:java_se:2.6.1:*:*:*:*:*:*:*pkg:maven/org.glassfish.hk2.external/jakarta.inject@2.6.1 0Low27
jakarta.validation-api-2.0.2.jarpkg:maven/jakarta.validation/jakarta.validation-api@2.0.2 058
jakarta.ws.rs-api-2.1.6.jarcpe:2.3:a:web_project:web:2.1.6:*:*:*:*:*:*:*pkg:maven/jakarta.ws.rs/jakarta.ws.rs-api@2.1.6 0Low45
jakarta.xml.bind-api-2.3.3.jarpkg:maven/jakarta.xml.bind/jakarta.xml.bind-api@2.3.3 035
jandex-2.0.4.Final.jarpkg:maven/org.jboss/jandex@2.0.4.Final 040
jasypt-1.9.0.jarcpe:2.3:a:jasypt_project:jasypt:1.9.0:*:*:*:*:*:*:*pkg:maven/org.jasypt/jasypt@1.9.0HIGH1Highest30
java-ipv6-0.17.jarpkg:maven/com.googlecode.java-ipv6/java-ipv6@0.17 020
java-jwt-3.10.3.jarpkg:maven/com.auth0/java-jwt@3.10.3 037
javaee-api-7.0.jarpkg:maven/javax/javaee-api@7.0
pkg:maven/org.glassfish.main/javaee-api@4.0-SNAPSHOT		 035
javassist-3.22.0-GA.jarpkg:maven/org.javassist/javassist@3.22.0-GA 058
javax.activation-api-1.2.0.jarpkg:maven/javax.activation/javax.activation-api@1.2.0 039
javax.mail-1.5.0.jarpkg:maven/com.sun.mail/javax.mail@1.5.0 040
javax.mail-api-1.6.0.jarpkg:maven/javax.mail/javax.mail-api@1.6.0 039
javax.persistence-api-2.2.jarcpe:2.3:a:oracle:java_se:2.2:*:*:*:*:*:*:*pkg:maven/javax.persistence/javax.persistence-api@2.2 0Low34
javax.servlet-api-3.1.0.jarcpe:2.3:a:oracle:java_se:3.1.0:*:*:*:*:*:*:*pkg:maven/javax.servlet/javax.servlet-api@3.1.0 0Medium49
javax.servlet.jsp-api-2.3.2-b02.jarcpe:2.3:a:oracle:java_se:2.3.2:b02:*:*:*:*:*:*
cpe:2.3:a:oracle:jsp:2.3.2:b02:*:*:*:*:*:*		pkg:maven/javax.servlet.jsp/javax.servlet.jsp-api@2.3.2-b02 0High43
javax.servlet.jsp.jstl-api-1.2.1.jarcpe:2.3:a:oracle:java_se:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jsp:1.2.1:*:*:*:*:*:*:*		pkg:maven/javax.servlet.jsp.jstl/javax.servlet.jsp.jstl-api@1.2.1 0High47
jaxb-api-2.2.jarpkg:maven/javax.xml.bind/jaxb-api@2.2 022
jaxb-api-2.3.1.jarcpe:2.3:a:oracle:java_se:2.3.1:*:*:*:*:*:*:*pkg:maven/javax.xml.bind/jaxb-api@2.3.1 0Low37
jaxb-impl-2.2.1.1.jarpkg:maven/com.sun.xml.bind/jaxb-impl@2.2.1.1 027
jaxb-runtime-2.3.1.jarpkg:maven/org.glassfish.jaxb/jaxb-runtime@2.3.1 032
jaxen-1.1.1.jarpkg:maven/jaxen/jaxen@1.1.1 0118
jaxen-1.1.6.jarpkg:maven/jaxen/jaxen@1.1.6 0117
jboss-logging-3.3.1.Final.jarpkg:maven/org.jboss.logging/jboss-logging@3.3.1.Final 042
jboss-transaction-api_1.2_spec-1.1.1.Final.jarpkg:maven/org.jboss.spec.javax.transaction/jboss-transaction-api_1.2_spec@1.1.1.Final 041
jcip-annotations-1.0-1.jarpkg:maven/com.github.stephenc.jcip/jcip-annotations@1.0-1 025
jersey-server-2.36.jarcpe:2.3:a:jersey_project:jersey:2.36:*:*:*:*:*:*:*pkg:maven/org.glassfish.jersey.core/jersey-server@2.36 0Highest31
jetty-6.1.26.jarcpe:2.3:a:jetty:jetty:6.1.26:*:*:*:*:*:*:*
cpe:2.3:a:mortbay:jetty:6.1.26:*:*:*:*:*:*:*
cpe:2.3:a:mortbay_jetty:jetty:6.1.26:*:*:*:*:*:*:*		pkg:maven/org.mortbay.jetty/jetty@6.1.26MEDIUM2Highest34
jline-2.14.5.jarpkg:maven/jline/jline@2.14.5 037
jmespath-java-1.12.267.jarcpe:2.3:a:amazon:aws-sdk-java:1.12.267:*:*:*:*:*:*:*pkg:maven/com.amazonaws/jmespath-java@1.12.267 0Low28
joda-time-2.9.9.jarcpe:2.3:a:time_project:time:2.9.9:*:*:*:*:*:*:*pkg:maven/joda-time/joda-time@2.9.9 0Highest45
jose4j-0.4.4.jarpkg:maven/org.bitbucket.b_c/jose4j@0.4.4 035
jsch-0.1.55.jarcpe:2.3:a:jcraft:jsch:0.1.55:*:*:*:*:*:*:*pkg:maven/com.jcraft/jsch@0.1.55 0Highest34
json-20140107.jarpkg:maven/org.json/json@20140107HIGH126
json-lib-2.4-jdk15.jarpkg:maven/net.sf.json-lib/json-lib@2.4 013
json-smart-2.4.8.jarcpe:2.3:a:ini-parser_project:ini-parser:2.4.8:*:*:*:*:*:*:*
cpe:2.3:a:json-smart_project:json-smart-v2:2.4.8:*:*:*:*:*:*:*		pkg:maven/net.minidev/json-smart@2.4.8 0Low51
jsoup-1.15.3.jarcpe:2.3:a:jsoup:jsoup:1.15.3:*:*:*:*:*:*:*pkg:maven/org.jsoup/jsoup@1.15.3 0Highest42
jsr305-3.0.2.jarpkg:maven/com.google.code.findbugs/jsr305@3.0.2 017
jsr311-api-1.1.1.jarcpe:2.3:a:web_project:web:1.1.1:*:*:*:*:*:*:*pkg:maven/javax.ws.rs/jsr311-api@1.1.1 0Low36
jta-1.1.jarpkg:maven/javax.transaction/jta@1.1 022
kahadb-5.7.0.jarcpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*pkg:maven/org.apache.activemq/kahadb@5.7.0CRITICAL24Highest25
lang-tag-1.7.jarpkg:maven/com.nimbusds/lang-tag@1.7 049
ldaptive-1.2.4.jarcpe:2.3:a:ldaptive:ldaptive:1.2.4:*:*:*:*:*:*:*pkg:maven/org.ldaptive/ldaptive@1.2.4 0Highest23
log4j-core-2.17.1.jarcpe:2.3:a:apache:log4j:2.17.1:*:*:*:*:*:*:*pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1 0Highest50
log4j-slf4j-impl-2.17.1.jarpkg:maven/org.apache.logging.log4j/log4j-slf4j-impl@2.17.1 046
logging-interceptor-3.14.7.jarcpe:2.3:a:squareup:okhttp:3.14.7:*:*:*:*:*:*:*
cpe:2.3:a:squareup:okhttp3:3.14.7:*:*:*:*:*:*:*		pkg:maven/com.squareup.okhttp3/logging-interceptor@3.14.7 0Highest19
lombok-1.14.8.jarpkg:maven/org.projectlombok/lombok@1.14.8 040
mail-1.4.7.jarpkg:maven/javax.mail/mail@1.4.7 044
mchange-commons-java-0.2.15.jarpkg:maven/com.mchange/mchange-commons-java@0.2.15 029
mex-1.6.3-impl.jarcpe:2.3:a:apache:axis:1.6.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:axis2:1.6.3:*:*:*:*:*:*:*		pkg:maven/org.apache.axis2/mex@1.6.3 0Highest27
minimal-json-0.9.1.jarpkg:maven/com.eclipsesource.minimal-json/minimal-json@0.9.1
pkg:maven/com.eclipsesource.minimal-json/minimal-json@0.9.1-SNAPSHOT		 033
moshi-1.8.0.jarpkg:maven/com.squareup.moshi/moshi@1.8.0 019
mqtt-client-1.3.jarcpe:2.3:a:mqtt:mqtt:1.3:*:*:*:*:*:*:*pkg:maven/org.fusesource.mqtt-client/mqtt-client@1.3HIGH1Highest29
mxparser-1.2.2.jarpkg:maven/io.github.x-stream/mxparser@1.2.2 058
mysql-connector-java-8.0.28.jarcpe:2.3:a:mysql:mysql:8.0.28:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_connector\/j:8.0.28:*:*:*:*:*:*:*		pkg:maven/mysql/mysql-connector-java@8.0.28 0Highest44
neethi-3.0.2.jarpkg:maven/org.apache.neethi/neethi@3.0.2 086
netty-common-4.1.72.Final.jar (shaded: org.jctools:jctools-core:3.1.0)pkg:maven/org.jctools/jctools-core@3.1.0 09
netty-tcnative-classes-2.0.46.Final.jarpkg:maven/io.netty/netty-tcnative-classes@2.0.46.Final 035
netty-transport-4.1.72.Final.jarcpe:2.3:a:netty:netty:4.1.72:*:*:*:*:*:*:*pkg:maven/io.netty/netty-transport@4.1.72.FinalHIGH3Highest32
nimbus-jose-jwt-9.24.4.jar (shaded: com.google.code.gson:gson:2.9.1)cpe:2.3:a:google:gson:2.9.1:*:*:*:*:*:*:*pkg:maven/com.google.code.gson/gson@2.9.1 0Highest9
nimbus-jose-jwt-9.24.4.jarcpe:2.3:a:connect2id:nimbus_jose\+jwt:9.24.4:*:*:*:*:*:*:*pkg:maven/com.nimbusds/nimbus-jose-jwt@9.24.4 0Highest55
oauth2-oidc-sdk-9.43.1.jarpkg:maven/com.nimbusds/oauth2-oidc-sdk@9.43.1 059
okhttp-3.14.7.jarcpe:2.3:a:squareup:okhttp:3.14.7:*:*:*:*:*:*:*
cpe:2.3:a:squareup:okhttp3:3.14.7:*:*:*:*:*:*:*		pkg:maven/com.squareup.okhttp3/okhttp@3.14.7HIGH1Highest17
okio-1.17.2.jarpkg:maven/com.squareup.okio/okio@1.17.2 017
opensaml-2.6.4.jarcpe:2.3:a:shibboleth:opensaml:2.6.4:*:*:*:*:*:*:*pkg:maven/org.opensaml/opensaml@2.6.4 0Highest83
openws-1.5.4.jarpkg:maven/org.opensaml/openws@1.5.4 080
org.apache.felix.framework-7.0.3.jarcpe:2.3:a:sun:sun_ftp:7.0.3:*:*:*:*:*:*:*pkg:maven/org.apache.felix/org.apache.felix.framework@7.0.3 0Low41
org.wso2.charon.core-2.1.3.jarpkg:maven/org.wso2.charon/org.wso2.charon.core@2.1.3 028
org.wso2.charon.samples-2.1.3.jarpkg:maven/org.wso2.charon/org.wso2.charon.samples@2.1.3 028
org.wso2.charon.utils-2.1.3.jarcpe:2.3:a:utils_project:utils:2.1.3:*:*:*:*:*:*:*pkg:maven/org.wso2.charon/org.wso2.charon.utils@2.1.3MEDIUM1Highest28
oro-2.0.8.jarpkg:maven/oro/oro@2.0.8 016
osgi-resource-locator-1.0.3.jarcpe:2.3:a:oracle:java_se:1.0.3:*:*:*:*:*:*:*pkg:maven/org.glassfish.hk2/osgi-resource-locator@1.0.3 0Low36
picocli-4.3.2.jarpkg:maven/info.picocli/picocli@4.3.2 036
postgresql-42.5.1.jarcpe:2.3:a:postgresql:postgresql_jdbc_driver:42.5.1:*:*:*:*:*:*:*pkg:maven/org.postgresql/postgresql@42.5.1 0Low71
protobuf-java-3.11.4.jarcpe:2.3:a:google:protobuf-java:3.11.4:*:*:*:*:*:*:*pkg:maven/com.google.protobuf/protobuf-java@3.11.4HIGH4Highest27
proton-j-0.33.10.jarcpe:2.3:a:apache:qpid:0.33.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:qpid_proton:0.33.10:*:*:*:*:*:*:*
cpe:2.3:a:apache:qpid_proton-j:0.33.10:*:*:*:*:*:*:*
cpe:2.3:a:proton_project:proton:0.33.10:*:*:*:*:*:*:*		pkg:maven/org.apache.qpid/proton-j@0.33.10 0Highest30
qpid-jms-client-0.61.0.jarcpe:2.3:a:apache:qpid:0.61.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:qpid_java:0.61.0:*:*:*:*:*:*:*		pkg:maven/org.apache.qpid/qpid-jms-client@0.61.0MEDIUM1Highest27
quartz-2.3.2.jarcpe:2.3:a:softwareag:quartz:2.3.2:*:*:*:*:*:*:*pkg:maven/org.quartz-scheduler/quartz@2.3.2 0Highest33
rampart-core-1.6.3.jarpkg:maven/org.apache.rampart/rampart-core@1.6.3 023
rampart-policy-1.6.3.jarpkg:maven/org.apache.rampart/rampart-policy@1.6.3 021
rampart-trust-1.6.3.jarpkg:maven/org.apache.rampart/rampart-trust@1.6.3 021
reflections-0.9.9.jarpkg:maven/org.reflections/reflections@0.9.9 018
retrofit-2.7.2.jarcpe:2.3:a:squareup:retrofit:2.7.2:*:*:*:*:*:*:*pkg:maven/com.squareup.retrofit2/retrofit@2.7.2 0Highest19
scim-common-2.22.jarpkg:maven/edu.psu.swe.scim/scim-common@2.22 029
scim-server-common-2.22.jarpkg:maven/edu.psu.swe.scim/scim-server-common@2.22 029
scim-spec-protocol-2.22.jarpkg:maven/edu.psu.swe.scim/scim-spec-protocol@2.22 029
scim-spec-schema-2.22.jarpkg:maven/edu.psu.swe.scim/scim-spec-schema@2.22 029
scim2-sdk-client-2.3.7.jarpkg:maven/com.unboundid.product.scim2/scim2-sdk-client@2.3.7 037
scim2-sdk-common-2.3.7.jarpkg:maven/com.unboundid.product.scim2/scim2-sdk-common@2.3.7 038
scim2-sdk-server-2.3.7.jarpkg:maven/com.unboundid.product.scim2/scim2-sdk-server@2.3.7 037
serializer-2.7.1.jarcpe:2.3:a:apache:xalan-java:2.7.1:*:*:*:*:*:*:*pkg:maven/xalan/serializer@2.7.1HIGH2Low32
servlet-api-2.3.jarpkg:maven/javax.servlet/servlet-api@2.3 016
slf4j-api-1.7.32.jarpkg:maven/org.slf4j/slf4j-api@1.7.32 027
smack-3.1.0.jarpkg:maven/jivesoftware/smack@3.1.0MEDIUM222
spring-aop-3.0.7.RELEASE.jarcpe:2.3:a:pivotal_software:spring_framework:3.0.7:release:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:3.0.7:release:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:3.0.7:release:*:*:*:*:*:*		pkg:maven/org.springframework/spring-aop@3.0.7.RELEASECRITICAL18Highest26
spring-core-3.0.7.RELEASE.jarcpe:2.3:a:pivotal_software:spring_framework:3.0.7:release:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:3.0.7:release:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:3.0.7:release:*:*:*:*:*:*		pkg:maven/org.springframework/spring-core@3.0.7.RELEASECRITICAL19Highest26
standard-1.1.2.jarcpe:2.3:a:apache:standard_taglibs:1.1.2:*:*:*:*:*:*:*pkg:maven/taglibs/standard@1.1.2HIGH1Highest23
stax-api-1.0-2.jarpkg:maven/javax.xml.stream/stax-api@1.0-2 021
stax-ex-1.8.jarcpe:2.3:a:oracle:java_se:1.8:*:*:*:*:*:*:*pkg:maven/org.jvnet.staxex/stax-ex@1.8 0Low48
stax2-api-3.1.1.jarpkg:maven/org.codehaus.woodstox/stax2-api@3.1.1 036
swagger-annotations-1.5.0.jarpkg:maven/io.swagger/swagger-annotations@1.5.0 031
swagger-annotations-1.6.3.jarpkg:maven/io.swagger/swagger-annotations@1.6.3 031
swagger-core-1.5.0.jarpkg:maven/io.swagger/swagger-core@1.5.0 024
swagger-jaxrs-1.5.0.jarpkg:maven/io.swagger/swagger-jaxrs@1.5.0 024
swagger-models-1.5.0.jarpkg:maven/io.swagger/swagger-models@1.5.0 030
txw2-2.3.1.jarpkg:maven/org.glassfish.jaxb/txw2@2.3.1 034
unboundid-ldapsdk-4.0.9.jarcpe:2.3:a:pingidentity:ldapsdk:4.0.9:*:*:*:*:*:*:*pkg:maven/com.unboundid/unboundid-ldapsdk@4.0.9 0Highest49
validation-api-1.1.0.Final.jarpkg:maven/javax.validation/validation-api@1.1.0.Final 042
wink-client-1.4.jarcpe:2.3:a:apache:wink:1.4:*:*:*:*:*:*:*
cpe:2.3:a:wink:wink:1.4:*:*:*:*:*:*:*		pkg:maven/org.apache.wink/wink-client@1.4CRITICAL1Highest32
woden-api-1.0M9.jarpkg:maven/org.apache.woden/woden-api@1.0M9 027
woden-impl-commons-1.0M9.jarcpe:2.3:a:apache:commons_net:1.0:m9:*:*:*:*:*:*pkg:maven/org.apache.woden/woden-impl-commons@1.0M9MEDIUM1Highest27
woden-impl-dom-1.0M9.jarpkg:maven/org.apache.woden/woden-impl-dom@1.0M9 027
woodstox-core-asl-4.1.4.jarpkg:maven/org.codehaus.woodstox/woodstox-core-asl@4.1.4 031
woodstox-core-asl-4.2.0.jarpkg:maven/org.codehaus.woodstox/woodstox-core-asl@4.2.0 037
wsdl4j-1.6.2.jarpkg:maven/wsdl4j/wsdl4j@1.6.2 020
wss4j-1.6.19.jarcpe:2.3:a:apache:wss4j:1.6.19:*:*:*:*:*:*:*pkg:maven/org.apache.ws.security/wss4j@1.6.19 0Highest42
wstx-asl-3.2.9.jarpkg:maven/org.codehaus.woodstox/wstx-asl@3.2.9HIGH130
xalan-2.7.1.jarcpe:2.3:a:apache:xalan-java:2.7.1:*:*:*:*:*:*:*pkg:maven/xalan/xalan@2.7.1HIGH2Low66
xercesImpl-2.12.2.jarcpe:2.3:a:apache:xerces-j:2.12.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:xerces2_java:2.12.2:*:*:*:*:*:*:*		pkg:maven/xerces/xercesImpl@2.12.2MEDIUM1Low84
xml-apis-1.4.01.jarcpe:2.3:a:apache:commons_net:1.4.01:*:*:*:*:*:*:*pkg:maven/xml-apis/xml-apis@1.4.01MEDIUM1Low87
xmlpull-1.1.3.1.jarpkg:maven/xmlpull/xmlpull@1.1.3.1 018
xmlsec-1.5.8.jarcpe:2.3:a:apache:santuario_xml_security_for_java:1.5.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:xml_security_for_java:1.5.8:*:*:*:*:*:*:*		pkg:maven/org.apache.santuario/xmlsec@1.5.8HIGH1Low44
xmltooling-1.4.4.jarcpe:2.3:a:xmltooling_project:xmltooling:1.4.4:*:*:*:*:*:*:*pkg:maven/org.opensaml/xmltooling@1.4.4MEDIUM1Highest74
xstream-1.4.19.jarcpe:2.3:a:xstream_project:xstream:1.4.19:*:*:*:*:*:*:*pkg:maven/com.thoughtworks.xstream/xstream@1.4.19HIGH3Highest55
zjsonpatch-0.2.4.jarpkg:maven/com.flipkart.zjsonpatch/zjsonpatch@0.2.4 026

Dependencies

FastInfoset-1.2.15.jar

Description:

Open Source implementation of the Fast Infoset Standard for Binary XML (http://www.itu.int/ITU-T/asn1/).

License:

http://www.opensource.org/licenses/apache2.0.php
File Path: /home/grprdist/.m2/repository/com/sun/xml/fastinfoset/FastInfoset/1.2.15/FastInfoset-1.2.15.jar
MD5: 57f3894ad7e069ae740b277d92d10fa0
SHA1: bb7b7ec0379982b97c62cd17465cb6d9155f68e8
SHA256:785861db11ca1bd0d1956682b974ad73eb19cd3e01a4b3fa82d62eca97210aec
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

XmlSchema-1.4.7.jar

Description:

Commons XMLSchema is a light weight schema object model that can be used to manipulate or
        generate a schema. It has a clean, easy to use API and can easily be integrated into an existing project
        since it has almost no dependencies on third party libraries.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/ws/commons/schema/XmlSchema/1.4.7/XmlSchema-1.4.7.jar
MD5: e3dce6afd6690efc9436f0b2147cc584
SHA1: a667ab231d6333105db86efe4a96724f50913e1f
SHA256:aae47bc270758cc6c641b624e670c6702ded4f6cd5e452298ad28bc65c14e00d
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

accessors-smart-2.4.8.jar

Description:

Java reflect give poor performance on getter setter an constructor calls, accessors-smart use ASM to speed up those calls.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/net/minidev/accessors-smart/2.4.8/accessors-smart-2.4.8.jar
MD5: e5761631acc11ded0255af1249937e85
SHA1: 6e1bee5a530caba91893604d6ab41d0edcecca9a
SHA256:7dd705aa1ac0e030f8ee2624e8e77239ae1eef6ccc2621c0b8c189866ee1c42c
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

activation-1.1.1.jar

Description:

The JavaBeans(TM) Activation Framework is used by the JavaMail(TM) API to manage MIME data

License:

COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html
File Path: /home/grprdist/.m2/repository/javax/activation/activation/1.1.1/activation-1.1.1.jar
MD5: 46a37512971d8eca81c3fcf245bf07d2
SHA1: 485de3a253e23f645037828c07f1d7f1af40763a
SHA256:ae475120e9fcd99b4b00b38329bd61cdc5eb754eee03fe66c01f50e137724f99
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

activemq-core-5.7.0.jar

Description:

The ActiveMQ Message Broker and Client implementations

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/activemq/activemq-core/5.7.0/activemq-core-5.7.0.jar
MD5: 479f0354e80231c6895d8862e179ef2c
SHA1: 1e07c5849fbb28bac3bf2528a801758fc58db6af
SHA256:8cb0bbdbd65afa23b55cc2c4b5c5e21c2da4b2534d57374a7fe52b9d1142c362
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

CVE-2014-3600  

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2015-3208 (OSSINDEX)  

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.apache.activemq:activemq-core:5.7.0:*:*:*:*:*:*:*

CVE-2015-5254  

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2016-3088  

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2014-3576  

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2014-3612  

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
CWE-287 Improper Authentication

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2019-0222  

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11775  

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
CWE-295 Improper Certificate Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.4)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-3060  

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
CWE-287 Improper Authentication

CVSSv2:
  • Base Score: MEDIUM (6.4)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2016-0734  

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
CWE-254 7PK - Security Features

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2016-6810  

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2018-8006  

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2020-13947  

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-1941  

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-13920  

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
CWE-306 Missing Authentication for Critical Function

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2012-5784  

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2016-0782  

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.4)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2012-6551  

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
CWE-399 Resource Management Errors

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-1830  

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2015-6524  

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
CWE-255 Credentials Management

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2015-7559  

It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (4.9)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2012-6092  

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js.  NOTE: AMQ-4124 is covered by CVE-2012-6551.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-1879  

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-1880  

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2014-8110  

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

activemq-protobuf-1.1.jar

Description:

    A Simpler Protocol Buffer Java API.  Includes a Proto to Java compiler.

File Path: /home/grprdist/.m2/repository/org/apache/activemq/protobuf/activemq-protobuf/1.1/activemq-protobuf-1.1.jar
MD5: 38add15a7775073053fe3aa81979336c
SHA1: 26682eb801f70563511f7c424dc10e8b3e66340e
SHA256:8323444e48a1920afe37b5f24b6dc139f35793e8a87fa178f6d9c8f92a6f39d1
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

amqp-client-4.12.0.jar

Description:

The RabbitMQ Java client library allows Java applications to interface with RabbitMQ.

License:

ASL 2.0: https://www.apache.org/licenses/LICENSE-2.0.html
GPL v2: https://www.gnu.org/licenses/gpl-2.0.txt
MPL 1.1: https://www.mozilla.org/MPL/MPL-1.1.txt
File Path: /home/grprdist/.m2/repository/com/rabbitmq/amqp-client/4.12.0/amqp-client-4.12.0.jar
MD5: 906413fa9389eb87762d1913b1d342f0
SHA1: eb4cdaae6f0bca1f038524aa1cb23e9919d4d49b
SHA256:fa7ccfd324d53be9d5d98689beb33c286de0fe504febe5f1854a3a2369627b9c
Referenced In Project/Scope:Grouper Rabbitmq:compile

Identifiers

animal-sniffer-annotations-1.9.jar

File Path: /home/grprdist/.m2/repository/org/codehaus/mojo/animal-sniffer-annotations/1.9/animal-sniffer-annotations-1.9.jar
MD5: 41f47a4c81b5a9f76bc7f12af69e4fbe
SHA1: c29299253a087898aaff7f4eac57effa46b1910a
SHA256:cd96feeb47f34b2559704715db7b179a03a3721f9dc4092c345c718e29b42de4
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

annotations-2.0.1.jar

Description:

Annotation supports the FindBugs tool

License:

GNU Lesser Public License: http://www.gnu.org/licenses/lgpl.html
File Path: /home/grprdist/.m2/repository/com/google/code/findbugs/annotations/2.0.1/annotations-2.0.1.jar
MD5: 35ef911c85603829ded63f211feb2d68
SHA1: 9ef6656259841cebfb9fb0697bb122ada4485498
SHA256:893b2203a27e4a8ba9d16cd6ed6e9f730736b4878a6bfffeff06861f32e6631b
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

ant-1.10.12.jar

File Path: /home/grprdist/.m2/repository/org/apache/ant/ant/1.10.12/ant-1.10.12.jar
MD5: f5b97fb267862b35d1eb398defe1831a
SHA1: be08c4f63e92e03bac761404cf77bc270928b6c5
SHA256:5c6a438c3ebe7a306eba452b09fa307b0e60314926177920bca896c4a504eaf6
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

antlr-2.7.7.jar

Description:

    A framework for constructing recognizers, compilers,
    and translators from grammatical descriptions containing
    Java, C#, C++, or Python actions.

License:

BSD License: http://www.antlr.org/license.html
File Path: /home/grprdist/.m2/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar
MD5: f8f1352c52a4c6a500b597596501fc64
SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
SHA256:88fbda4b912596b9f56e8e12e580cc954bacfb51776ecfddd3e18fc1cf56dc4c
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

antlr4-runtime-4.7.1.jar

Description:

The ANTLR 4 Runtime

License:

http://www.antlr.org/license.html
File Path: /home/grprdist/.m2/repository/org/antlr/antlr4-runtime/4.7.1/antlr4-runtime-4.7.1.jar
MD5: 0223e36b3a3fadd05a52221828a4fcf1
SHA1: 946f8aa9daa917dd81a8b818111bec7e288f821a
SHA256:43516d19beae35909e04d06af6c0c58c17bc94e0070c85e8dc9929ca640dc91d
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

aopalliance-1.0.jar

Description:

AOP Alliance

License:

Public Domain
File Path: /home/grprdist/.m2/repository/aopalliance/aopalliance/1.0/aopalliance-1.0.jar
MD5: 04177054e180d09e3998808efa0401c7
SHA1: 0235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
SHA256:0addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

aopalliance-repackaged-2.6.1.jar

Description:

Dependency Injection Kernel

License:

http://www.eclipse.org/legal/epl-2.0, https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/hk2/external/aopalliance-repackaged/2.6.1/aopalliance-repackaged-2.6.1.jar
MD5: 0237846ebdaa7db36b356044a373ffba
SHA1: b2eb0a83bcbb44cc5d25f8b18f23be116313a638
SHA256:bad77f9278d753406360af9e4747bd9b3161554ea9cd3d62411a0ae1f2c141fd
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

apache-mime4j-core-0.7.2.jar

Description:

Java stream based MIME message parser

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/james/apache-mime4j-core/0.7.2/apache-mime4j-core-0.7.2.jar
MD5: 88f799546eca803c53eee01a4ce5edcd
SHA1: a81264fe0265ebe8fd1d8128aad06dc320de6eef
SHA256:4d7434c68f94b81a253c12f28e6bbb4d6239c361d6086a46e22e594bb43ac660
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

asm-7.1.jar

Description:

ASM, a very small and fast Java bytecode manipulation framework

License:

BSD: http://asm.ow2.org/license.html
File Path: /home/grprdist/.m2/repository/org/ow2/asm/asm/7.1/asm-7.1.jar
MD5: 04fc92647ce25b41121683674a50dfdf
SHA1: fa29aa438674ff19d5e1386d2c3527a0267f291e
SHA256:4ab2fa2b6d2cc9ccb1eaa05ea329c407b47b13ed2915f62f8c4b8cc96258d4de
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

aws-java-sdk-core-1.12.267.jar

Description:

The AWS SDK for Java - Core module holds the classes that are used by the individual service clients to interact with Amazon Web Services. Users need to depend on aws-java-sdk artifact for accessing individual client classes.

File Path: /home/grprdist/.m2/repository/com/amazonaws/aws-java-sdk-core/1.12.267/aws-java-sdk-core-1.12.267.jar
MD5: e6f847980566ec95e838933ab1609c69
SHA1: 2562b87f3af418751c2d0bcbe4209dbefa263484
SHA256:0f06b44909ff2d30b2a61229839e3619fe2ac7bc4c5f52536299a8cc8a1ffd51
Referenced In Projects/Scopes:

  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

axiom-api-1.2.11.jar

Description:

The Axiom API

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/ws/commons/axiom/axiom-api/1.2.11/axiom-api-1.2.11.jar
MD5: d94103a1ad757d694e01cdbe93e579b6
SHA1: b24f205af38900582b397e3a808d5e249c828e87
SHA256:5b43bb2e100961229730c69217aac08f772e53eef8275e71c9d77976285d621d
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

axiom-api-1.2.15.jar

Description:

The Axiom API

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/ws/commons/axiom/axiom-api/1.2.15/axiom-api-1.2.15.jar
MD5: 56b93a28558783f249d4f1b18629fdf0
SHA1: e5f4f2a8ba280e0cee2029f8dbf4ac3856281bbd
SHA256:7b1000806a83240e370d852f53071bdc4b247dfe240aa1bc8ae91e439215cc12
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

axiom-dom-1.2.14.jar (shaded: org.apache.ws.commons.axiom:axiom-common-impl:1.2.14)

Description:

Contains implementation classes shared by LLOM and DOOM.

File Path: /home/grprdist/.m2/repository/org/apache/ws/commons/axiom/axiom-dom/1.2.14/axiom-dom-1.2.14.jar/META-INF/maven/org.apache.ws.commons.axiom/axiom-common-impl/pom.xml
MD5: 2bdf56db06a2eadf10c2dfb68be7e6ef
SHA1: 41758129abfa2f6e871b468d2bcc78a541bd8952
SHA256:d33a322665052f8ddf9c2fa62cae421c673bea9bbec2c21674582e9d971caa0d
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

axiom-dom-1.2.14.jar

Description:

The Axiom DOM implementation.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/ws/commons/axiom/axiom-dom/1.2.14/axiom-dom-1.2.14.jar
MD5: 0a769345ff3aa13e1348a64a069bf4e5
SHA1: e56bb2b1e532967818cfcb0c3d17922380db24c2
SHA256:7f3aaf83dfbcfbec5d5ad915f77349d884323f6a28134e1a11e28de0d1792bb1
Referenced In Projects/Scopes:
  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

axiom-impl-1.2.15.jar (shaded: org.apache.ws.commons.axiom:core-aspects:1.2.15)

File Path: /home/grprdist/.m2/repository/org/apache/ws/commons/axiom/axiom-impl/1.2.15/axiom-impl-1.2.15.jar/META-INF/maven/org.apache.ws.commons.axiom/core-aspects/pom.xml
MD5: 4447f584852d04df2322dbcddbe25f58
SHA1: 060acec50c33e97c9b9c1d6837dc52494644273a
SHA256:635931a703e4fbf361b3752c0250b35f51a4df226df29d2226c47e7bad0f2330
Referenced In Projects/Scopes:

  • Grouper WS Generated Client:runtime
  • Grouper WS:runtime
  • Grouper WS Test:runtime

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

axis2-adb-1.6.1.jar

Description:

Axis2 Data Binding module

File Path: /home/grprdist/.m2/repository/org/apache/axis2/axis2-adb/1.6.1/axis2-adb-1.6.1.jar
MD5: 23ee2609a2f6d28e7f83b79b17b40b77
SHA1: 4b97034369d6d94bda9c98d7445d93e548f39ba5
SHA256:fbf32fb63dd4f58395e988ab1f48504612713b25b0eb5a5ebf7d90865fa52090
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile

Identifiers

CVE-2012-5785  

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

axis2-kernel-1.6.4.jar

Description:

Core Parts of Axis2. This includes Axis2 engine, Client API, Addressing support, etc.,

File Path: /home/grprdist/.m2/repository/org/apache/axis2/axis2-kernel/1.6.4/axis2-kernel-1.6.4.jar
MD5: 6feb481699a3da0605e90a376236fb6a
SHA1: 10c0675d66fa311c29a879bcaaa5d202802f7d2e
SHA256:5a0e236e0aba70b31166accd09af7714ab4c7d76f94555887527a3789d4fdb07
Referenced In Projects/Scopes:

  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

axis2-mtompolicy-1.6.3.jar

Description:

Axis2 : MTOM Policy

File Path: /home/grprdist/.m2/repository/org/apache/axis2/axis2-mtompolicy/1.6.3/axis2-mtompolicy-1.6.3.jar
MD5: 1b36029c6d4a0db8c3c6b8c97cd8d99c
SHA1: 5ac00ff3025f6ae62f51b0e303124b55af9f8a73
SHA256:3312c4e17aa01e2bd0dcf4bd3378ab2c7c5e054d4a61f37807c260666f6cf505
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

backport-util-concurrent-3.1.jar

Description:

Dawid Kurzyniec's backport of JSR 166

License:

Public Domain: http://creativecommons.org/licenses/publicdomain
File Path: /home/grprdist/.m2/repository/backport-util-concurrent/backport-util-concurrent/3.1/backport-util-concurrent-3.1.jar
MD5: 748bb0cbf4780b2e3121dc9c12e10cd9
SHA1: 682f7ac17fed79e92f8e87d8455192b63376347b
SHA256:f5759b7fcdfc83a525a036deedcbd32e5b536b625ebc282426f16ca137eb5902
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

bcpkix-jdk15on-1.52.jar

Description:

The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.5 to JDK 1.8. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.

License:

Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcpkix-jdk15on/1.52/bcpkix-jdk15on-1.52.jar
MD5: 72104264eec0fd299cca4b07eada5d5b
SHA1: b8ffac2bbc6626f86909589c8cc63637cc936504
SHA256:8e8e9ac258051ec8d6f7f1128d0ddec800ed87b14e7a55023d0f2850b8049615
Referenced In Project/Scope:Grouper Box:compile

Identifiers

CVE-2020-26939  

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
CWE-203 Information Exposure Through Discrepancy

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

bcpkix-jdk18on-1.72.jar

Description:

The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.8 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcpkix-jdk18on/1.72/bcpkix-jdk18on-1.72.jar
MD5: 4bb2ace2ca16e7fd42a0a0c13d017464
SHA1: bb3fdb5162ccd5085e8d7e57fada4d8eaa571f5a
SHA256:56a054cb170d41fb1f8ba0b29568806258b7ffefdc5e98b77ef96d4740f3d6bc
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

bcprov-jdk15on-1.52.jar

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

License:

Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
MD5: 873ac611cb0d7160c0a3d30eee964454
SHA1: 88a941faf9819d371e3174b5ed56a3f3f7d73269
SHA256:0dc4d181e4d347893c2ddbd2e6cd5d7287fc651c03648fa64b2341c7366b1773
Referenced In Project/Scope:Grouper Box:compile

Identifiers

  • pkg:maven/org.bouncycastle/bcprov-jdk15on@1.52  (Confidence:High)
  • cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.52:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.52:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.52:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.52:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.52:*:*:*:*:*:*:*  (Confidence:Low)  

CVE-2016-1000338  

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
CWE-347 Improper Verification of Cryptographic Signature

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000340  

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
CWE-19 Data Processing Errors

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000342  

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
CWE-347 Improper Verification of Cryptographic Signature

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000343  

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000344  

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.4)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000352  

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.4)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000341  

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
CWE-361 7PK - Time and State

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2016-1000345  

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
CWE-361 7PK - Time and State

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2017-13098  

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
CWE-203 Information Exposure Through Discrepancy

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2020-15522  

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-0187 (OSSINDEX)  

In engineSetMode of BaseBlockCipher.java, there is a possible incorrect cryptographic algorithm chosen due to an incomplete comparison. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-148517383
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.5)
  • Vector: /AV:L/AC:L/Au:/C:H/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.bouncycastle:bcprov-jdk15on:1.52:*:*:*:*:*:*:*

CVE-2016-1000339  

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2020-26939  

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
CWE-203 Information Exposure Through Discrepancy

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2016-1000346  

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
CWE-320 Key Management Errors

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: LOW (3.7)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2015-6644 (OSSINDEX)  

Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.
CWE-200 Information Exposure

CVSSv3:
  • Base Score: LOW (3.3)
  • Vector: CVSS:/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.bouncycastle:bcprov-jdk15on:1.52:*:*:*:*:*:*:*

bcprov-jdk15on-1.59.jar

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

License:

Bouncy Castle Licence: http://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.59/bcprov-jdk15on-1.59.jar
MD5: 7c7e9a51e0c86e26e3cc39b2ed678c4f
SHA1: 2507204241ab450456bdb8e8c0a8f986e418bd99
SHA256:1c31e44e331d25e46d293b3e8ee2d07028a67db011e74cb2443285aed1d59c85
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

  • pkg:maven/org.bouncycastle/bcprov-jdk15on@1.59  (Confidence:High)
  • cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.59:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.59:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.59:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.59:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.59:*:*:*:*:*:*:*  (Confidence:Low)  

CVE-2018-1000613  

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.
CWE-502 Deserialization of Untrusted Data, CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2018-1000180  

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
CWE-327 Use of a Broken or Risky Cryptographic Algorithm

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-15522  

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-0187 (OSSINDEX)  

In engineSetMode of BaseBlockCipher.java, there is a possible incorrect cryptographic algorithm chosen due to an incomplete comparison. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-148517383
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.5)
  • Vector: /AV:L/AC:L/Au:/C:H/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.bouncycastle:bcprov-jdk15on:1.59:*:*:*:*:*:*:*

CVE-2020-26939  

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
CWE-203 Information Exposure Through Discrepancy

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

bcprov-jdk15on-1.70.jar

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.70/bcprov-jdk15on-1.70.jar
MD5: 1809d0449a6374279c01fdd3be26cd92
SHA1: 4636a0d01f74acaf28082fb62b317f1080118371
SHA256:8f3c20e3e2d565d26f33e8d4857a37d0d7f8ac39b62a7026496fcab1bdac30d4
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

  • pkg:maven/org.bouncycastle/bcprov-jdk15on@1.70  (Confidence:High)
  • cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.70:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.70:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.70:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.70:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.70:*:*:*:*:*:*:*  (Confidence:Low)  

bcprov-jdk18on-1.72.jar

Description:

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcprov-jdk18on/1.72/bcprov-jdk18on-1.72.jar
MD5: eb4ed3b81359fb50a828723a4a9ab0b6
SHA1: d8dc62c28a3497d29c93fee3e71c00b27dff41b4
SHA256:39287f2208a753db419f5ca529d6c80f094614aa74d790331126b3c9c6b85fda
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

  • pkg:maven/org.bouncycastle/bcprov-jdk18on@1.72  (Confidence:High)
  • cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.72:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.72:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.72:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.72:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.72:*:*:*:*:*:*:*  (Confidence:Low)  

bcutil-jdk18on-1.72.jar

Description:

The Bouncy Castle Java APIs for ASN.1 extension and utility APIs used to support bcpkix and bctls. This jar contains APIs for JDK 1.8 and up.

License:

Bouncy Castle Licence: https://www.bouncycastle.org/licence.html
File Path: /home/grprdist/.m2/repository/org/bouncycastle/bcutil-jdk18on/1.72/bcutil-jdk18on-1.72.jar
MD5: cade3651656670f716a430c4e3899d93
SHA1: 41f19a69ada3b06fa48781120d8bebe1ba955c77
SHA256:45377fdb6560a971eea725f507d91fd6b8fbd0797d61bfc86f2cb653c58186a4
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

box-java-sdk-2.17.0.jar

Description:

The Box SDK for Java.

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/box/box-java-sdk/2.17.0/box-java-sdk-2.17.0.jar
MD5: ab2a3990bf5cbf6fd54a3333ecfda14f
SHA1: b6e3c0f009f8da7c116635d1813c5788e8cbc7c2
SHA256:77c8802185398f38dc0e8e91f86672d34817fa21410abcb97b1db88bd8e49e8e
Referenced In Project/Scope:Grouper Box:compile

Identifiers

bsh-2.0b5.jar

Description:

BeanShell is a small, free, embeddable Java source interpreter with object scripting language features,
        written in Java. BeanShell dynamically executes standard Java syntax and extends it with common scripting
        conveniences such as loose types, commands, and method closures like those in Perl and JavaScript.

License:

GNU LESSER GENERAL PUBLIC LICENSE: http://www.gnu.org/copyleft/lesser.html
File Path: /home/grprdist/.m2/repository/org/beanshell/bsh/2.0b5/bsh-2.0b5.jar
MD5: 02f72336919d06a8491e82346e10b4d5
SHA1: fdc2ab6ae8b53e0d4761b296c116df747cd85199
SHA256:6232199563807354b3bcb5aceb3dc136502f022c6b0ef743987a83f66fee5a5c
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2016-2510  

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
CWE-19 Data Processing Errors

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

byte-buddy-1.12.9.jar (shaded: net.bytebuddy:byte-buddy-dep:1.12.9)

Description:

        Byte Buddy is a Java library for creating Java classes at run time.
        This artifact is a build of Byte Buddy with a remaining dependency onto ASM.
        You should never depend on this module without repackaging Byte Buddy and ASM into your own namespace.

File Path: /home/grprdist/.m2/repository/net/bytebuddy/byte-buddy/1.12.9/byte-buddy-1.12.9.jar/META-INF/maven/net.bytebuddy/byte-buddy-dep/pom.xml
MD5: f252b6a3ad73a2fe8b82d4e5e252b6e7
SHA1: bd386dc86918b6f7769ad855aa2636b40b639c76
SHA256:71c523053fd9cd841080a5bc89a4740b49f5dedd648e8de0ab064456e3113c14
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

byte-buddy-1.12.9.jar

Description:

        Byte Buddy is a Java library for creating Java classes at run time.
        This artifact is a build of Byte Buddy with all ASM dependencies repackaged into its own name space.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/net/bytebuddy/byte-buddy/1.12.9/byte-buddy-1.12.9.jar
MD5: a120a37aba17a10766b9bc869f90fd2b
SHA1: 424ded9ef3496b0d997ce066f2166a4f7ec7b07a
SHA256:e305b6b5bdf8602bc5012efaa50c96b0fb922a3c60308ee1af85605b74d82710
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

c3p0-0.9.5.4.jar

Description:

a JDBC Connection pooling / Statement caching library

License:

GNU Lesser General Public License, Version 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Eclipse Public License, Version 1.0: http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/grprdist/.m2/repository/com/mchange/c3p0/0.9.5.4/c3p0-0.9.5.4.jar
MD5: 45fd4a89c9fd671a0d1dc97c0ec77abe
SHA1: a21a1d37ae0b59efce99671544f51c34ed1e8def
SHA256:60cf2906cd6ad6771f514a3e848b74b3e3da99c1806f2a63c38e2dd8da5ef11f
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

c3p0-oracle-thin-extras-0.9.5.jar

Description:

a JDBC Connection pooling / Statement caching library

License:

GNU Lesser General Public License, Version 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Eclipse Public License, Version 1.0: http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/grprdist/.m2/repository/com/google/code/maven-play-plugin/com/mchange/c3p0-oracle-thin-extras/0.9.5/c3p0-oracle-thin-extras-0.9.5.jar
MD5: 06b6bb3df31e56a391a5815d0f132715
SHA1: ae706b22bae360f5d360b2a5d207f804a3729ec2
SHA256:d185e4fb6a0165a39a2b85650efa18722ca9b4badef52a7701f081d9ae5ac321
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2019-5427  

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

cglib-3.3.0.jar

File Path: /home/grprdist/.m2/repository/cglib/cglib/3.3.0/cglib-3.3.0.jar
MD5: 6ff304cc2874dd20277a8206fee5fd9a
SHA1: c956b9f9708af5901e9cf05701e9b2b1c25027cc
SHA256:9fe0c26d7464140ccdfe019ac687be1fb906122b508ab54beb810db0f09a9212
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

checker-qual-3.5.0.jar

Description:

        Checker Qual is the set of annotations (qualifiers) and supporting classes
        used by the Checker Framework to type check Java source code.

        Please
        see artifact:
        org.checkerframework:checker

License:

The MIT License: http://opensource.org/licenses/MIT
File Path: /home/grprdist/.m2/repository/org/checkerframework/checker-qual/3.5.0/checker-qual-3.5.0.jar
MD5: 4464def1ed5c10f248ebfe1bccbedf1a
SHA1: 2f50520c8abea66fbd8d26e481d3aef5c673b510
SHA256:729990b3f18a95606fc2573836b6958bcdb44cb52bfbd1b7aa9c339cff35a5a4
Referenced In Projects/Scopes:
  • Grouper Duo:runtime
  • Grouper ActiveMQ Messaging:runtime
  • Grouper PSP-NG:runtime
  • Grouper WS:runtime
  • Grouper WS Test:runtime
  • Grouper Office365 and Azure Provisioner:runtime
  • Grouper AWS Messaging:runtime
  • Grouper Rabbitmq:runtime
  • Grouper Google Apps Provisioner:runtime
  • Grouper UI:runtime
  • Grouper API:runtime
  • Grouper WS Generated Client:runtime
  • Grouper AMQ:runtime
  • Grouper WS SCIM:runtime
  • Grouper SCIM:runtime
  • Grouper Box:runtime
  • Grouper UI webapp:runtime

Identifiers

classmate-1.5.1.jar

Description:

Library for introspecting types with full generic information
        including resolving of field and method types.

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/classmate/1.5.1/classmate-1.5.1.jar
MD5: e91fcd30ba329fd1b0b6dc5321fd067c
SHA1: 3fe0bed568c62df5e89f4f174c101eab25345b6c
SHA256:aab4de3006808c09d25dd4ff4a3611cfb63c95463cfd99e73d2e1680d229a33b
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

commons-beanutils-1.9.4.jar

Description:

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-beanutils/commons-beanutils/1.9.4/commons-beanutils-1.9.4.jar
MD5: 07dc532ee316fe1f2f0323e9bd2f8df4
SHA1: d52b9abcd97f38c81342bb7e7ae1eee9b73cba51
SHA256:7d938c81789028045c08c065e94be75fc280527620d5bd62b519d5838532368a
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-cli-1.4.jar

Description:

    Apache Commons CLI provides a simple API for presenting, processing and validating a command line interface.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-cli/commons-cli/1.4/commons-cli-1.4.jar
MD5: c966d7e03507c834d5b09b848560174e
SHA1: c51c00206bb913cd8612b24abd9fa98ae89719b1
SHA256:fd3c7c9545a9cdb2051d1f9155c4f76b1e4ac5a57304404a6eedb578ffba7328
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-codec-1.15.jar

Description:

     The Apache Commons Codec package contains simple encoder and decoders for
     various formats such as Base64 and Hexadecimal.  In addition to these
     widely used encoders and decoders, the codec package also maintains a
     collection of phonetic encoding utilities.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-codec/commons-codec/1.15/commons-codec-1.15.jar
MD5: 303baf002ce6d382198090aedd9d79a2
SHA1: 49d94806b6e3dc933dacbd8acb0fdbab8ebd1e5d
SHA256:b3e9f6d63a790109bf0d056611fbed1cf69055826defeb9894a71369d246ed63
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Client:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper WS Manual Client:compile
  • Grouper Duo:compile
  • Grouper Google Apps Provisioner:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-collections-3.2.2.jar

Description:

Types that extend and augment the Java Collections Framework.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar
MD5: f54a8510f834a1a57166970bfc982e94
SHA1: 8ad72fe39fa8c91eaaf12aadb21e0c3661fe26d5
SHA256:eeeae917917144a68a741d4c0dff66aa5c5c5fd85593ff217bced3fc8ca783b8
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-collections4-4.0.jar

Description:

The Apache Commons Collections package contains types that extend and augment the Java Collections Framework.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-collections4/4.0/commons-collections4-4.0.jar
MD5: a18f2d0153b5607dff8c5becbdd76dd1
SHA1: da217367fd25e88df52ba79e47658d4cf928b0d1
SHA256:93f8dfcd20831a28d092427723f696bceb70b28e7fb89d7914f14d5ea492ce5a
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

CVE-2015-6420  

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

commons-csv-1.6.jar

Description:

The Apache Commons CSV library provides a simple interface for reading and writing
CSV files of various types.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-csv/1.6/commons-csv-1.6.jar
MD5: 6a0c53855ceb8fb376635e9a05fb8cb6
SHA1: 22b3c2f901af973a8ec4f24e80c8c0c77a600b79
SHA256:7d1560fe2c3564128f2ff3f7c0fc9f0666738aa0e704f3d78b8954f9e0ec3adf
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-dbcp-1.4.jar

Description:

Commons Database Connection Pooling

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-dbcp/commons-dbcp/1.4/commons-dbcp-1.4.jar
MD5: b004158fab904f37f5831860898b3cd9
SHA1: 30be73c965cc990b153a100aaaaafcf239f82d39
SHA256:a6e2d83551d0e5b59aa942359f3010d35e79365e6552ad3dbaa6776e4851e4f6
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-digester-2.1.jar

Description:

    The Digester package lets you configure an XML to Java object mapping module
    which triggers certain actions called rules whenever a particular 
    pattern of nested XML elements is recognized.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-digester/commons-digester/2.1/commons-digester-2.1.jar
MD5: 528445033f22da28f5047b6abcd1c7c9
SHA1: 73a8001e7a54a255eef0f03521ec1805dc738ca0
SHA256:e0b2b980a84fc6533c5ce291f1917b32c507f62bcad64198fff44368c2196a3d
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-digester3-3.2.jar

Description:

    The Apache Commons Digester package lets you configure an XML to Java
    object mapping module which triggers certain actions called rules whenever
    a particular pattern of nested XML elements is recognized.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-digester3/3.2/commons-digester3-3.2.jar
MD5: 41d2c62c7aedafa7a3627794abc83f71
SHA1: c3f68c5ff25ec5204470fd8fdf4cb8feff5e8a79
SHA256:1c150e3d2df4b4237b47e28fea2079fb0da324578d5cca6a5fed2e37a62082ec
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-exec-1.3.jar

Description:

Apache Commons Exec is a library to reliably execute external processes from within the JVM.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-exec/1.3/commons-exec-1.3.jar
MD5: 8bb8fa2edfd60d5c7ed6bf9923d14aa8
SHA1: 8dfb9facd0830a27b1b5f29f84593f0aeee7773b
SHA256:cb49812dc1bfb0ea4f20f398bcae1a88c6406e213e67f7524fb10d4f8ad9347b
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-fileupload-1.4.jar

Description:

    The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart
    file upload functionality to servlets and web applications.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-fileupload/commons-fileupload/1.4/commons-fileupload-1.4.jar
MD5: 0c3b924dcaaa90c3fb93fe04ae96a35e
SHA1: f95188e3d372e20e7328706c37ef366e5d7859b0
SHA256:a4ec02336f49253ea50405698b79232b8c5cbf02cb60df3a674d77a749a1def7
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-httpclient-3.1.jar

Description:

The HttpClient  component supports the client-side of RFC 1945 (HTTP/1.0)  and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily.

License:

Apache License: http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/grprdist/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar
MD5: 8ad8c9229ef2d59ab9f59f7050e846a5
SHA1: 964cd74171f427720480efdec40a7c7f6e58426a
SHA256:dbd4953d013e10e7c1cc3701a3e6ccd8c950c892f08d804fabfac21705930443
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper Client:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper WS Manual Client:compile
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2012-5783  

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CWE-295 Improper Certificate Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

Vulnerable Software & Versions:

CVE-2020-13956  

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

commons-io-2.11.0.jar

Description:

The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-io/commons-io/2.11.0/commons-io-2.11.0.jar
MD5: 3b4b7ccfaeceeac240b804839ee1a1ca
SHA1: a2503f302b11ebde7ebc3df41daebe0e4eea3689
SHA256:961b2f6d87dbacc5d54abf45ab7a6e2495f89b75598962d8c723cea9bc210908
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-jaxrs-1.30.jar

Description:

Common classes to make creating REST services more consistent.

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/edu/psu/swe/commons/commons-jaxrs/1.30/commons-jaxrs-1.30.jar
MD5: 28ddd7d7e6076992b76b74847bc449b0
SHA1: 808318f583518b6e4f0caef590cd77a6faa42b3f
SHA256:0dc28a13f8b9e8e5544dc64085c299dbc2309c63e8158c1103f62f3bfb245cb2
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

commons-jexl-2.1.1.jar

Description:

The Commons Jexl library is an implementation of the JSTL Expression Language with extensions.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-jexl/2.1.1/commons-jexl-2.1.1.jar
MD5: 4ad8f5c161dd3a50e190334555675db9
SHA1: 6ecc181debade00230aa1e17666c4ea0371beaaa
SHA256:03c9a9fae5da78ce52c0bf24467cc37355b7e23196dff4839e2c0ff018a01306
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Office365 and Azure Provisioner:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper Client:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-jexl3-3.0.jar

Description:

The Apache Commons JEXL library is an implementation of the JSTL Expression Language with extensions.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-jexl3/3.0/commons-jexl3-3.0.jar
MD5: 81041b5b058a2ccff0046386bc7e23f8
SHA1: 75aba6fe6659500bc7fcd420adca9c04ec9a379a
SHA256:79b0aecbe5d851ccf919ba3f5ec3ee333e011f46a24713cb2099e3968a5b9884
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-lang-2.6.jar

Description:

        Commons Lang, a package of Java utility classes for the
        classes that are in java.lang's hierarchy, or are considered to be so
        standard as to justify existence in java.lang.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
SHA256:50f11b09f877c294d56f24463f47d28f929cf5044f648661c0f0cfbae9a2f49c
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-lang3-3.12.0.jar

Description:

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar
MD5: 19fe50567358922bdad277959ea69545
SHA1: c6842c86792ff03b9f1d1fe2aab8dc23aa6c6f0e
SHA256:d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper Client:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

commons-logging-1.2.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well known logging systems.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-logging/commons-logging/1.2/commons-logging-1.2.jar
MD5: 040b4b4d8eac886f6b4a2a3bd2f31b00
SHA1: 4bfc12adfe4842bf07b657f0369c4cb522955686
SHA256:daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Office365 and Azure Provisioner:compile
  • Grouper Client:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper WS SCIM:compile
  • Grouper SCIM:compile
  • Grouper Rabbitmq:provided
  • Grouper Box:compile
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper WS Manual Client:compile
  • Grouper Duo:compile
  • Grouper Google Apps Provisioner:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-math-1.2.jar

Description:

The Math project is a library of lightweight, self-contained mathematics and statistics components addressing the most common practical problems not immediately available in the Java programming language or commons-lang.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-math/commons-math/1.2/commons-math-1.2.jar
MD5: 5d3ce091a67e863549de4493e19df069
SHA1: 3955b41fe9f3c0469bd873331940674812d09bd2
SHA256:429ad6e1a650bc924a3e26fafc8ef703147375d8dd6d02b710c655071cc82270
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-net-3.6.jar

Description:

Apache Commons Net library contains a collection of network utilities and protocol implementations.
Supported protocols include: Echo, Finger, FTP, NNTP, NTP, POP3(S), SMTP(S), Telnet, Whois

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-net/commons-net/3.6/commons-net-3.6.jar
MD5: b46661b01cc7aeec501f1cd3775509f1
SHA1: b71de00508dcb078d2b24b5fa7e538636de9b3da
SHA256:d3b3866c61a47ba3bf040ab98e60c3010d027da0e7a99e1755e407dd47bc2702
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper AMQ:compile
  • Grouper WS SCIM:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-pool-1.6.jar

Description:

Commons Object Pooling Library

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-pool/commons-pool/1.6/commons-pool-1.6.jar
MD5: 5ca02245c829422176d23fa530e919cc
SHA1: 4572d589699f09d866a226a14b7f4323c6d8f040
SHA256:46c42b4a38dc6b2db53a9ee5c92c63db103665d56694e2cfce2c95d51a6860cc
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-text-1.10.0.jar

Description:

Apache Commons Text is a library focused on algorithms working on strings.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-text/1.10.0/commons-text-1.10.0.jar
MD5: 4afc9bfa2d31dbf7330c98fcc954b892
SHA1: 3363381aef8cef2dbc1023b3e3a9433b08b64e01
SHA256:770cd903fa7b604d1f7ef7ba17f84108667294b2b478be8ed1af3bffb4ae0018
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-validator-1.6.jar

Description:

    Apache Commons Validator provides the building blocks for both client side validation and server side data validation.
    It may be used standalone or with a framework like Struts.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/commons-validator/commons-validator/1.6/commons-validator-1.6.jar
MD5: 3fd5efd8dcdd601035c123638a897833
SHA1: e989d1e87cdd60575df0765ed5bac65c905d7908
SHA256:bd62795d7068a69cbea333f6dbf9c9c1a6ad7521443fb57202a44874f240ba25
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

commons-vfs2-2.4.1.jar

Description:

Apache Commons VFS is a Virtual File System library.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/commons/commons-vfs2/2.4.1/commons-vfs2-2.4.1.jar
MD5: 3689ad3e33c2455c033c7062f583c49f
SHA1: 2b041628c3cb436d8eee25f78603f04eb5e817a5
SHA256:1d518e883bb4e9a791c2bb48c76ed7b8879708b312ed955854e50b831e23ed35
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

content-type-2.2.jar

Description:

Java library for Content (Media) Type representation

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/nimbusds/content-type/2.2/content-type-2.2.jar
MD5: 135aaa5ebcc12a45f4b3ff08cb6fa46a
SHA1: 9a894bce7646dd4086652d85b88013229f23724b
SHA256:730f1816196145e88275093c147f2e6da3c3e541207acd3503a1b06129b9bea9
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

converter-moshi-2.7.2.jar

File Path: /home/grprdist/.m2/repository/com/squareup/retrofit2/converter-moshi/2.7.2/converter-moshi-2.7.2.jar
MD5: 0393c9af8a3f4d02d8e743c1d25de8f8
SHA1: c1c9f754062b7bfc5fba46e0f6015af2fa171617
SHA256:a77fb00f3a8c975bd0962404c51c73e737904b06f1e83aa2d74d9fa71ba3f6bd
Referenced In Project/Scope:Grouper Office365 and Azure Provisioner:compile

Identifiers

cron-parser-core-3.4.jar

File Path: /home/grprdist/.m2/repository/net/redhogs/cronparser/cron-parser-core/3.4/cron-parser-core-3.4.jar
MD5: 984e308161cecec9ca9ca7ab34257c1e
SHA1: f4b72519661bd9879803b82ac19eab1269bbcdf9
SHA256:caece60f6f9305eb0ff54b9558ef014a7c076bb9ecec609006983794c0ced2ee
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

csrfguard-4.1.4.jar

Description:

OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.

File Path: /home/grprdist/.m2/repository/org/owasp/csrfguard/4.1.4/csrfguard-4.1.4.jar
MD5: 7a8913a0d0cb554bb84ef0871716db3d
SHA1: 8590d9f54d2179ff2af16f718e9f22abdeb6f317
SHA256:5de5e1df57b5c54a84b2c59adde4b51bf8b1735165feb5bec3cfb84f8b37b366
Referenced In Projects/Scopes:

  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

CVE-2021-28490 (OSSINDEX)  

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2021-28490 for details
CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: HIGH (8.8)
  • Vector: /AV:N/AC:L/Au:/C:H/I:H/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.owasp:csrfguard:4.1.4:*:*:*:*:*:*:*

csrfguard-4.1.4.jar: csrfguard.js

File Path: /home/grprdist/.m2/repository/org/owasp/csrfguard/4.1.4/csrfguard-4.1.4.jar/META-INF/csrfguard.js
MD5: 0e05e024b3f928ae41163059e9280a15
SHA1: b542548435de656da7eb06a730e44dcd4049b983
SHA256:258e9c1e8b113bb34f0494c2aab8fc5a0c7bd33de82cc63a8fb40ee10523893b
Referenced In Projects/Scopes:

  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

  • None

csrfguard-jsp-tags-4.1.4.jar

Description:

JSP Tag support

File Path: /home/grprdist/.m2/repository/org/owasp/csrfguard-jsp-tags/4.1.4/csrfguard-jsp-tags-4.1.4.jar
MD5: 74cf22e7e48742a8f238a665129be835
SHA1: 7111cf78de80dcce8357b8db9cc908870c2873b7
SHA256:75d6a3c1d77ababd448b9ef9fc17e0d765315847bdf68c741e485232d3c65b1c
Referenced In Projects/Scopes:

  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

dom4j-2.1.3.jar

Description:

flexible XML framework for Java

License:

BSD 3-clause New License: https://github.com/dom4j/dom4j/blob/master/LICENSE
File Path: /home/grprdist/.m2/repository/org/dom4j/dom4j/2.1.3/dom4j-2.1.3.jar
MD5: 41efcf234c5a05a8c590f9b51d53ca66
SHA1: a75914155a9f5808963170ec20653668a2ffd2fd
SHA256:549f3007c6290f6a901e57d1d331b4ed0e6bf7384f78bf10316ffceeca834de6
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

duo-client-0.3.0.jar

Description:

Two Factor Authentication API Client

License:

BSD: https://opensource.org/licenses/BSD-3-Clause
File Path: /home/grprdist/.m2/repository/com/duosecurity/duo-client/0.3.0/duo-client-0.3.0.jar
MD5: 738de692e3292ad5880112e0a666ddd9
SHA1: 2c71c5e8b9993c8f605974321c228ac6d3e0c999
SHA256:0114f73d21eb725c1d9539d1fc166c78e029c4fedf6ea565a6b122e012b65084
Referenced In Project/Scope:Grouper Duo:compile

Identifiers

edu.internet2.middleware.grouper:grouper-ui:2.6.0-SNAPSHOT

Description:

Internet2 Groups Management User Interface

License:

Apache 2 http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/grouper-docs/git/grouper/grouper-ui/pom.xml

Referenced In Project/Scope:Grouper UI webapp

Identifiers

edu.internet2.middleware.grouper:grouper-ws-java-generated-client:2.6.0-SNAPSHOT

Description:

Internet2 Groups Management WS Generated Client

License:

Apache 2 http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/grouper-docs/git/grouper/grouper-ws/grouper-ws-java-generated-client/pom.xml

Referenced In Project/Scope:Grouper WS Test

Identifiers

edu.internet2.middleware.grouper:grouper-ws:2.6.0-SNAPSHOT

Description:

Internet2 Groups Management WS Core

License:

Apache 2 http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/grouper-docs/git/grouper/grouper-ws/grouper-ws/pom.xml

Referenced In Project/Scope:Grouper WS Test

Identifiers

edu.internet2.middleware.grouper:grouper:2.6.0-SNAPSHOT

Description:

Internet2 Groups Management Toolkit

License:

Apache 2 http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/grouper-docs/git/grouper/grouper/pom.xml

Referenced In Projects/Scopes:
  • Grouper UI webapp
  • Grouper WS
  • Grouper AWS Messaging
  • Grouper WS Generated Client
  • Grouper Google Apps Provisioner
  • Grouper Duo
  • Grouper Rabbitmq
  • Grouper WS SCIM
  • Grouper ActiveMQ Messaging
  • Grouper SCIM
  • Grouper AMQ
  • Grouper WS Test
  • Grouper Box
  • Grouper Office365 and Azure Provisioner
  • Grouper PSP-NG
  • Grouper UI

Identifiers

edu.internet2.middleware.grouper:grouperClient:2.6.0-SNAPSHOT

Description:

Client for Grouper LDAP and Web Services

License:

Apache 2 http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /var/grouper-docs/git/grouper/grouper-misc/grouperClient/pom.xml

Referenced In Projects/Scopes:
  • Grouper UI webapp
  • Grouper WS
  • Grouper API
  • Grouper AWS Messaging
  • Grouper WS Generated Client
  • Grouper Google Apps Provisioner
  • Grouper Duo
  • Grouper Rabbitmq
  • Grouper WS SCIM
  • Grouper ActiveMQ Messaging
  • Grouper SCIM
  • Grouper AMQ
  • Grouper WS Test
  • Grouper Box
  • Grouper Office365 and Azure Provisioner
  • Grouper PSP-NG
  • Grouper UI

Identifiers

ehcache-core-2.6.10.jar

Description:

This is the ehcache core module. Pair it with other modules for added functionality.

License:

The Apache Software License, Version 2.0: src/assemble/EHCACHE-CORE-LICENSE.txt
File Path: /home/grprdist/.m2/repository/net/sf/ehcache/ehcache-core/2.6.10/ehcache-core-2.6.10.jar
MD5: 206e69dbe0f3454dceee5acf71b64823
SHA1: 8e567a024e27e11b961ca068c5c367f845e21a9b
SHA256:53733a580faad03c8433a6a9f0067040f7ace569f4adeaf71f8aa46e1037e3c9
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

ehcache-core-2.6.10.jar: sizeof-agent.jar

File Path: /home/grprdist/.m2/repository/net/sf/ehcache/ehcache-core/2.6.10/ehcache-core-2.6.10.jar/net/sf/ehcache/pool/sizeof/sizeof-agent.jar
MD5: 5ad919b3ac0516897bdca079c9a222a8
SHA1: e86399a80ae6a6c7a563717eaa0ce9ba4708571c
SHA256:3bcd560ca5f05248db9b689244b043e9c7549e3791281631a64e5dfff15870d2
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

ezmorph-1.0.6.jar

Description:

      Simple java library for transforming an Object to another Object.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/net/sf/ezmorph/ezmorph/1.0.6/ezmorph-1.0.6.jar
MD5: 1fa113c6aacf3a01af1449df77acd474
SHA1: 01e55d2a0253ea37745d33062852fd2c90027432
SHA256:2be06a2380f8656426b5c610db694bbd75314caf3e9191affcd7942721398ed7
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

geronimo-activation_1.1_spec-1.0.2.jar

Description:

Provides open-source implementations of Sun specifications.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-activation_1.1_spec/1.0.2/geronimo-activation_1.1_spec-1.0.2.jar
MD5: 9759ed85c6e767bf3dc00c4cf635c4e2
SHA1: 3efc3aadfaf8878060167e492c03fdafb905ae01
SHA256:eead654df3a0e1405314eb0578e32c53267872dfbb1250b2fd6f3a9629c57fa4
Referenced In Projects/Scopes:
  • Grouper SCIM:compile
  • Grouper WS Generated Client:compile

Identifiers

geronimo-annotation_1.1_spec-1.0.jar

Description:

Annotation spec 1.1 API

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-annotation_1.1_spec/1.0/geronimo-annotation_1.1_spec-1.0.jar
MD5: 49744ebcc93e58a1dec259997b8bf686
SHA1: 145b78b5d1dc9021594cccbd9482b51fe412a8a4
SHA256:6d2d296d01540201bca6e7175bf900f6df0be605e29bdaf822df516f40235ff9
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

geronimo-j2ee-management_1.1_spec-1.0.1.jar

Description:

Provides open-source implementations of Sun specifications.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-j2ee-management_1.1_spec/1.0.1/geronimo-j2ee-management_1.1_spec-1.0.1.jar
MD5: 7e1708a3b808e9749b5789668fd9ca8b
SHA1: 5372615b0c04c1913c95c34a0414cef720ca2855
SHA256:7ad780c72a92039bc07cbc09b6ee8d06571a1fbd92d4361a19a433d783b6e221
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

geronimo-javamail_1.4_spec-1.6.jar

Description:

Javamail 1.4 Specification

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-javamail_1.4_spec/1.6/geronimo-javamail_1.4_spec-1.6.jar
MD5: 2bcb3208c8e0c8e9713d8222abb33788
SHA1: 815bcb854f72622fa00d5d119175ed252127af4f
SHA256:b30feea0591af150709d4c57c2885ccf382bff100891f6b35605d50a851a2238
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

geronimo-javamail_1.4_spec-1.7.1.jar

Description:

Javamail 1.4 Specification

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-javamail_1.4_spec/1.7.1/geronimo-javamail_1.4_spec-1.7.1.jar
MD5: f3b9d8c9a79eefdc0ebe07c34612646d
SHA1: 43ad4090b1a07a11c82ac40c01fc4e2fbad20013
SHA256:6f1e85d9c66135f5a9dbc9f78cbf8132e52f8a85884d618ccf0dbe9344c5a330
Referenced In Project/Scope:Grouper WS Generated Client:compile

Identifiers

geronimo-jaxrs_1.1_spec-1.0.jar

Description:

Java API for RESTful Web Services 1.1

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-jaxrs_1.1_spec/1.0/geronimo-jaxrs_1.1_spec-1.0.jar
MD5: 33ad0e4d15950960c57a50e01f68d382
SHA1: 6f4c71cbff6a7725e393a74b9e3680d2685ddac7
SHA256:21051161452bff4b076e2fc148add1bb398c3f2e44649c440d80025ef4d861a9
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

geronimo-jms_1.1_spec-1.1.1.jar

Description:

Provides open-source implementations of Sun specifications.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-jms_1.1_spec/1.1.1/geronimo-jms_1.1_spec-1.1.1.jar
MD5: d80ce71285696d36c1add1989b94f084
SHA1: c872b46c601d8dc03633288b81269f9e42762cea
SHA256:18d9ff7b9066aa99cf89843f5055d2fe58b1abe4346ee9df0daf4ac18ca232d7
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

geronimo-jms_1.1_spec-1.1.jar

File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-jms_1.1_spec/1.1/geronimo-jms_1.1_spec-1.1.jar
MD5: 10e163bdd905d1c16d7e1c48427b5853
SHA1: bbd68f90d445de37050b1e9fb9d7114e83757e73
SHA256:0fe8cfc0154855316054162a9b355f66a43d7e65fc71886e6d12c37d3aa5a5fc
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

geronimo-jms_2.0_spec-1.0-alpha-2.jar

Description:

Java Message Service 2.0 API

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-jms_2.0_spec/1.0-alpha-2/geronimo-jms_2.0_spec-1.0-alpha-2.jar
MD5: bd94cfcc9f711642d280681330b14844
SHA1: 8d8a4d5a80138ba4ebc7b5509989e3d7013c7e74
SHA256:62a109edef3de718b0cb600bf040b4be5e32c683a57ee16f9f8a89537bf5da51
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

geronimo-jta_1.1_spec-1.1.jar

File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-jta_1.1_spec/1.1/geronimo-jta_1.1_spec-1.1.jar
MD5: 25b479710f7ac269c6bf5bf016345ad9
SHA1: fe8d9046737540d728e4b82cf26dcdd8bf4b0eb1
SHA256:186d94eaf931e434c6858d5f255c808f22a5de72cda8106ca34fe003d3e015bb
Referenced In Project/Scope:Grouper WS Generated Client:compile

Identifiers

geronimo-stax-api_1.0_spec-1.0.1.jar

Description:

Provides open-source implementations of Sun specifications.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-stax-api_1.0_spec/1.0.1/geronimo-stax-api_1.0_spec-1.0.1.jar
MD5: b7c2a715cd3d1c43dc4ccfae426e8e2e
SHA1: 1c171093a8b43aa550c6050ac441abe713ebb4f2
SHA256:124235815fba376b0c20ed37f79d691fa26b4e00297a4ab27b6ca05ceb591348
Referenced In Projects/Scopes:
  • Grouper SCIM:compile
  • Grouper WS Generated Client:compile

Identifiers

geronimo-ws-metadata_2.0_spec-1.1.2.jar

Description:

Provides open-source implementations of Sun specifications.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/geronimo/specs/geronimo-ws-metadata_2.0_spec/1.1.2/geronimo-ws-metadata_2.0_spec-1.1.2.jar
MD5: 3d0fbbca45e8877dee74e83bc83317d5
SHA1: 7be9f049b4f0f0cf045675be5a0ff709d57cbc6a
SHA256:94820ccdb04c7c64290938f16cc577cdd8ded6a4d12ed2fbfd03318feff97579
Referenced In Project/Scope:Grouper WS Generated Client:compile

Identifiers

google-api-client-1.25.0.jar

Description:

The Google API Client Library for Java provides functionality common to all Google APIs; for example HTTP transport, error handling, authentication, JSON parsing, media download/upload, and batching.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/api-client/google-api-client/1.25.0/google-api-client-1.25.0.jar
MD5: dbeddb59844ea8fbd9416a0c017a627f
SHA1: e7ff725e89ff5dcbed107be1a24e8102ae2441ee
SHA256:24e1a69d6c04e6e72e3e16757d46d32daa7dd43cb32c3895f832f25358be1402
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

google-api-services-admin-directory-directory_v1-rev118-1.25.0.jar

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/apis/google-api-services-admin-directory/directory_v1-rev118-1.25.0/google-api-services-admin-directory-directory_v1-rev118-1.25.0.jar
MD5: 093bffe6a1b932e74232d16f654ddc1e
SHA1: cb4be66bd057795f15773450d89a38036c39b44a
SHA256:e4e39591006de30a5949b75665aadd003267f49c1595946b7f855b9a62b155e3
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

google-api-services-groupssettings-v1-rev82-1.25.0.jar

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/apis/google-api-services-groupssettings/v1-rev82-1.25.0/google-api-services-groupssettings-v1-rev82-1.25.0.jar
MD5: e1791393caa9941e855ca0210ad0137d
SHA1: 5337b0fa1813cf3e8f40afc7039c9b952a792170
SHA256:4155714fb255173943c60182f5796ed16a5efce7cd9abb547933f6c6bfe04e87
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

google-http-client-1.25.0.jar

Description:

    Google HTTP Client Library for Java. Functionality that works on all supported Java platforms,
    including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/http-client/google-http-client/1.25.0/google-http-client-1.25.0.jar
MD5: d28fdd84656ffe586d56ab6492509dd6
SHA1: 5fb16523c393bfe0210c29db44742bd308311841
SHA256:fb7d80a515da4618e2b402e1fef96999e07621b381a5889ef091482c5a3e961d
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

google-http-client-jackson2-1.25.0.jar

File Path: /home/grprdist/.m2/repository/com/google/http-client/google-http-client-jackson2/1.25.0/google-http-client-jackson2-1.25.0.jar
MD5: 5e7de7ec9216d4747dcbdc5b6d08d560
SHA1: 7c5c89bd4d0d34d9f1cb3396e8da6233e5074b5c
SHA256:f9e7e0d318860a2092d70b56331976280c4e9348a065ede3b99c92aa032fd853
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

google-oauth-client-1.25.0.jar

Description:

    Google OAuth Client Library for Java. Functionality that works on all supported Java platforms,
    including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/oauth-client/google-oauth-client/1.25.0/google-oauth-client-1.25.0.jar
MD5: 6fd6dc606bb8c17c9a6d61e21533f010
SHA1: c9ee14e8b095b4b301b28d57755cc482b8d6f39f
SHA256:7e2929133d4231e702b5956a7e5dc8347a352acc1e97082b40c3585b81cd3501
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

CVE-2020-7692  

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
CWE-863 Incorrect Authorization

CVSSv2:
  • Base Score: MEDIUM (6.4)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2021-22573  

The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
CWE-347 Improper Verification of Cryptographic Signature

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions:

groovy-2.5.18.jar

Description:

Groovy: A powerful, dynamic language for the JVM

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/codehaus/groovy/groovy/2.5.18/groovy-2.5.18.jar
MD5: f3de969ce974116e3e262c591dfc8ef2
SHA1: 798c6b66235338deeab9ecffa8942c67a0357abe
SHA256:ce352918c7fc06c700bc7f13cbd00226042bc146a899eb52ff5b522a092a309c
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

groovy-xml-2.5.18.jar

Description:

Groovy: A powerful, dynamic language for the JVM

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/codehaus/groovy/groovy-xml/2.5.18/groovy-xml-2.5.18.jar
MD5: f6c37df32d9c4837944d07f775f5d51e
SHA1: 42e42df001f431da9ca965495d56cdaad93a2f0b
SHA256:a474f0f15088281be9e94639be4c1aa873d40fdb8e540220f17c071ae1490673
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

gson-2.9.0.jar

Description:

Gson JSON library

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/code/gson/gson/2.9.0/gson-2.9.0.jar
MD5: 53fa3e6753e90d931d62cb89580fde2f
SHA1: 8a1167e089096758b49f9b34066ef98b2f4b37aa
SHA256:c96d60551331a196dac54b745aa642cd078ef89b6f267146b705f2c2cbef052d
Referenced In Projects/Scopes:
  • Grouper Office365 and Azure Provisioner:compile
  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

guava-18.0.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, google's collections, io classes, and much
    much more.

    Guava has only one code dependency - javax.annotation,
    per the JSR-305 spec.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/guava/guava/18.0/guava-18.0.jar
MD5: 947641f6bb535b1d942d1bc387c45290
SHA1: cce0823396aa693798f8882e64213b1772032b09
SHA256:d664fbfc03d2e5ce9cab2a44fb01f1d0bf9dfebeccc1a473b1f9ea31f79f6f99
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

CVE-2018-10237  

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-8908  

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CWE-732 Incorrect Permission Assignment for Critical Resource

CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: LOW (3.3)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

guava-20.0.jar

Description:

    Guava is a suite of core and expanded libraries that include
    utility classes, google's collections, io classes, and much
    much more.

    Guava has only one code dependency - javax.annotation,
    per the JSR-305 spec.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/guava/guava/20.0/guava-20.0.jar
MD5: f32a8a2524620dbecc9f6bf6a20c293f
SHA1: 89507701249388e1ed5ddcf8c41f4ce1be7831ef
SHA256:36a666e3b71ae7f0f0dca23654b67e086e6c93d192f60ba5dfd5519db6c288c8
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

CVE-2018-10237  

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-8908  

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CWE-732 Incorrect Permission Assignment for Critical Resource

CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: LOW (3.3)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

hawtbuf-1.9.jar

Description:

HawtBuf: a rich byte buffer library

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/fusesource/hawtbuf/hawtbuf/1.9/hawtbuf-1.9.jar
MD5: f02d55780c4f2280b58528a76b5c0286
SHA1: 4a42b835d1df77db8c9a144a11ebb4600a372f5f
SHA256:a057c86610e9ebdd7eef79c4b277c71126507bc9a2b685d7b5848bf7e5360d86
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

hawtdispatch-1.11.jar

Description:

HawtDispatch: The libdispatch style API for Java

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/fusesource/hawtdispatch/hawtdispatch/1.11/hawtdispatch-1.11.jar
MD5: d89ede049421a92e93e4d110c37fdd1d
SHA1: 01fefb873b3046944dd8af2fb2be6dab4ef76057
SHA256:8de17bc829c4cf5df97d6b71e598bfcd7460d001dbea133bc1d6ba53541e62a8
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

hawtdispatch-transport-1.11.jar

Description:

HawtDispatch Transport: Transport abstractions for HawtDispatch

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/fusesource/hawtdispatch/hawtdispatch-transport/1.11/hawtdispatch-transport-1.11.jar
MD5: aa237af24f64f14578ef92d6eaff5850
SHA1: f930133932548bba115b00a2a166613c15fe0ba7
SHA256:762930df50903ec68551641c1583080b2a1da359ad9aaaeb1917c2516741183b
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

hibernate-commons-annotations-5.1.2.Final.jar

Description:

Common reflection code used in support of annotation processing

License:

GNU Library General Public License v2.1 or later: http://www.opensource.org/licenses/LGPL-2.1
File Path: /home/grprdist/.m2/repository/org/hibernate/common/hibernate-commons-annotations/5.1.2.Final/hibernate-commons-annotations-5.1.2.Final.jar
MD5: 2a2490b3eb8e7585a6a899d27d7ed43f
SHA1: e59ffdbc6ad09eeb33507b39ffcf287679a498c8
SHA256:1c7ce712b2679fea0a5441eb02a04144297125b768944819be0765befb996275
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

hibernate-core-5.6.10.Final.jar

Description:

Hibernate's core ORM functionality

License:

GNU Library General Public License v2.1 or later: https://www.opensource.org/licenses/LGPL-2.1
File Path: /home/grprdist/.m2/repository/org/hibernate/hibernate-core/5.6.10.Final/hibernate-core-5.6.10.Final.jar
MD5: 9c4f43fc5936b6d6555ff6ece7865220
SHA1: 408fd5802391d8e6f619db9d7c6c0e27d49118c2
SHA256:ed3693a0ae288dafff6155b03b7d743fdb9c9f432de37d7b894f44d92e3a85c4
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

hk2-api-2.6.1.jar

Description:

${project.name}

License:

http://www.eclipse.org/legal/epl-2.0, https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/hk2/hk2-api/2.6.1/hk2-api-2.6.1.jar
MD5: 23e8c18dae0c7b776bed756763d5153f
SHA1: 114bd7afb4a1bd9993527f52a08a252b5d2acac5
SHA256:c2cb80a01e58440ae57d5ee59af4d4d94e5180e04aff112b0cb611c07d61e773
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

hk2-locator-2.6.1.jar

Description:

${project.name}

License:

http://www.eclipse.org/legal/epl-2.0, https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/hk2/hk2-locator/2.6.1/hk2-locator-2.6.1.jar
MD5: dfd358720393d83b01747928db6e3912
SHA1: 9dedf9d2022e38ec0743ed44c1ac94ad6149acdd
SHA256:febc668deb9f2000c76bd4918d8086c0a4c74d07bd0c60486b72c6bd38b62874
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

hk2-utils-2.6.1.jar

Description:

${project.name}

License:

http://www.eclipse.org/legal/epl-2.0, https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/hk2/hk2-utils/2.6.1/hk2-utils-2.6.1.jar
MD5: 75ccb55538a77bf878996497ffeb86f3
SHA1: 396513aa96c1d5a10aa4f75c4dcbf259a698d62d
SHA256:30727f79086452fdefdab08451d982c2082aa239d9f75cdeb1ba271e3c887036
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

CVE-2021-4277  

A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is dbab1b66955eeb3d76b34612b358307f5c4e3944. It is recommended to apply a patch to fix this issue. The identifier VDB-216749 was assigned to this vulnerability.
CWE-330 Use of Insufficiently Random Values

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions:

httpclient-4.5.13.jar

Description:

   Apache HttpComponents Client

File Path: /home/grprdist/.m2/repository/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar
MD5: 40d6b9075fbd28fa10292a45a0db9457
SHA1: e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cada
SHA256:6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743
Referenced In Projects/Scopes:

  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper Google Apps Provisioner:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

httpcore-4.4.14.jar

Description:

   Apache HttpComponents Core (blocking I/O)

File Path: /home/grprdist/.m2/repository/org/apache/httpcomponents/httpcore/4.4.14/httpcore-4.4.14.jar
MD5: 2b3991eda121042765a5ee299556c200
SHA1: 9dd1a631c082d92ecd4bd8fd4cf55026c720a8c1
SHA256:f956209e450cb1d0c51776dfbd23e53e9dd8db9a1298ed62b70bf0944ba63b28
Referenced In Projects/Scopes:

  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper Google Apps Provisioner:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

httpmime-4.5.13.jar

Description:

   Apache HttpComponents HttpClient - MIME coded entities

File Path: /home/grprdist/.m2/repository/org/apache/httpcomponents/httpmime/4.5.13/httpmime-4.5.13.jar
MD5: 3f0c1ef2c9dc47b62b780192f54b0c18
SHA1: efc110bad4a0d45cda7858e6beee1d8a8313da5a
SHA256:06e754d99245b98dcc2860dcb43d20e737d650da2bf2077a105f68accbd5c5cc
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

ion-java-1.0.2.jar

Description:

    A Java implementation of the Amazon Ion data notation.

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/software/amazon/ion/ion-java/1.0.2/ion-java-1.0.2.jar
MD5: 3f07f5df418af9ea2ebe80c3d6eccac4
SHA1: ee9dacea7726e495f8352b81c12c23834ffbc564
SHA256:0d127b205a1fce0abc2a3757a041748651bc66c15cf4c059bac5833b27d471a5
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

istack-commons-runtime-3.0.7.jar

Description:

istack common utility code

License:

https://glassfish.java.net/public/CDDL+GPL_1_1.html, https://glassfish.java.net/public/CDDL+GPL_1_1.html
File Path: /home/grprdist/.m2/repository/com/sun/istack/istack-commons-runtime/3.0.7/istack-commons-runtime-3.0.7.jar
MD5: 83e9617b86023b91bd54f65c09838f4b
SHA1: c197c86ceec7318b1284bffb49b54226ca774003
SHA256:6443e10ba2e259fb821d9b6becf10db5316285fc30c53cec9d7b19a3877e7fdf
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

j2objc-annotations-1.1.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/j2objc/j2objc-annotations/1.1/j2objc-annotations-1.1.jar
MD5: 49ae3204bb0bb9b2ac77062641f4a6d7
SHA1: ed28ded51a8b1c6b112568def5f4b455e6809019
SHA256:2994a7eb78f2710bd3d3bfb639b2c94e219cedac0d4d084d516e78c16dddecf6
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

jackson-annotations-2.9.0.jar

Description:

Core annotations used for value types, used by Jackson data binding package.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.9.0/jackson-annotations-2.9.0.jar
MD5: c09faa1b063681cf45706c6df50685b6
SHA1: 07c10d545325e3a6e72e06381afe469fd40eb701
SHA256:45d32ac61ef8a744b464c54c2b3414be571016dd46bfc2bec226761cf7ae457a
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

CVE-2018-1000873  

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

jackson-core-2.13.3.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.13.3/jackson-core-2.13.3.jar
MD5: 9a6679e6a2f7d601a9f212576fda550c
SHA1: a27014716e4421684416e5fa83d896ddb87002da
SHA256:ab119a8ea3cc69472ebc0e870b849bfbbe536ad57d613dc38453ccd592ca6a3d
Referenced In Project/Scope:Grouper Client:provided

Identifiers

jackson-core-2.14.0.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.14.0/jackson-core-2.14.0.jar
MD5: 88988c4b941b1f4c6637af5218b26f87
SHA1: 49d219171d6af643e061e9e1baaaf6a6a067918d
SHA256:ab4793e5df4fbfae445ca55e9e1439311c80fa8b34fc13162c1260902b4dbea0
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper Google Apps Provisioner:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

jackson-databind-2.13.3.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.13.3/jackson-databind-2.13.3.jar
MD5: e35e2adf33b2eed8e9f538a911244175
SHA1: 56deb9ea2c93a7a556b3afbedd616d342963464e
SHA256:6444bf08d8cd4629740afc3db1276938f494728deb663ce585c4e91f6b45eb84
Referenced In Project/Scope:Grouper Client:provided

Identifiers

CVE-2022-42003  

In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1
CWE-502 Deserialization of Untrusted Data

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-42004  

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
CWE-502 Deserialization of Untrusted Data

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

jackson-databind-2.14.0.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.14.0/jackson-databind-2.14.0.jar
MD5: f94ffc53b4062cae1f383a4482593020
SHA1: 513b8ca3fea0352ceebe4d0bbeea527ab343dc1a
SHA256:54377fa855f52ed87e8f689b35249971840b16870dee76806d5d200cbcd66f27
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

jackson-dataformat-cbor-2.12.6.jar

Description:

Support for reading and writing Concise Binary Object Representation
([CBOR](https://www.rfc-editor.org/info/rfc7049)
encoded data using Jackson abstractions (streaming API, data binding, tree model)

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.12.6/jackson-dataformat-cbor-2.12.6.jar
MD5: 2bef08f2597473f39e4d9c9de01d3dde
SHA1: 3cd2e6a538f73483c6c59c354ce2276bcdc5ba7b
SHA256:cfa008d15f052e69221e8c3193056ff95c3c594271321ccac8d72dc1a770619c
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

jackson-dataformat-yaml-2.4.2.jar (shaded: org.yaml:snakeyaml:1.12)

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License Version 2.0: LICENSE.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.4.2/jackson-dataformat-yaml-2.4.2.jar/META-INF/maven/org.yaml/snakeyaml/pom.xml
MD5: d103ace8c756cc13661469b53cff1794
SHA1: c9dbe57a55450ef61cdb139c01a8edea9206949d
SHA256:8e74df39a8ef592fb70464815ddc7ae244ec6ebfe5ba9a3203daa07275395160
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

CVE-2022-1471 (OSSINDEX)  

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (9.8)
  • Vector: /AV:N/AC:L/Au:/C:H/I:H/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.yaml:snakeyaml:1.12:*:*:*:*:*:*:*

CVE-2017-18640  

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-25857  

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-3064  

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38749  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38751  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38752  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-41854  

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2021-4235  

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38750  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

jackson-dataformat-yaml-2.4.2.jar

Description:

Support for reading and writing YAML-encoded data via Jackson abstractions.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.4.2/jackson-dataformat-yaml-2.4.2.jar
MD5: 0284425f0cb4b9badc64c1455f7af053
SHA1: 7136d542ef2d5b9ace4bb9eb4bd43f8d410a55da
SHA256:f873a33cba87a937141e247cde7530682e90786ae5a38a1ca2d13662eca3219b
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

jackson-datatype-joda-2.4.2.jar

Description:

Add-on module for Jackson (http://jackson.codehaus.org) to support
Joda (http://joda-time.sourceforge.net/) data types.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/datatype/jackson-datatype-joda/2.4.2/jackson-datatype-joda-2.4.2.jar
MD5: 6e25c374cf329603f01710030195b8ae
SHA1: d826d1db3f9f2277576c524a71d03d1f1cbe462b
SHA256:aadc841436205f31d3947adf8579d8e5651bd4ef24dbf743327020128b7e2705
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

jackson-jaxrs-base-2.14.0.jar

Description:

Pile of code that is shared by all Jackson-based JAX-RS
providers.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/jaxrs/jackson-jaxrs-base/2.14.0/jackson-jaxrs-base-2.14.0.jar
MD5: 95b3a4295287c202cf3556828bf4faf6
SHA1: f013209a02e9ed57d23e3d9bb1e05da6b0e4afba
SHA256:b2ba9f27eba41c580cb8958c6494e71efc7871bd68682f6363b2759945920451
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS SCIM:compile

Identifiers

jackson-jaxrs-json-provider-2.14.0.jar

Description:

Functionality to handle JSON input/output for JAX-RS implementations (like Jersey and RESTeasy) using standard Jackson data binding.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/jaxrs/jackson-jaxrs-json-provider/2.14.0/jackson-jaxrs-json-provider-2.14.0.jar
MD5: c283b55e9b2ce98e0d8ad33429e2cd95
SHA1: 96f7f0f834f765aefeeb73e313001060f88fcd12
SHA256:87465585a13d27491b774e077003d76ce859bffea574ac79bc10903527bd435e
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS SCIM:compile

Identifiers

jackson-module-jaxb-annotations-2.14.0.jar

Description:

Support for using JAXB annotations as an alternative to "native" Jackson annotations,
for configuring data-binding.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/fasterxml/jackson/module/jackson-module-jaxb-annotations/2.14.0/jackson-module-jaxb-annotations-2.14.0.jar
MD5: 7181cedd13c14dcbf8b4f55c347e0e6e
SHA1: d224162d974acebab7bb6fb7826a5fd319cebbf7
SHA256:5ac9a0f78af0fdac22f5a4e25494bee2ed54bf1c760af63aa78a0147eb7f41d0
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS SCIM:compile

Identifiers

jakarta.activation-api-1.2.2.jar

Description:

Jakarta Activation API jar

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/grprdist/.m2/repository/jakarta/activation/jakarta.activation-api/1.2.2/jakarta.activation-api-1.2.2.jar
MD5: 1cbb480310fa1987f9db7a3ed7118af7
SHA1: 99f53adba383cb1bf7c3862844488574b559621f
SHA256:a187a939103aef5849a7af84bd7e27be2d120c410af291437375ffe061f4f09d
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS SCIM:compile

Identifiers

jakarta.annotation-api-1.3.5.jar

Description:

Jakarta Annotations API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/jakarta/annotation/jakarta.annotation-api/1.3.5/jakarta.annotation-api-1.3.5.jar
MD5: 8b165cf58df5f8c2a222f637c0a07c97
SHA1: 59eb84ee0d616332ff44aba065f3888cf002cd2d
SHA256:85fb03fc054cdf4efca8efd9b6712bbb418e1ab98241c4539c8585bbc23e1b8a
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

jakarta.inject-2.6.1.jar

Description:

Injection API (JSR 330) version ${javax.inject.version} repackaged as OSGi bundle

License:

http://www.eclipse.org/legal/epl-2.0, https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/hk2/external/jakarta.inject/2.6.1/jakarta.inject-2.6.1.jar
MD5: 4d7c80a1e3cd54531af03bef4537f7af
SHA1: 8096ebf722902e75fbd4f532a751e514f02e1eb7
SHA256:5e88c123b3e41bca788b2683118867d9b6dec714247ea91c588aed46a36ee24f
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

jakarta.validation-api-2.0.2.jar

Description:

        Jakarta Bean Validation API

License:

Apache License 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/jakarta/validation/jakarta.validation-api/2.0.2/jakarta.validation-api-2.0.2.jar
MD5: 77501d529c1928c9bac2500cc9f93fb0
SHA1: 5eacc6522521f7eacb081f95cee1e231648461e7
SHA256:b42d42428f3d922c892a909fa043287d577c0c5b165ad9b7d568cebf87fc9ea4
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

jakarta.ws.rs-api-2.1.6.jar

Description:

Jakarta RESTful Web Services API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/jakarta/ws/rs/jakarta.ws.rs-api/2.1.6/jakarta.ws.rs-api-2.1.6.jar
MD5: c3892382aeb5c54085b22b1890511d29
SHA1: 1dcb770bce80a490dff49729b99c7a60e9ecb122
SHA256:4cea299c846c8a6e6470cbfc2f7c391bc29b9caa2f9264ac1064ba91691f4adf
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

jakarta.xml.bind-api-2.3.3.jar

Description:

Jakarta XML Binding API 2.3 Design Specification

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/grprdist/.m2/repository/jakarta/xml/bind/jakarta.xml.bind-api/2.3.3/jakarta.xml.bind-api-2.3.3.jar
MD5: 61286918ca0192e9f87d1358aef718dd
SHA1: 48e3b9cfc10752fba3521d6511f4165bea951801
SHA256:c04539f472e9a6dd0c7685ea82d677282269ab8e7baca2e14500e381e0c6cec5
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS SCIM:compile

Identifiers

jandex-2.0.4.Final.jar

Description:

Parent POM for JBoss projects. Provides default project build configuration.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/jboss/jandex/2.0.4.Final/jandex-2.0.4.Final.jar
MD5: 2938e9457bf0c1fba50d8b03a05218de
SHA1: 1796bb21a7a19a10caa7c555f81da66f4bf490cb
SHA256:f75da95aa66d841c5341480247a39a5c3c615aa6966058306d49a5d3db9b3b61
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jasypt-1.9.0.jar

Description:

Java library which enables encryption in java apps with minimum effort.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/jasypt/jasypt/1.9.0/jasypt-1.9.0.jar
MD5: ae3eb8eb393515846ff6703bccade8f9
SHA1: 0857a1a55a81641c31b2a9b4b292120c1d4432bd
SHA256:b5808493000ac2041a6fc5fcc448f52b5423ab1aec060f846379016e1fc16fc7
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

CVE-2014-9970  

jasypt before 1.9.2 allows a timing attack against the password hash comparison.
CWE-200 Information Exposure

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

java-ipv6-0.17.jar

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/googlecode/java-ipv6/java-ipv6/0.17/java-ipv6-0.17.jar
MD5: 7eab662f5ec5c0f1d964e1c551a5ac02
SHA1: 243426a162fa169ad40f5f59cb957321f00cba3f
SHA256:37cf71baf707041cb494834c559ad12b631f5c7747c804ec19598bc0e0f01162
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

java-jwt-3.10.3.jar

Description:

Java implementation of JSON Web Token (JWT)

License:

The MIT License (MIT): https://raw.githubusercontent.com/auth0/java-jwt/master/LICENSE
File Path: /home/grprdist/.m2/repository/com/auth0/java-jwt/3.10.3/java-jwt-3.10.3.jar
MD5: 69ca7c81203e238a71437325580b3663
SHA1: 138b7ea9ca2c8c8e66acf5a70e809490bcf08955
SHA256:c5901a5dadf420867cd6cb598f7ae09b0cde7f7e46b7e1a70b56be8d5a5c64a6
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

javaee-api-7.0.jar

Description:

Java(TM) EE 7 Specification APIs

License:

CDDL + GPLv2 with classpath exception: http://glassfish.java.net/nonav/public/CDDL+GPL.html
File Path: /home/grprdist/.m2/repository/javax/javaee-api/7.0/javaee-api-7.0.jar
MD5: 4574e0b1f14590cb3280d37a6cedc27d
SHA1: 51399f902cc27a808122edcbebfaa1ad989954ba
SHA256:16e51bfb2a6ed95d600e7a541e53a42b8d39c87d23b5f0e6460dd0dffe84903e
Referenced In Projects/Scopes:
  • Grouper WS SCIM:compile
  • Grouper WS:provided

Identifiers

javassist-3.22.0-GA.jar

Description:

  	Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation
    simple.  It is a class library for editing bytecodes in Java.

License:

MPL 1.1: http://www.mozilla.org/MPL/MPL-1.1.html
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Apache License 2.0: http://www.apache.org/licenses/
File Path: /home/grprdist/.m2/repository/org/javassist/javassist/3.22.0-GA/javassist-3.22.0-GA.jar
MD5: 69f277ed4c6631e45ec4cacd0e6e46c6
SHA1: 3e83394258ae2089be7219b971ec21a8288528ad
SHA256:59531c00f3e3aa1ff48b3a8cf4ead47d203ab0e2fd9e0ad401f764e05947e252
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

javax.activation-api-1.2.0.jar

Description:

JavaBeans Activation Framework API jar

License:

https://github.com/javaee/activation/blob/master/LICENSE.txt
File Path: /home/grprdist/.m2/repository/javax/activation/javax.activation-api/1.2.0/javax.activation-api-1.2.0.jar
MD5: 5e50e56bcf4a3ef3bc758f69f7643c3b
SHA1: 85262acf3ca9816f9537ca47d5adeabaead7cb16
SHA256:43fdef0b5b6ceb31b0424b208b930c74ab58fac2ceeb7b3f6fd3aeb8b5ca4393
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

javax.mail-1.5.0.jar

Description:

JavaMail API

License:

https://glassfish.java.net/public/CDDL+GPL_1_1.html
File Path: /home/grprdist/.m2/repository/com/sun/mail/javax.mail/1.5.0/javax.mail-1.5.0.jar
MD5: dabf8c0f32c7f6eb5c87aebd53e07fce
SHA1: ec2410fdf7e0a3022e7c2a2e6241039d1abc1e98
SHA256:9568765e086609fc4d511b27cb89b3351a40ebda0552852a7daf65b769a01511
Referenced In Projects/Scopes:
  • Grouper WS SCIM:compile
  • Grouper WS:provided

Identifiers

javax.mail-api-1.6.0.jar

Description:

JavaMail API jar

License:

https://javaee.github.io/javamail/LICENSE
File Path: /home/grprdist/.m2/repository/javax/mail/javax.mail-api/1.6.0/javax.mail-api-1.6.0.jar
MD5: f641c3a2ad76a53acfbec7d7f5d8021d
SHA1: 1941270d3b04ded5bdc274351450b4afe47be080
SHA256:cddf58552871afe398061fffc36aec20899ad1f05a8141d90914e26d83980a66
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

javax.persistence-api-2.2.jar

Description:

Java(TM) Persistence API

License:

Eclipse Public License v1.0: http://www.eclipse.org/legal/epl-v10.html
Eclipse Distribution License v. 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /home/grprdist/.m2/repository/javax/persistence/javax.persistence-api/2.2/javax.persistence-api-2.2.jar
MD5: e6520b3435f5b6d58eee415b5542abf8
SHA1: 25665ac8c0b62f50e6488173233239120fc52c96
SHA256:5578b71b37999a5eaed3fea0d14aa61c60c6ec6328256f2b63472f336318baf4
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

javax.servlet-api-3.1.0.jar

Description:

Java(TM) Servlet 3.1 API Design Specification

License:

CDDL + GPLv2 with classpath exception: https://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: /home/grprdist/.m2/repository/javax/servlet/javax.servlet-api/3.1.0/javax.servlet-api-3.1.0.jar
MD5: 79de69e9f5ed8c7fcb8342585732bbf7
SHA1: 3cd63d075497751784b2fa84be59432f4905bf7c
SHA256:af456b2dd41c4e82cf54f3e743bc678973d9fe35bd4d3071fa05c7e5333b8482
Referenced In Projects/Scopes:
  • Grouper API:provided
  • Grouper WS:provided
  • Grouper UI:provided

Identifiers

javax.servlet.jsp-api-2.3.2-b02.jar

Description:

Java.net - The Source for Java Technology Collaboration

License:

CDDL + GPLv2 with classpath exception: http://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: /home/grprdist/.m2/repository/javax/servlet/jsp/javax.servlet.jsp-api/2.3.2-b02/javax.servlet.jsp-api-2.3.2-b02.jar
MD5: 5a0f2ffd45ce2722ab1c096571dbefc4
SHA1: 0287387015b38bb4fc5d5f085c938ab51bf82b00
SHA256:baf462a8b451bb2e00aebab92adc8005fa42f11b82b8e7335165842d80413d16
Referenced In Project/Scope:Grouper UI:provided

Identifiers

javax.servlet.jsp.jstl-api-1.2.1.jar

Description:

Java.net - The Source for Java Technology Collaboration

License:

CDDL + GPLv2 with classpath exception: http://glassfish.dev.java.net/nonav/public/CDDL+GPL.html
File Path: /home/grprdist/.m2/repository/javax/servlet/jsp/jstl/javax.servlet.jsp.jstl-api/1.2.1/javax.servlet.jsp.jstl-api-1.2.1.jar
MD5: e81f03bad3a397e1a07561e4b00be00b
SHA1: f072f63ab1689e885ac40c221df3e6bb3e64a84a
SHA256:f8fe158caa6c220bbc2d94da08773af101909da02ff61725392b7c603dd693e0
Referenced In Projects/Scopes:
  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

jaxb-api-2.2.jar

File Path: /home/grprdist/.m2/repository/javax/xml/bind/jaxb-api/2.2/jaxb-api-2.2.jar
MD5: cc9e4d0fb397b4ab294a4bdde36177eb
SHA1: bcf23b1d858c6f69d67c851d497984d25345d0b1
SHA256:34c022696b577e984d42641428e6e49a8afa0257c4ec96feff36e4b67c093390
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

jaxb-api-2.3.1.jar

Description:

JAXB (JSR 222) API

License:

https://oss.oracle.com/licenses/CDDL+GPL-1.1, https://oss.oracle.com/licenses/CDDL+GPL-1.1
File Path: /home/grprdist/.m2/repository/javax/xml/bind/jaxb-api/2.3.1/jaxb-api-2.3.1.jar
MD5: bcf270d320f645ad19f5edb60091e87f
SHA1: 8531ad5ac454cc2deb9d4d32c40c4d7451939b5d
SHA256:88b955a0df57880a26a74708bc34f74dcaf8ebf4e78843a28b50eae945732b06
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jaxb-impl-2.2.1.1.jar

Description:

JAXB (JSR 222) reference implementation

License:

CDDL 1.0: https://glassfish.dev.java.net/public/CDDL+GPL.html
GPL2 w/ CPE: https://glassfish.dev.java.net/public/CDDL+GPL.html
File Path: /home/grprdist/.m2/repository/com/sun/xml/bind/jaxb-impl/2.2.1.1/jaxb-impl-2.2.1.1.jar
MD5: dac518925b66b9e6c1a510179e5bd690
SHA1: 12b12db16f9f63f9e6b842a676d09a5c195d1dde
SHA256:f1a30f934a2dce2a68c30fbdfa2657cf24be774415df66f54fce5547015a781c
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

jaxb-runtime-2.3.1.jar

Description:

JAXB (JSR 222) Reference Implementation

File Path: /home/grprdist/.m2/repository/org/glassfish/jaxb/jaxb-runtime/2.3.1/jaxb-runtime-2.3.1.jar
MD5: 848098e3eda0d37738d51a7acacd8e95
SHA1: dd6dda9da676a54c5b36ca2806ff95ee017d8738
SHA256:45fecfa5c8217ce1f3652ab95179790ec8cc0dec0384bca51cbeb94a293d9f2f
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jaxen-1.1.1.jar

Description:

Jaxen is a universal Java XPath engine.

File Path: /home/grprdist/.m2/repository/jaxen/jaxen/1.1.1/jaxen-1.1.1.jar
MD5: 261d1aa59865842ecc32b3848b0c6538
SHA1: 9f5d3c5974dbe5cf69c2c2ec7d8a4eb6e0fce7f9
SHA256:160958f42f60fff817d6c0b1b02fd9284b3f0fcb46e61d38866f65b7af4d329d
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

jaxen-1.1.6.jar

Description:

Jaxen is a universal Java XPath engine.

License:

http://jaxen.codehaus.org/license.html
File Path: /home/grprdist/.m2/repository/jaxen/jaxen/1.1.6/jaxen-1.1.6.jar
MD5: a140517286b56eea981e188dcc3a13f6
SHA1: 3f8c36d9a0578e8e98f030c662b69888b1430ac0
SHA256:5ac9c74bbb3964b34a886ba6b1b6c0b0dc3ebeebc1dc4a44942a76634490b3eb
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

jboss-logging-3.3.1.Final.jar

Description:

The JBoss Logging Framework

License:

Apache License, version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/jboss/logging/jboss-logging/3.3.1.Final/jboss-logging-3.3.1.Final.jar
MD5: 93cf8945ff84aaf9f0ed9a76991338fb
SHA1: c46217ab74b532568c0ed31dc599db3048bd1b67
SHA256:9f7d8b884370763b131bf48a0fc91edec89ad80e0e40c47658098a686a905bb2
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jboss-transaction-api_1.2_spec-1.1.1.Final.jar

Description:

The Java Transaction 1.2 API classes

License:

Common Development and Distribution License: http://repository.jboss.org/licenses/cddl.txt
GNU General Public License, Version 2 with the Classpath Exception: http://repository.jboss.org/licenses/gpl-2.0-ce.txt
File Path: /home/grprdist/.m2/repository/org/jboss/spec/javax/transaction/jboss-transaction-api_1.2_spec/1.1.1.Final/jboss-transaction-api_1.2_spec-1.1.1.Final.jar
MD5: 1e633c47138aba999d39692a31a1a124
SHA1: a8485cab9484dda36e9a8c319e76b5cc18797b58
SHA256:a310a50b9bdc44aaf36362dc9bb212235a147ffa8ef72dc9544a39c329eabbc3
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jcip-annotations-1.0-1.jar

Description:

    A clean room implementation of the JCIP Annotations based entirely on the specification provided by the javadocs.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/github/stephenc/jcip/jcip-annotations/1.0-1/jcip-annotations-1.0-1.jar
MD5: d62dbfa8789378457ada685e2f614846
SHA1: ef31541dd28ae2cefdd17c7ebf352d93e9058c63
SHA256:4fccff8382aafc589962c4edb262f6aa595e34f1e11e61057d1c6a96e8fc7323
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jersey-server-2.36.jar

Description:

Jersey core server implementation

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
The GNU General Public License (GPL), Version 2, With Classpath Exception: https://www.gnu.org/software/classpath/license.html
Apache License, 2.0: http://www.apache.org/licenses/LICENSE-2.0.html
Modified BSD: https://asm.ow2.io/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/jersey/core/jersey-server/2.36/jersey-server-2.36.jar
MD5: 8dd2bd5634c82b57eebb0fe35aaccee2
SHA1: 73cf67d0d761b60860b7721529503a121cfa9df4
SHA256:2699758d1c33a9137363fd022d8c9c00423c800c4fde2b49d53530987e8da72d
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

jetty-6.1.26.jar

Description:

Jetty server core

License:

http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.php
File Path: /home/grprdist/.m2/repository/org/mortbay/jetty/jetty/6.1.26/jetty-6.1.26.jar
MD5: 12b65438bbaf225102d0396c21236052
SHA1: 2f546e289fddd5b1fab1d4199fbb6e9ef43ee4b0
SHA256:21091d3a9c1349f640fdc421504a604c040ed89087ecc12afbe32353326ed4e5
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile

Identifiers

CVE-2011-4461  

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References:

Vulnerable Software & Versions: (show all)

CVE-2009-1523  

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

jline-2.14.5.jar

License:

The BSD License: http://www.opensource.org/licenses/bsd-license.php
File Path: /home/grprdist/.m2/repository/jline/jline/2.14.5/jline-2.14.5.jar
MD5: 54de3b3c5a84e395d8066c143802985e
SHA1: fdedd5f2522122102f0b3db85fe7aa563a009926
SHA256:4f347bc90d6f5ce61c0f8928d44a7b993275ceaa7d7f237714518a9bdd5003ce
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jmespath-java-1.12.267.jar

Description:

Implementation of the JMES Path JSON Query langauge for Java.

License:

Apache License, Version 2.0: https://aws.amazon.com/apache2.0
File Path: /home/grprdist/.m2/repository/com/amazonaws/jmespath-java/1.12.267/jmespath-java-1.12.267.jar
MD5: e2a19172a5599b97ba09a270eac7acda
SHA1: 27260189acb9fbfc3a72c8f67dbdf4ce7d11276b
SHA256:dfa93938d0c40fd07e8e97fc0db2d9b062eb69d295e524c5dd614956bf13844e
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

joda-time-2.9.9.jar

Description:

Date and time library to replace JDK date handling

License:

Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/joda-time/joda-time/2.9.9/joda-time-2.9.9.jar
MD5: eca438c8cc2b1de38e28d884b7f15dbc
SHA1: f7b520c458572890807d143670c9b24f4de90897
SHA256:b049a43c1057942e6acfbece008e4949b2e35d1658d0c8e06f4485397e2fa4e7
Referenced In Projects/Scopes:
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

jose4j-0.4.4.jar

Description:

     The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK).
     It is written in Java and relies solely on the JCA APIs for cryptography.
     Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/bitbucket/b_c/jose4j/0.4.4/jose4j-0.4.4.jar
MD5: 0b1441282db12afb083ed1362e26b5fa
SHA1: 82deffa5cab3871084b47c24b467745c881996f0
SHA256:ba3a665487af6671f70e1742b3a5a60b8e3f091317f1aa6cb85c77fa884a90a2
Referenced In Project/Scope:Grouper Box:compile

Identifiers

jsch-0.1.55.jar

Description:

JSch is a pure Java implementation of SSH2

License:

Revised BSD: http://www.jcraft.com/jsch/LICENSE.txt
File Path: /home/grprdist/.m2/repository/com/jcraft/jsch/0.1.55/jsch-0.1.55.jar
MD5: c395ada0fc012d66f11bd30246f6c84d
SHA1: bbd40e5aa7aa3cfad5db34965456cee738a42a50
SHA256:d492b15a6d2ea3f1cc39c422c953c40c12289073dbe8360d98c0f6f9ec74fc44
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

json-20140107.jar

Description:

		JSON is a light-weight, language independent, data interchange format.
		See http://www.JSON.org/

		The files in this package implement JSON encoders/decoders in Java.
		It also includes the capability to convert between JSON and XML, HTTP
		headers, Cookies, and CDL.

		This is a reference implementation. There is a large number of JSON packages
		in Java. Perhaps someday the Java community will standardize on one. Until
		then, choose carefully.

		The license includes this restriction: "The software shall be used for good,
		not evil." If your conscience cannot live with that, then choose a different
		package.

		The package compiles on Java 1.2 thru Java 1.4.

License:

The JSON License: http://json.org/license.html
File Path: /home/grprdist/.m2/repository/org/json/json/20140107/json-20140107.jar
MD5: 8ca2437d3dbbaa2e76195adedfd901f4
SHA1: d1ffca6e2482b002702c6a576166fd685e3370e3
SHA256:8e5aa0a368bee60347b5a4ad861d9f68c7793f60deeea89efd449eb70d5ae622
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

CVE-2022-45688 (OSSINDEX)  

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CWE-787 Out-of-bounds Write

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.json:json:20140107:*:*:*:*:*:*:*

json-lib-2.4-jdk15.jar

File Path: /home/grprdist/.m2/repository/net/sf/json-lib/json-lib/2.4/json-lib-2.4-jdk15.jar
MD5: f5db294d05b3d5a5bfb873455b0a8626
SHA1: 136743e0d12df4e785e62b48618cee169b2ae546
SHA256:8290f8871ebd3db52e36c6fa844fe172895b2c714ea589cfed3d78ad9c01a924
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

json-smart-2.4.8.jar

Description:

JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. It is based on a subset of the JavaScript Programming Language, Standard ECMA-262 3rd Edition - December 1999. JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/net/minidev/json-smart/2.4.8/json-smart-2.4.8.jar
MD5: 20a8427206313ed3aa85cdc47f730415
SHA1: 7c62f5f72ab05eb54d40e2abf0360a2fe9ea477f
SHA256:174a9ad578b56644e62b3965d8bf94ac3a76e707c6343b8abac9d3671438b4b2
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

  • pkg:maven/net.minidev/json-smart@2.4.8  (Confidence:High)
  • cpe:2.3:a:ini-parser_project:ini-parser:2.4.8:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:json-smart_project:json-smart-v2:2.4.8:*:*:*:*:*:*:*  (Confidence:Low)  

jsoup-1.15.3.jar

Description:

jsoup is a Java library for working with real-world HTML. It provides a very convenient API for fetching URLs and extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.

License:

The MIT License: https://jsoup.org/license
File Path: /home/grprdist/.m2/repository/org/jsoup/jsoup/1.15.3/jsoup-1.15.3.jar
MD5: 4f16c3b17b8c1b0173b1ed9f99f2c27c
SHA1: f6e1d8a8819f854b681c8eaa57fd59a42329e10c
SHA256:e20a5e78b1372f2a4e620832db4442d5077e5cbde280b24c666a3770844999bc
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope:Grouper Google Apps Provisioner:compile

Identifiers

jsr311-api-1.1.1.jar

License:

                CDDL License
            : http://www.opensource.org/licenses/cddl1.php
File Path: /home/grprdist/.m2/repository/javax/ws/rs/jsr311-api/1.1.1/jsr311-api-1.1.1.jar
MD5: c9803468299ec255c047a280ddec510f
SHA1: 59033da2a1afd56af1ac576750a8d0b1830d59e6
SHA256:ab1534b73b5fa055808e6598a5e73b599ccda28c3159c3c0908977809422ee4a
Referenced In Projects/Scopes:
  • Grouper SCIM:compile
  • Grouper WS Generated Client:compile
  • Grouper WS SCIM:compile

Identifiers

jta-1.1.jar

Description:

    The javax.transaction package. It is appropriate for inclusion in a classpath, and may be added to a Java 2 installation.

File Path: /home/grprdist/.m2/repository/javax/transaction/jta/1.1/jta-1.1.jar
MD5: 82a10ce714f411b28f13850059de09ee
SHA1: 2ca09f0b36ca7d71b762e14ea2ff09d5eac57558
SHA256:b8ec163b4a47bad16f9a0b7d03c3210c6b0a29216d768031073ac20817c0ba50
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

kahadb-5.7.0.jar

Description:

An Embedded Lightweight Non-Relational Database

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/activemq/kahadb/5.7.0/kahadb-5.7.0.jar
MD5: 9dca17bdb723eb03b24e8532f0ccabe1
SHA1: c45eff4b78ca1f5f7469e4f4e094dbd4c8038adf
SHA256:0cb14a39a6ae2a62a05cafd81cab688705e25df1b57fd4bac3e61a49b696b394
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

CVE-2014-3600  

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2015-5254  

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2016-3088  

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2014-3576  

The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2014-3612  

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
CWE-287 Improper Authentication

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2019-0222  

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11775  

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
CWE-295 Improper Certificate Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.4)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-3060  

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
CWE-287 Improper Authentication

CVSSv2:
  • Base Score: MEDIUM (6.4)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2016-0734  

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
CWE-254 7PK - Security Features

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2016-6810  

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2018-8006  

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2020-13947  

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-1941  

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-13920  

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
CWE-306 Missing Authentication for Critical Function

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2012-5784  

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2016-0782  

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.4)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2012-6551  

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
CWE-399 Resource Management Errors

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-1830  

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2015-6524  

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
CWE-255 Credentials Management

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2015-7559  

It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (4.9)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2012-6092  

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js.  NOTE: AMQ-4124 is covered by CVE-2012-6551.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-1879  

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-1880  

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2014-8110  

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

lang-tag-1.7.jar

Description:

Java implementation of "Tags for Identifying Languages" (RFC 5646)

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/nimbusds/lang-tag/1.7/lang-tag-1.7.jar
MD5: 31b8a4f76fdbf21f1d667f9d6618e0b2
SHA1: 97c73ecd70bc7e8eefb26c5eea84f251a63f1031
SHA256:e8c1c594e2425bdbea2d860de55c69b69fc5d59454452449a0f0913c2a5b8a31
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

ldaptive-1.2.4.jar

Description:

Ldaptive API

License:

http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-3.0.txt
File Path: /home/grprdist/.m2/repository/org/ldaptive/ldaptive/1.2.4/ldaptive-1.2.4.jar
MD5: fb195e2011383d6dc6678ceea2406ba8
SHA1: 05866d99f046d84c243c57ad120cb7d5bc8b07a5
SHA256:3e8bac957050e1261c06933b4e11eff4a8e45bad3dd8e42af0d851d5d942722b
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

log4j-core-2.17.1.jar

Description:

The Apache Log4j Implementation

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/logging/log4j/log4j-core/2.17.1/log4j-core-2.17.1.jar
MD5: 8d2f5c52700336dae846b2c3ecde7a6e
SHA1: 779f60f3844dadc3ef597976fcb1e5127b1f343d
SHA256:c967f223487980b9364e94a7c7f9a8a01fd3ee7c19bdbf0b0f9f8cb8511f3d41
Referenced In Projects/Scopes:
  • Grouper WS Parent:compile
  • Grouper Client:compile
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Office365 and Azure Provisioner:compile
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper WS SCIM:compile
  • Grouper:compile
  • Grouper ActiveMQ Messaging:compile
  • Grouper SCIM:compile
  • Grouper Box:compile
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper Rabbitmq:compile
  • Grouper AMQ:compile
  • Grouper Installer:compile
  • Grouper WS Manual Client:compile
  • Grouper Duo:compile
  • Grouper Google Apps Provisioner:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

log4j-slf4j-impl-2.17.1.jar

Description:

The Apache Log4j SLF4J API binding to Log4j 2 Core

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/logging/log4j/log4j-slf4j-impl/2.17.1/log4j-slf4j-impl-2.17.1.jar
MD5: 8d0e5934a9c341dbc3493d4039afd985
SHA1: 84692d456bcce689355d33d68167875e486954dd
SHA256:e9a03720e5d5076009c2530635da9d08485e28a0b0ec20708dadc51afb78e41e
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

logging-interceptor-3.14.7.jar

File Path: /home/grprdist/.m2/repository/com/squareup/okhttp3/logging-interceptor/3.14.7/logging-interceptor-3.14.7.jar
MD5: 30a08668c0c0de36ff97e48bd12492d5
SHA1: 20c38a174010e77a1649752d4e60f69f74606f65
SHA256:ec7e348bcf292b5bf5b34eefbde0ac91a81ea64b129824127d96b1129a0b303a
Referenced In Projects/Scopes:

  • Grouper Office365 and Azure Provisioner:compile
  • Grouper Duo:compile

Identifiers

lombok-1.14.8.jar

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: http://projectlombok.org/LICENSE
File Path: /home/grprdist/.m2/repository/org/projectlombok/lombok/1.14.8/lombok-1.14.8.jar
MD5: 1cbc1782a86f6e2d3b7337b1889cdfe5
SHA1: 8ac073941721e0b521ec8e8bad088b1e7b8cd332
SHA256:0493e0a2e0873763a74959fb07b2ec74fcfd4d277a2b010df58bf33fb3fec639
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

mail-1.4.7.jar

Description:

JavaMail API (compat)

License:

http://www.sun.com/cddl, https://glassfish.java.net/public/CDDL+GPL_1_1.html
File Path: /home/grprdist/.m2/repository/javax/mail/mail/1.4.7/mail-1.4.7.jar
MD5: 77f53ff0c78ba43c4812ecc9f53e20f8
SHA1: 9add058589d5d85adeb625859bf2c5eeaaedf12d
SHA256:78c33b4f7c7b60f4b680f2d2405b1f063d71929cf1a4fbc328888379f365fcfb
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

mchange-commons-java-0.2.15.jar

Description:

mchange-commons-java

License:

GNU Lesser General Public License, Version 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Eclipse Public License, Version 1.0: http://www.eclipse.org/org/documents/epl-v10.html
File Path: /home/grprdist/.m2/repository/com/mchange/mchange-commons-java/0.2.15/mchange-commons-java-0.2.15.jar
MD5: 97c4575d9d49d9afb71492e6bb4417da
SHA1: 6ef5abe5f1b94ac45b7b5bad42d871da4fda6bbc
SHA256:2b8fce65e95a3e968d5ab3507e2833f43df3daee0635ee51c7ce33343bb3a21c
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

mex-1.6.3-impl.jar

Description:

WS-Metadata Exchange implementation

File Path: /home/grprdist/.m2/repository/org/apache/axis2/mex/1.6.3/mex-1.6.3-impl.jar
MD5: 982464882b55d5c4bfe30527e2513be9
SHA1: 630125f012a1b9e02b876fadacdee2072b45df3a
SHA256:bc408486709a4636a95255dec40256cf1ee606469017c3b96e366e517bda5bd3
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

minimal-json-0.9.1.jar

Description:

A Minimal JSON Parser and Writer

License:

Eclipse Public License - v 1.0: http://www.eclipse.org/legal/epl-v10.html
File Path: /home/grprdist/.m2/repository/com/eclipsesource/minimal-json/minimal-json/0.9.1/minimal-json-0.9.1.jar
MD5: 81b1f21832f40ce97354fca3af91736e
SHA1: 9b409b88e38b11519ce3334cbcdda361462ac72d
SHA256:a6f45beef45c4dbc8e0f2943d02bb34d9d9bb720d4a17d4dc1f0a11cd1ef5858
Referenced In Project/Scope:Grouper Box:compile

Identifiers

moshi-1.8.0.jar

File Path: /home/grprdist/.m2/repository/com/squareup/moshi/moshi/1.8.0/moshi-1.8.0.jar
MD5: 118e54e31c739e1e8fb39f700bffc3c9
SHA1: 752e7b187599d3ccb174d00ba7235e29add736be
SHA256:42fe746d2694ea11fe6a02becd9da2ca3dafe97c9efd50a0f9af5c4596e74a6a
Referenced In Project/Scope:Grouper Office365 and Azure Provisioner:compile

Identifiers

mqtt-client-1.3.jar

Description:

     mqtt-client provides an ASL 2.0 licensed API to MQTT. It takes care of 
     automatically reconnecting to your MQTT server and restoring your client 
     session if any network failures occur. Applications can use a blocking 
     API style, a futures based API, or a callback/continuations passing API 
     style.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/fusesource/mqtt-client/mqtt-client/1.3/mqtt-client-1.3.jar
MD5: b7212dee2b38b12d23b3e200c654043f
SHA1: e3722695b436f4d254263eb50bdc0a5784f74634
SHA256:b0232c3594184d80e0956fd56cab10dcd0088d046540ed311540f4a7237e2dfb
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

CVE-2019-0222 (OSSINDEX)  

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.fusesource.mqtt-client:mqtt-client:1.3:*:*:*:*:*:*:*

mxparser-1.2.2.jar

Description:

    MXParser is a fork of xpp3_min 1.1.7 containing only the parser with merged changes of the Plexus fork.

License:

Indiana University Extreme! Lab Software License: https://raw.githubusercontent.com/x-stream/mxparser/master/LICENSE.txt
File Path: /home/grprdist/.m2/repository/io/github/x-stream/mxparser/1.2.2/mxparser-1.2.2.jar
MD5: 9d7e42409dfdcee9bd17903015bdeae2
SHA1: 476fb3b3bb3716cad797cd054ce45f89445794e9
SHA256:aeeee23a3303d811bca8790ea7f25b534314861c03cff36dafdcc2180969eb97
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

mysql-connector-java-8.0.28.jar

Description:

JDBC Type 4 driver for MySQL

License:

The GNU General Public License, v2 with FOSS exception
File Path: /home/grprdist/.m2/repository/mysql/mysql-connector-java/8.0.28/mysql-connector-java-8.0.28.jar
MD5: 95cde01c78e7b04e13305338d60e056a
SHA1: 33678b1729d4f832b9e4bcb2d5bbd67940920a7a
SHA256:a00ccdf537ff50e50067b989108c2235197ffb65e197149bbb669db843cd1c3e
Referenced In Projects/Scopes:
  • Grouper Duo:runtime
  • Grouper ActiveMQ Messaging:runtime
  • Grouper PSP-NG:runtime
  • Grouper WS:runtime
  • Grouper WS Test:runtime
  • Grouper Office365 and Azure Provisioner:runtime
  • Grouper AWS Messaging:runtime
  • Grouper Rabbitmq:runtime
  • Grouper Google Apps Provisioner:runtime
  • Grouper UI:runtime
  • Grouper API:runtime
  • Grouper WS Generated Client:runtime
  • Grouper AMQ:runtime
  • Grouper WS SCIM:runtime
  • Grouper SCIM:runtime
  • Grouper Box:runtime
  • Grouper UI webapp:runtime

Identifiers

neethi-3.0.2.jar

Description:

Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/neethi/neethi/3.0.2/neethi-3.0.2.jar
MD5: 51aed43fd54c1fcc86d531fd93250bc4
SHA1: 129d23d29de183eafe787b9566c2d0bbb8eab47a
SHA256:6131cc1fc941a49c0523c85574baeb5cf3380ab243bcc5f3ebe833b6b29c8859
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

netty-common-4.1.72.Final.jar (shaded: org.jctools:jctools-core:3.1.0)

Description:

Java Concurrency Tools Core Library

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/io/netty/netty-common/4.1.72.Final/netty-common-4.1.72.Final.jar/META-INF/maven/org.jctools/jctools-core/pom.xml
MD5: 08e7326c64d7fd6ae4ea32e7eb4e5b79
SHA1: 9deceaba814dea198202b04fe0eec0d2dbf69ea9
SHA256:acaf1b4c366f6794a734288a2c003f16af90a9c479cf4d7daade689764e4fb47
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

netty-tcnative-classes-2.0.46.Final.jar

Description:

    A Mavenized fork of Tomcat Native which incorporates various patches. This artifact is dynamically linked
    to OpenSSL and Apache APR.

File Path: /home/grprdist/.m2/repository/io/netty/netty-tcnative-classes/2.0.46.Final/netty-tcnative-classes-2.0.46.Final.jar
MD5: b398595d12e13f97ff9295abdf0d6a76
SHA1: 9937a832d9c19861822d345b48ced388b645aa5f
SHA256:d3ec888dcc4ac7915bf88b417c5e04fd354f4311032a748a6882df09347eed9a
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

netty-transport-4.1.72.Final.jar

Description:

Netty is an asynchronous event-driven network application framework for    rapid development of maintainable high performance protocol servers and    clients.

License:

https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/grprdist/.m2/repository/io/netty/netty-transport/4.1.72.Final/netty-transport-4.1.72.Final.jar
MD5: 6f4128413f9200c948bcceb2299bb7e5
SHA1: 99138b436a584879355aca8fe3c64b46227d5d79
SHA256:c5fb68e9a65b6e8a516adfcb9fa323479ee7b4d9449d8a529d2ecab3d3711d5a
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

CVE-2022-41881  

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.
CWE-674 Uncontrolled Recursion

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-41915  

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
CWE-436 Interpretation Conflict, CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2022-24823  

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
CWE-378 Creation of Temporary File With Insecure Permissions, CWE-379 Creation of Temporary File in Directory with Incorrect Permissions, CWE-668 Exposure of Resource to Wrong Sphere

CVSSv2:
  • Base Score: LOW (1.9)
  • Vector: /AV:L/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

nimbus-jose-jwt-9.24.4.jar (shaded: com.google.code.gson:gson:2.9.1)

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/nimbusds/nimbus-jose-jwt/9.24.4/nimbus-jose-jwt-9.24.4.jar/META-INF/maven/com.google.code.gson/gson/pom.xml
MD5: 7bd7595123078326684b630486e49fa8
SHA1: f0cf3edcef8dcb74d27cb427544a309eb718d772
SHA256:e5966323d7142570b37a4be979e21bc2dae848107e4dc416d8f44d9aa3f02903
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

nimbus-jose-jwt-9.24.4.jar

Description:

        Java library for Javascript Object Signing and Encryption (JOSE) and
        JSON Web Tokens (JWT)

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/nimbusds/nimbus-jose-jwt/9.24.4/nimbus-jose-jwt-9.24.4.jar
MD5: f00923fe2eb333891619668391ac4d14
SHA1: 29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37
SHA256:8d589630722a4c56349248652477fdaa4e30df9c732c4d6eac2f271437246304
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

oauth2-oidc-sdk-9.43.1.jar

Description:

		OAuth 2.0 SDK with OpenID Connection extensions for developing
		client and server applications.

License:

Apache License, version 2.0: https://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/grprdist/.m2/repository/com/nimbusds/oauth2-oidc-sdk/9.43.1/oauth2-oidc-sdk-9.43.1.jar
MD5: 564a5b104ad66dce737a0e281dac4293
SHA1: a25abc8ea0a91296063d55dbb57b698f81a4649c
SHA256:65d360ca0d7bb89302a8153c7acb30214d5c027b177c714d72dc05d41f993204
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

okhttp-3.14.7.jar

File Path: /home/grprdist/.m2/repository/com/squareup/okhttp3/okhttp/3.14.7/okhttp-3.14.7.jar
MD5: 46fa74c5a760f81f448f3b86a3c1bddd
SHA1: a8656952ad4315057d92e7b58bfd232c823e034f
SHA256:620d4fa43c5c6a5ef625760204a88799e1e4a65e1c7a1d8da02e061c4cbb8000
Referenced In Projects/Scopes:

  • Grouper Office365 and Azure Provisioner:compile
  • Grouper Duo:compile

Identifiers

CVE-2021-0341 (OSSINDEX)  

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069
CWE-295 Improper Certificate Validation

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:H/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.squareup.okhttp3:okhttp:3.14.7:*:*:*:*:*:*:*

okio-1.17.2.jar

File Path: /home/grprdist/.m2/repository/com/squareup/okio/okio/1.17.2/okio-1.17.2.jar
MD5: 54a6a8979bd8e64e1fbf21d511654737
SHA1: 78c7820b205002da4d2d137f6f312bd64b3d6049
SHA256:f80ce42d2ffac47ad4c47e1d6f980d604d247ceb1a886705cf4581ab0c9fe2b8
Referenced In Projects/Scopes:

  • Grouper Office365 and Azure Provisioner:compile
  • Grouper Duo:compile

Identifiers

opensaml-2.6.4.jar

Description:

        The OpenSAML-J library provides tools to support developers working with the Security Assertion Markup Language
        (SAML).

License:

Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/opensaml/opensaml/2.6.4/opensaml-2.6.4.jar
MD5: 70e20154abc9a94e230b5679e3603e5a
SHA1: de2c742b770bd58328fd05ebd9d9efc85f79d88c
SHA256:b8297a0b783113a5e0113ee69683addf99194b3ff981c0c90b85dda492f30064
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

openws-1.5.4.jar

Description:

        The OpenWS library provides a growing set of tools to work with web services at a low level. These tools include
        classes for creating and reading SOAP messages, transport-independent clients for connecting to web services,
        and various transports for use with those clients.

License:

Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/opensaml/openws/1.5.4/openws-1.5.4.jar
MD5: 5b5f0fbe27277f2d119d4c4feab48a12
SHA1: 942bd987e5956fcdf1eaa56cde87112ea871d0e8
SHA256:6bb7ed759c3c5318ee44cfe1cf483a91e31688df78b9501fcebd05dca559df76
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

org.apache.felix.framework-7.0.3.jar

Description:

OSGi R8 framework implementation.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/felix/org.apache.felix.framework/7.0.3/org.apache.felix.framework-7.0.3.jar
MD5: ea392d1ab3f5f416f8aa1ac14c1c14ff
SHA1: c60632913c11ae47e8a6dcd5b617f48ee17693f5
SHA256:afd53fb601da924552129a965e3c2fbe1a17a3824b77c7f74b318606ef9a174d
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

org.wso2.charon.core-2.1.3.jar

Description:

WSO2 Charon - SCIM Implementation

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/wso2/charon/org.wso2.charon.core/2.1.3/org.wso2.charon.core-2.1.3.jar
MD5: b9c7fdad7ba33088ae18eb87f62850c9
SHA1: a59aac1d9b10638093a2b34c7e85b8197fd7b116
SHA256:9faad93994ffc2226a1252b224101a7f95f576d6af4231ff2ac150042586c757
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

org.wso2.charon.samples-2.1.3.jar

Description:

WSO2 Charon - SCIM Implementation

File Path: /home/grprdist/.m2/repository/org/wso2/charon/org.wso2.charon.samples/2.1.3/org.wso2.charon.samples-2.1.3.jar
MD5: 174188250207f852a6d4a40c07214659
SHA1: 86648e72e7c865855deca7655eabeac741e3b918
SHA256:c2c9c64c2420f5b6c354d560c003d06bbffa3c61c23eafc42ff76a1913fcdd64
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

org.wso2.charon.utils-2.1.3.jar

Description:

WSO2 Charon - SCIM Implementation

File Path: /home/grprdist/.m2/repository/org/wso2/charon/org.wso2.charon.utils/2.1.3/org.wso2.charon.utils-2.1.3.jar
MD5: c917fc503ca82dde2b06436b86381316
SHA1: 3b8f16bcad7686008de6c4932155003322beb04f
SHA256:346183f82796efc1acb1b41c6925ef9264735569c4804447102f7652e935b2b4
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

CVE-2021-4277  

A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is dbab1b66955eeb3d76b34612b358307f5c4e3944. It is recommended to apply a patch to fix this issue. The identifier VDB-216749 was assigned to this vulnerability.
CWE-330 Use of Insufficiently Random Values

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions:

oro-2.0.8.jar

File Path: /home/grprdist/.m2/repository/oro/oro/2.0.8/oro-2.0.8.jar
MD5: 42e940d5d2d822f4dc04c65053e630ab
SHA1: 5592374f834645c4ae250f4c9fbb314c9369d698
SHA256:e00ccdad5df7eb43fdee44232ef64602bf63807c2d133a7be83ba09fd49af26e
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

osgi-resource-locator-1.0.3.jar

Description:

Used by various API providers that rely on META-INF/services mechanism to locate providers.

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/grprdist/.m2/repository/org/glassfish/hk2/osgi-resource-locator/1.0.3/osgi-resource-locator-1.0.3.jar
MD5: e7e82b82118c5387ae45f7bf3892909b
SHA1: de3b21279df7e755e38275137539be5e2c80dd58
SHA256:aab5d7849f7cfcda2cc7c541ba1bd365151d42276f151c825387245dfde3dd74
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

picocli-4.3.2.jar

Description:

Java command line parser with both an annotations API and a programmatic API. Usage help with ANSI styles and colors. Autocomplete. Nested subcommands. Easily included as source to avoid adding a dependency.

License:

The Apache Software License, version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/info/picocli/picocli/4.3.2/picocli-4.3.2.jar
MD5: f20bf12b29c0ffea894d557336171f39
SHA1: 37a9ed41f7a028611775b6e8ad831e3e5fcd6280
SHA256:43c9cf516012aad1ac5ce6b54642e9cb1271e66d827b06a879fd314144d57550
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

postgresql-42.5.1.jar

Description:

PostgreSQL JDBC Driver Postgresql

License:

BSD-2-Clause: https://jdbc.postgresql.org/about/license.html
File Path: /home/grprdist/.m2/repository/org/postgresql/postgresql/42.5.1/postgresql-42.5.1.jar
MD5: 378f8a2ddab2564a281e5f852800e2e9
SHA1: ac2f61eb3b1b4e47ea45de47e73d2e92f49e3ce1
SHA256:89e8bffa8b37b9487946012c690cf04f3103953051c1c193d88ee36b68d365ae
Referenced In Projects/Scopes:
  • Grouper Duo:runtime
  • Grouper ActiveMQ Messaging:runtime
  • Grouper PSP-NG:runtime
  • Grouper WS:runtime
  • Grouper WS Test:runtime
  • Grouper Office365 and Azure Provisioner:runtime
  • Grouper AWS Messaging:runtime
  • Grouper Rabbitmq:runtime
  • Grouper Google Apps Provisioner:runtime
  • Grouper UI:runtime
  • Grouper API:runtime
  • Grouper WS Generated Client:runtime
  • Grouper AMQ:runtime
  • Grouper WS SCIM:runtime
  • Grouper SCIM:runtime
  • Grouper Box:runtime
  • Grouper UI webapp:runtime

Identifiers

protobuf-java-3.11.4.jar

Description:

    Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an
    efficient yet extensible format.

License:

https://opensource.org/licenses/BSD-3-Clause
File Path: /home/grprdist/.m2/repository/com/google/protobuf/protobuf-java/3.11.4/protobuf-java-3.11.4.jar
MD5: c4ceefed77d79affded2a1302e74606d
SHA1: 7ec0925cc3aef0335bbc7d57edfd42b0f86f8267
SHA256:42e98f58f53d1a49fd734c2dd193880f2dfec3436a2993a00d06b8800a22a3f2
Referenced In Projects/Scopes:
  • Grouper Duo:runtime
  • Grouper ActiveMQ Messaging:runtime
  • Grouper PSP-NG:runtime
  • Grouper WS:runtime
  • Grouper WS Test:runtime
  • Grouper Office365 and Azure Provisioner:runtime
  • Grouper AWS Messaging:runtime
  • Grouper Rabbitmq:runtime
  • Grouper Google Apps Provisioner:runtime
  • Grouper UI:runtime
  • Grouper API:runtime
  • Grouper WS Generated Client:runtime
  • Grouper AMQ:runtime
  • Grouper WS SCIM:runtime
  • Grouper SCIM:runtime
  • Grouper Box:runtime
  • Grouper UI webapp:runtime

Identifiers

CVE-2022-3171  

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-3509 (OSSINDEX)  

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.google.protobuf:protobuf-java:3.11.4:*:*:*:*:*:*:*

CVE-2022-3510 (OSSINDEX)  

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-3510 for details
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.google.protobuf:protobuf-java:3.11.4:*:*:*:*:*:*:*

CVE-2021-22569  

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

proton-j-0.33.10.jar

Description:

Proton is a library for speaking AMQP.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/qpid/proton-j/0.33.10/proton-j-0.33.10.jar
MD5: 55d0529cb097f647e53cff7a4189b128
SHA1: fb31048dec7642e31982a46500acb211f52f6314
SHA256:1fcddf5c76e70eff331900443c51e1a2c8d313b5ffc70611995fadfb6c36d96a
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

qpid-jms-client-0.61.0.jar

Description:

The core JMS Client implementation

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/qpid/qpid-jms-client/0.61.0/qpid-jms-client-0.61.0.jar
MD5: e8bd7c8a71cdcebbd6701084d4caae11
SHA1: f53f49713a144de8e46cffb4af24a1775dea1e0c
SHA256:7aea6f78c010c34cce82de3f837ccf17362c4d05588bd2d0af6e938de575ca0b
Referenced In Project/Scope:Grouper ActiveMQ Messaging:compile

Identifiers

CVE-2016-3094  

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
CWE-20 Improper Input Validation, CWE-287 Improper Authentication

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

quartz-2.3.2.jar

Description:

Enterprise Job Scheduler

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
Apache Software License, Version 2.0
File Path: /home/grprdist/.m2/repository/org/quartz-scheduler/quartz/2.3.2/quartz-2.3.2.jar
MD5: d7299dbaec0e0ed7af281b07cc40c8c1
SHA1: 18a6d6b5a40b77bd060b34cb9f2acadc4bae7c8a
SHA256:639c6a675bc472e1568df9d8c954ff702da6f83ed27da0ff9a7bd12ed73b8bf0
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

rampart-core-1.6.3.jar

File Path: /home/grprdist/.m2/repository/org/apache/rampart/rampart-core/1.6.3/rampart-core-1.6.3.jar
MD5: 0cbfedf143fe82ac905007fa511b4edc
SHA1: 1e7bd2bd86b31cf3da506cedd7795f27dbb59786
SHA256:7b02ff1069eb88c269059dc1594367bdab5c5b71b2de8a3caf8c8bf231a5cf3e
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

rampart-policy-1.6.3.jar

File Path: /home/grprdist/.m2/repository/org/apache/rampart/rampart-policy/1.6.3/rampart-policy-1.6.3.jar
MD5: 8ca68b706a67111b8befb4aa4719b0e1
SHA1: f30fdc22cd01ac3af5e7993671f3a39e84e8817f
SHA256:6d2c5f7813aa45e1efd4bba19c8b4a973a8f979a397b1b6e7da4536fb3ac21c5
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

rampart-trust-1.6.3.jar

File Path: /home/grprdist/.m2/repository/org/apache/rampart/rampart-trust/1.6.3/rampart-trust-1.6.3.jar
MD5: 63b25725f4a2fe71065050a4fe25e50f
SHA1: f10e1cd5c7ba8b22a7569909ab06dde00191905d
SHA256:72fa50ae6524e65e3d15dda16aa64f2ad035efd3b4d658e1f5aac01302d59f23
Referenced In Projects/Scopes:

  • Grouper WS:runtime
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

reflections-0.9.9.jar

Description:

Reflections - a Java runtime metadata analysis

License:

WTFPL: http://www.wtfpl.net/
The New BSD License: http://www.opensource.org/licenses/bsd-license.html
File Path: /home/grprdist/.m2/repository/org/reflections/reflections/0.9.9/reflections-0.9.9.jar
MD5: 5f13944b355f927f956b6298136ad959
SHA1: 0296d8adb2f22a38025f44b45cac89835ff0bbaf
SHA256:6a6c56d436f1f34e609bbf2d9b222f449f916941916dd874e7e15ff907daed1c
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

retrofit-2.7.2.jar

File Path: /home/grprdist/.m2/repository/com/squareup/retrofit2/retrofit/2.7.2/retrofit-2.7.2.jar
MD5: 8dbee9c822e3bf4bcbfa4294117d2185
SHA1: b98baad220c2091db369e5943265f9d083cad1cc
SHA256:54b9d05e90fb5ae6777329fabb9b345705b3e2074d3729313d84fae727129f6b
Referenced In Project/Scope:Grouper Office365 and Azure Provisioner:compile

Identifiers

scim-common-2.22.jar

File Path: /home/grprdist/.m2/repository/edu/psu/swe/scim/scim-common/2.22/scim-common-2.22.jar
MD5: 863af25f99e1d327bc22532afeb42428
SHA1: 056ea5df19814b1f4e5dfea2e1030a6f3544c96c
SHA256:cda5ae540e8d2f44d3558d95758a7a0c1dc6004e17b0b732fe1f28012694eb81
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

scim-server-common-2.22.jar

File Path: /home/grprdist/.m2/repository/edu/psu/swe/scim/scim-server-common/2.22/scim-server-common-2.22.jar
MD5: ca435af9a84e81e3ee458cccc20e6454
SHA1: 1be5948ac74c352a3c1d702d9239daeee5eaf1e6
SHA256:f031a0e309ffdf53f70cddaae2c6dc7b8fc3938818cdaa0f5df18acf42e8d5d6
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

scim-spec-protocol-2.22.jar

File Path: /home/grprdist/.m2/repository/edu/psu/swe/scim/scim-spec-protocol/2.22/scim-spec-protocol-2.22.jar
MD5: 275585181fda639f510f472f4bdf4295
SHA1: 03dc0a008c95546e57db16d573326727eba3cf19
SHA256:aa865bd68c7d2b307805f9e77e55f7b56d509bf620738b2f487a5a21759e8c57
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

scim-spec-schema-2.22.jar

File Path: /home/grprdist/.m2/repository/edu/psu/swe/scim/scim-spec-schema/2.22/scim-spec-schema-2.22.jar
MD5: 67924518854e34c22ae83bc9df146993
SHA1: 07ba31a942dd8672640e0a47e605ad4ea6fb6159
SHA256:317b4d507593a37be9cd2a07dc75dc8331fc4b0f9d18554bf741a6ea68e14f2f
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

scim2-sdk-client-2.3.7.jar

Description:

      The UnboundID SCIM2 SDK is a library that may be used to interact with various
      types of SCIM-enabled endpoints (such as the UnboundID server products) to
      perform lightweight, cloud-based identity management via the SCIM Protocol.
      See http://simplecloud.info for more information.

License:

GNU General Public License version 2 (GPLv2): http://www.gnu.org/licenses/gpl-2.0.html
GNU Lesser General Public License version 2.1 (LGPLv2.1): http://www.gnu.org/licenses/lgpl-2.1.html
UnboundID SCIM2 SDK Free Use License: https://github.com/pingidentity/scim2
File Path: /home/grprdist/.m2/repository/com/unboundid/product/scim2/scim2-sdk-client/2.3.7/scim2-sdk-client-2.3.7.jar
MD5: e3e918223fb7cd140fbcd306b6135fc5
SHA1: 3d08d77a96d2fa5551183e9a9d226800053e233e
SHA256:6798a3c586dff309bf8913db9aeef755c8d651d3b64b7546378c8f46a683f550
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

scim2-sdk-common-2.3.7.jar

Description:

      The UnboundID SCIM2 SDK is a library that may be used to interact with various
      types of SCIM-enabled endpoints (such as the UnboundID server products) to
      perform lightweight, cloud-based identity management via the SCIM Protocol.
      See http://simplecloud.info for more information.

License:

GNU General Public License version 2 (GPLv2): http://www.gnu.org/licenses/gpl-2.0.html
GNU Lesser General Public License version 2.1 (LGPLv2.1): http://www.gnu.org/licenses/lgpl-2.1.html
UnboundID SCIM2 SDK Free Use License: https://github.com/pingidentity/scim2
File Path: /home/grprdist/.m2/repository/com/unboundid/product/scim2/scim2-sdk-common/2.3.7/scim2-sdk-common-2.3.7.jar
MD5: 31431671351615ee26879cb2c0bf61ae
SHA1: facf6780a0804e0262e395da0eb7fe3dd9eaf5ad
SHA256:59f19cfcd48ba49ee2f62f53777d55bba2a3b0b290285f836235d8e2d878cdad
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

scim2-sdk-server-2.3.7.jar

Description:

    The UnboundID SCIM2 SDK is a library that may be used to interact with various
    types of SCIM-enabled endpoints (such as the UnboundID server products) to
    perform lightweight, cloud-based identity management via the SCIM Protocol.
    See http://simplecloud.info for more information.

License:

GNU General Public License version 2 (GPLv2): http://www.gnu.org/licenses/gpl-2.0.html
GNU Lesser General Public License version 2.1 (LGPLv2.1): http://www.gnu.org/licenses/lgpl-2.1.html
UnboundID SCIM2 SDK Free Use License: https://github.com/pingidentity/scim2
File Path: /home/grprdist/.m2/repository/com/unboundid/product/scim2/scim2-sdk-server/2.3.7/scim2-sdk-server-2.3.7.jar
MD5: e2d8a00f5cd272affd32637fa660ed1a
SHA1: 228a2ff37cc5163a9fbaaa8319a0dfeb50c9bf60
SHA256:ea54049f80d77233fddbb96e94e53205119de2db4626583227757ac19f7e6ea3
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

serializer-2.7.1.jar

Description:

    Serializer to write out XML, HTML etc. as a stream of characters from an input DOM or from input
    SAX events.

File Path: /home/grprdist/.m2/repository/xalan/serializer/2.7.1/serializer-2.7.1.jar
MD5: a6b64dfe58229bdd810263fa0cc54cff
SHA1: 4b4b18df434451249bb65a63f2fb69e215a6a020
SHA256:a15078d243d4a20b6b4e8ae2f61ed4655e352054e121aada6f7441f1ed445a3c
Referenced In Project/Scope:Grouper WS Generated Client:runtime

Identifiers

CVE-2014-0107  

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2022-34169  

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CWE-681 Incorrect Conversion between Numeric Types

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

servlet-api-2.3.jar

File Path: /home/grprdist/.m2/repository/javax/servlet/servlet-api/2.3/servlet-api-2.3.jar
MD5: c097f777c6fd453277c6891b3bb4dc09
SHA1: 0137a24e9f62973f01f16dd23fc1b5a9964fd9ef
SHA256:8478b902d0815ed066db860fb14cc5d404548d4b6348ab930b46270fcddeba68
Referenced In Project/Scope:Grouper WS Generated Client:compile

Identifiers

slf4j-api-1.7.32.jar

Description:

The slf4j API

File Path: /home/grprdist/.m2/repository/org/slf4j/slf4j-api/1.7.32/slf4j-api-1.7.32.jar
MD5: fbcf58513bc25b80f075d812aad3e3cf
SHA1: cdcff33940d9f2de763bc41ea05a0be5941176c3
SHA256:3624f8474c1af46d75f98bc097d7864a323c81b3808aa43689a6e1c601c027be
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper ActiveMQ Messaging:compile
  • Grouper SCIM:compile
  • Grouper Box:compile
  • Grouper API:compile
  • Grouper WS:compile
  • Grouper Rabbitmq:compile
  • Grouper AMQ:compile
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

smack-3.1.0.jar

Description:

        Smack is an Open Source XMPP (Jabber) client library for instant messaging and presence. A pure Java library, it can be embedded into your applications to create anything from a full XMPP client to simple XMPP integrations such as sending notification messages.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0
File Path: /home/grprdist/.m2/repository/jivesoftware/smack/3.1.0/smack-3.1.0.jar
MD5: 362dd4c2fc9b23a33d47272456dd0c39
SHA1: 916a0fe08d840a08c950f49fb59b961e14d673b8
SHA256:c9a25e014608d3402b795d125c88a18a6e22e6c61c65b5e5d224e0f72f4aec8b
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2014-5075 (OSSINDEX)  

The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CWE-310 Cryptographic Issues

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:jivesoftware:smack:3.1.0:*:*:*:*:*:*:*

CVE-2014-0363 (OSSINDEX)  

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.
CWE-295 Improper Certificate Validation

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:jivesoftware:smack:3.1.0:*:*:*:*:*:*:*

spring-aop-3.0.7.RELEASE.jar

File Path: /home/grprdist/.m2/repository/org/springframework/spring-aop/3.0.7.RELEASE/spring-aop-3.0.7.RELEASE.jar
MD5: 833e6c239fa50bada08e5cb82582c82b
SHA1: e52176ba360e47d132bbc80dc144a916dd75eee7
SHA256:3658108e22da2a4bf6a245eb82631e12bbb8ede5c261a39efdc3801a19d6741b
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

CVE-2018-1270  

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22965  

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0225  

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2016-9878  

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11040  

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-4152  

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-6429  

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE'), CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-7315  

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0054  

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2018-1257  

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-5421  

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: LOW (3.6)
  • Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11039  

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-6430  

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.4)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2014-3625  

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2014-1904  

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

spring-core-3.0.7.RELEASE.jar

File Path: /home/grprdist/.m2/repository/org/springframework/spring-core/3.0.7.RELEASE/spring-core-3.0.7.RELEASE.jar
MD5: feeca5dd71af07bda262b0ed14dc1951
SHA1: 2c90825834a037aab6f6a71bbd05d81680832c49
SHA256:9c58303d3031da9fb220afe99d4bb28df24f938995dd06513d13abf35534c4c7
Referenced In Project/Scope:Grouper AMQ:compile

Identifiers

CVE-2018-1270  

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22965  

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0225  

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2016-9878  

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11040  

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-4152  

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-6429  

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE'), CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-7315  

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0054  

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2018-1257  

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-5421  

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: LOW (3.6)
  • Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11039  

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2013-6430  

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.4)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References:

Vulnerable Software & Versions:

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2014-3578 (OSSINDEX)  

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.springframework:spring-core:3.0.7.RELEASE:*:*:*:*:*:*:*

CVE-2014-3625  

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2014-1904  

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

standard-1.1.2.jar

File Path: /home/grprdist/.m2/repository/taglibs/standard/1.1.2/standard-1.1.2.jar
MD5: 65351d0487ad57edda9171bb3b46b98c
SHA1: a17e8a4d9a1f7fcc5eed606721c9ed6b7f18acf7
SHA256:2c0048ab3ce75a202f692b159d6aa0a68edce3e4e4c5123a3359a38b29faa6b1
Referenced In Projects/Scopes:

  • Grouper UI webapp:compile
  • Grouper UI:compile

Identifiers

CVE-2015-0254  

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
NVD-CWE-Other

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

stax-api-1.0-2.jar

Description:

    StAX is a standard XML processing API that allows you to stream XML data from and to your application.

License:

GNU General Public Library: http://www.gnu.org/licenses/gpl.txt
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0: http://www.sun.com/cddl/cddl.html
File Path: /home/grprdist/.m2/repository/javax/xml/stream/stax-api/1.0-2/stax-api-1.0-2.jar
MD5: 7d18b63063580284c3f5734081fdc99f
SHA1: d6337b0de8b25e53e81b922352fbea9f9f57ba0b
SHA256:e8c70ebd76f982c9582a82ef82cf6ce14a7d58a4a4dca5cb7b7fc988c80089b7
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

stax-ex-1.8.jar

Description:

Extensions to JSR-173 StAX API.

License:

                Dual license consisting of the CDDL v1.1 and GPL v2
            : https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
File Path: /home/grprdist/.m2/repository/org/jvnet/staxex/stax-ex/1.8/stax-ex-1.8.jar
MD5: a0ebfdbc6b5a34b174a1d1f732d1bdda
SHA1: 8cc35f73da321c29973191f2cf143d29d26a1df7
SHA256:95b05d9590af4154c6513b9c5dc1fb2e55b539972ba0a9ef28e9a0c01d83ad77
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

stax2-api-3.1.1.jar

Description:

Stax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API.

License:

The BSD License: http://www.opensource.org/licenses/bsd-license.php
File Path: /home/grprdist/.m2/repository/org/codehaus/woodstox/stax2-api/3.1.1/stax2-api-3.1.1.jar
MD5: 40d088c7b8b3f6759a40db54ce1f30e5
SHA1: 0466eab062e9d1a3ce2c4631b6d09b5e5c0cbd1b
SHA256:850bbbbaaa1e7ecc4ebecdb8a283ff36d1f2451c6797b0175bc40ae2ad9b31c4
Referenced In Projects/Scopes:
  • Grouper WS:runtime
  • Grouper WS Test:runtime
  • Grouper WS Generated Client:compile

Identifiers

swagger-annotations-1.5.0.jar

License:

http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/grprdist/.m2/repository/io/swagger/swagger-annotations/1.5.0/swagger-annotations-1.5.0.jar
MD5: c16eb2bdd9f90e97849950178c4c543d
SHA1: f7497f7887e65277c0dab1da1148cf211083f3d4
SHA256:298386371cef279ebafd891e78003bb6d0295abdcc7bc3542eea3c543526cc42
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

swagger-annotations-1.6.3.jar

License:

http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/grprdist/.m2/repository/io/swagger/swagger-annotations/1.6.3/swagger-annotations-1.6.3.jar
MD5: 942481616f73ad3273893e9c390985aa
SHA1: 7cd78274cad53849ab809a73cec06c7dbb5f374a
SHA256:ceb72bfad2be626cc0eeb53c7e89b727e5e270c25a533cc62a65d3f044bcae4d
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile

Identifiers

swagger-core-1.5.0.jar

File Path: /home/grprdist/.m2/repository/io/swagger/swagger-core/1.5.0/swagger-core-1.5.0.jar
MD5: abc2015d9e823cb96abfa7e2937b43fb
SHA1: 09d5cfb8188ac316bad3a7b38c46bac0568c60e4
SHA256:aab9520f832a76b5f79464742525d263d779250c070baaa1271327c7d6f66d2e
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

swagger-jaxrs-1.5.0.jar

File Path: /home/grprdist/.m2/repository/io/swagger/swagger-jaxrs/1.5.0/swagger-jaxrs-1.5.0.jar
MD5: a09d96c899411ac57a479c6635829600
SHA1: 04a77f3f95bfec3073d9d20660c16f54886dfc9f
SHA256:519bc52cbc7d1aef101f89f96059d89f8a6118b2f808163caf79beea445f67bd
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

swagger-models-1.5.0.jar

License:

http://www.apache.org/licenses/LICENSE-2.0.html
File Path: /home/grprdist/.m2/repository/io/swagger/swagger-models/1.5.0/swagger-models-1.5.0.jar
MD5: 5c3d553535fddea14a4e7e87c5fc59fa
SHA1: d2566bfc270073a559b342089f54086ee64ca5b1
SHA256:70ec229c809e595c1aebf7f5b0c9ace148f5e8afa65c6b93f1fa40a82f7107e5
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

txw2-2.3.1.jar

Description:

        TXW is a library that allows you to write XML documents.

File Path: /home/grprdist/.m2/repository/org/glassfish/jaxb/txw2/2.3.1/txw2-2.3.1.jar
MD5: 0fed730907ba86376ef392ee7eb42d5f
SHA1: a09d2c48d3285f206fafbffe0e50619284e92126
SHA256:34975dde1c6920f1a39791142235689bc3cd357e24d05edd8ff93b885bd68d60
Referenced In Projects/Scopes:

  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

unboundid-ldapsdk-4.0.9.jar

Description:

      The UnboundID LDAP SDK for Java is a fast, comprehensive, and easy-to-use
      Java API for communicating with LDAP directory servers and performing
      related tasks like reading and writing LDIF, encoding and decoding data
      using base64 and ASN.1 BER, and performing secure communication.  This
      package contains the Standard Edition of the LDAP SDK, which is a
      complete, general-purpose library for communicating with LDAPv3 directory
      servers.

License:

GNU General Public License version 2 (GPLv2): http://www.gnu.org/licenses/gpl-2.0.html
GNU Lesser General Public License version 2.1 (LGPLv2.1): http://www.gnu.org/licenses/lgpl-2.1.html
UnboundID LDAP SDK Free Use License: https://docs.ldap.com/ldap-sdk/docs/LICENSE-UnboundID-LDAPSDK.txt
File Path: /home/grprdist/.m2/repository/com/unboundid/unboundid-ldapsdk/4.0.9/unboundid-ldapsdk-4.0.9.jar
MD5: 9c4684b76cc5354f5af4796e0ae81df5
SHA1: b676202ad7b56718266fda979e280fa955792e1c
SHA256:693bc47a6d311217397f7fd78043272d8b090cec4fe1c8834b31fc9a138f8361
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

validation-api-1.1.0.Final.jar

Description:

        Bean Validation API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/javax/validation/validation-api/1.1.0.Final/validation-api-1.1.0.Final.jar
MD5: 4c257f52462860b62ab3cdab45f53082
SHA1: 8613ae82954779d518631e05daa73a6a954817d5
SHA256:f39d7ba7253e35f5ac48081ec1bc28c5df9b32ac4b7db20853e5a8e76bf7b0ed
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers

wink-client-1.4.jar

Description:

The Apache Software Foundation provides support for the Apache community of open-source software projects.    The Apache projects are characterized by a collaborative, consensus based development process, an open and    pragmatic software license, and a desire to create high quality software that leads the way in its field.    We consider ourselves not simply a group of projects sharing a server, but rather a community of developers    and users.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/wink/wink-client/1.4/wink-client-1.4.jar
MD5: 68f861b4a7b83e6b2967c873b1a46e56
SHA1: 236afba302284da7988a971157a91a1875dcad60
SHA256:92a5373479ddea707e912da02585059cea7ccbee4ac19d7f5bc4c6aacb72d3ec
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

CVE-2017-5249  

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner.
CWE-312 Cleartext Storage of Sensitive Information, CWE-922 Insecure Storage of Sensitive Information

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

woden-api-1.0M9.jar

Description:

The Woden project is a subproject of the Apache Web Services Project to    develop a Java class library for reading, manipulating, creating and writing WSDL documents,    initially to support WSDL 2.0 but with the longer term aim of supporting past, present and    future versions of WSDL.    There are two main deliverables: an API and an implementation. The Woden API consists of    a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the    W3C WSDL 2.0 specification. The implementation will be a high performance implementation    directly usable in other Apache projects such as Axis2.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/woden/woden-api/1.0M9/woden-api-1.0M9.jar
MD5: a95da428dca81540f6f387874d27e44d
SHA1: bd81f156f5ff87bc9f398d88932d7cd6f2989312
SHA256:c64fba998cca96b30528f074971e6d0a53c602da9dd56867e759cfd10d5094a9
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

woden-impl-commons-1.0M9.jar

Description:

The Woden project is a subproject of the Apache Web Services Project to    develop a Java class library for reading, manipulating, creating and writing WSDL documents,    initially to support WSDL 2.0 but with the longer term aim of supporting past, present and    future versions of WSDL.    There are two main deliverables: an API and an implementation. The Woden API consists of    a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the    W3C WSDL 2.0 specification. The implementation will be a high performance implementation    directly usable in other Apache projects such as Axis2.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/woden/woden-impl-commons/1.0M9/woden-impl-commons-1.0M9.jar
MD5: 867bba433148f1ce4dcdf1d4aa1ca77a
SHA1: fb97f4ef2a042aa0ce6393d1792ea21a88149c56
SHA256:cdb7ef3585c42bf59fbd5500d45e0092bbcd1e8a1af4f7fb2d4132e88be69237
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

woden-impl-dom-1.0M9.jar

Description:

The Woden project is a subproject of the Apache Web Services Project to    develop a Java class library for reading, manipulating, creating and writing WSDL documents,    initially to support WSDL 2.0 but with the longer term aim of supporting past, present and    future versions of WSDL.    There are two main deliverables: an API and an implementation. The Woden API consists of    a set of Java interfaces. The WSDL 2.0-specific portion of the Woden API conforms to the    W3C WSDL 2.0 specification. The implementation will be a high performance implementation    directly usable in other Apache projects such as Axis2.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/woden/woden-impl-dom/1.0M9/woden-impl-dom-1.0M9.jar
MD5: 3175d1b4b9d712e62f64f518312da5e0
SHA1: ac649d2a2c4fdd49149aefc27164e90f8312bde1
SHA256:16f675b7dc2f98ecc5634a4ba3a7e2a8a78342fb48d30016d38f106c9ca6ca3e
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

woodstox-core-asl-4.1.4.jar

Description:

Woodstox is a high-performance XML processor that
implements Stax (JSR-173) and SAX2 APIs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/codehaus/woodstox/woodstox-core-asl/4.1.4/woodstox-core-asl-4.1.4.jar
MD5: c6ad8f9f12dca37f99b6089098c470e9
SHA1: 79b82e7dfd5c24b228ea56456d6adce225259ec4
SHA256:d24cf82fa3f2b30a847036ff4c198dde397e43c4599aef9e93fcbe1e49186bc2
Referenced In Project/Scope:Grouper WS Generated Client:compile

Identifiers

woodstox-core-asl-4.2.0.jar

Description:

Woodstox is a high-performance XML processor that
implements Stax (JSR-173) and SAX2 APIs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/codehaus/woodstox/woodstox-core-asl/4.2.0/woodstox-core-asl-4.2.0.jar
MD5: ac7e73fcf52654c0642afdfccc7d9f57
SHA1: 7a3784c65cfa5c0553f31d000b43346feb1f4ee3
SHA256:5ccb662b21ed218aaf06fc0a46f8b78338bc4992a236b62b471fa3f2671ed0ae
Referenced In Projects/Scopes:
  • Grouper WS:runtime
  • Grouper WS Test:runtime

Identifiers

wsdl4j-1.6.2.jar

Description:

Java stub generator for WSDL

License:

CPL: http://www.opensource.org/licenses/cpl1.0.txt
File Path: /home/grprdist/.m2/repository/wsdl4j/wsdl4j/1.6.2/wsdl4j-1.6.2.jar
MD5: 2608a8ea3f07b0c08de8a7d3d0d3fc09
SHA1: dec1669fb6801b7328e01ad72fc9e10b69ea06c1
SHA256:e90120d26f1a163c5843c7a758d0a0c950d1b0970268ad0770d6c1cc50508c43
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

wss4j-1.6.19.jar

Description:

        The Apache WSS4J project provides a Java implementation of the primary security standards 
        for Web Services, namely the OASIS Web Services Security (WS-Security) specifications 
        from the OASIS Web Services Security TC.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/ws/security/wss4j/1.6.19/wss4j-1.6.19.jar
MD5: 924bee104f7c4d2d98a51acbf793b8f7
SHA1: 2d4d36b6a423aa14fd0a57a52ec8f25d3d5dc19a
SHA256:5befd9da5d52ca6b63836ffb1a420741a0556baa996567cb3af2d96c7bbfee28
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

wstx-asl-3.2.9.jar

Description:

Woodstox is a high-performance XML processor that implements Stax (JSR-173) API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/codehaus/woodstox/wstx-asl/3.2.9/wstx-asl-3.2.9.jar
MD5: 8cb7d88faca2da5a3f9a3c50eee1fc3b
SHA1: c82b6e8f225bb799540e558b10ee24d268035597
SHA256:fcfe0265682f49b40a81073959c7fc6d57efda8c86ccf3bc6700d884411b1271
Referenced In Project/Scope:Grouper SCIM:compile

Identifiers

CVE-2019-12401 (OSSINDEX)  

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.codehaus.woodstox:wstx-asl:3.2.9:*:*:*:*:*:*:*

xalan-2.7.1.jar

Description:

    Xalan-Java is an XSLT processor for transforming XML documents into HTML,
    text, or other XML document types. It implements XSL Transformations (XSLT)
    Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from
    the command line, in an applet or a servlet, or as a module in other program.

File Path: /home/grprdist/.m2/repository/xalan/xalan/2.7.1/xalan-2.7.1.jar
MD5: d43aad24f2c143b675292ccfef487f9c
SHA1: 75f1d83ce27bab5f29fff034fc74aa9f7266f22a
SHA256:55a2e95144acf1abe44fea91c2948525c9b1f00fcaa1d10e753e92872ffbdd1e
Referenced In Project/Scope:Grouper WS Generated Client:runtime

Identifiers

CVE-2014-0107  

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2022-34169  

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CWE-681 Incorrect Conversion between Numeric Types

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

xercesImpl-2.12.2.jar

Description:

      Xerces2 provides high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces continues to build upon the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

      The Apache Xerces2 parser is the reference implementation of XNI but other parser components, configurations, and parsers can be written using the Xerces Native Interface. For complete design and implementation documents, refer to the XNI Manual.

      Xerces2 provides fully conforming XML Schema 1.0 and 1.1 processors. An experimental implementation of the "XML Schema Definition Language (XSD): Component Designators (SCD) Candidate Recommendation (January 2010)" is also provided for evaluation. For more information, refer to the XML Schema page.

      Xerces2 also provides a complete implementation of the Document Object Model Level 3 Core and Load/Save W3C Recommendations and provides a complete implementation of the XML Inclusions (XInclude) W3C Recommendation. It also provides support for OASIS XML Catalogs v1.1.

      Xerces2 is able to parse documents written according to the XML 1.1 Recommendation, except that it does not yet provide an option to enable normalization checking as described in section 2.13 of this specification. It also handles namespaces according to the XML Namespaces 1.1 Recommendation, and will correctly serialize XML 1.1 documents if the DOM level 3 load/save APIs are in use.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/xerces/xercesImpl/2.12.2/xercesImpl-2.12.2.jar
MD5: 40e4f2d5aacfbf51a9a1572d77a0e5e9
SHA1: f051f988aa2c9b4d25d05f95742ab0cc3ed789e2
SHA256:6fc991829af1708d15aea50c66f0beadcd2cfeb6968e0b2f55c1b0909883fe16
Referenced In Projects/Scopes:
  • Grouper Rabbitmq:compile
  • Grouper UI webapp:compile
  • Grouper ActiveMQ Messaging:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

  • pkg:maven/xerces/xercesImpl@2.12.2  (Confidence:High)
  • cpe:2.3:a:apache:xerces-j:2.12.2:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:apache:xerces2_java:2.12.2:*:*:*:*:*:*:*  (Confidence:Low)  

CVE-2017-10355 (OSSINDEX)  

sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)

The software contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
CWE-833 Deadlock

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:xerces:xercesImpl:2.12.2:*:*:*:*:*:*:*

xml-apis-1.4.01.jar

Description:

xml-commons provides an Apache-hosted set of DOM, SAX, and 
    JAXP interfaces for use in other xml-based projects. Our hope is that we 
    can standardize on both a common version and packaging scheme for these 
    critical XML standards interfaces to make the lives of both our developers 
    and users easier. The External Components portion of xml-commons contains 
    interfaces that are defined by external standards organizations. For DOM, 
    that's the W3C; for SAX it's David Megginson and sax.sourceforge.net; for 
    JAXP it's Sun.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
The SAX License: http://www.saxproject.org/copying.html
The W3C License: http://www.w3.org/TR/2004/REC-DOM-Level-3-Core-20040407/java-binding.zip
File Path: /home/grprdist/.m2/repository/xml-apis/xml-apis/1.4.01/xml-apis-1.4.01.jar
MD5: 7eaad6fea5925cca6c36ee8b3e02ac9d
SHA1: 3789d9fada2d3d458c4ba2de349d48780f381ee3
SHA256:a840968176645684bb01aed376e067ab39614885f9eee44abe35a5f20ebe7fad
Referenced In Projects/Scopes:
  • Grouper WS Generated Client:runtime
  • Grouper Rabbitmq:compile
  • Grouper UI webapp:compile
  • Grouper ActiveMQ Messaging:compile
  • Grouper AWS Messaging:compile
  • Grouper UI:compile

Identifiers

CVE-2021-37533  

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

xmlpull-1.1.3.1.jar

License:

Public Domain: http://www.xmlpull.org/v1/download/unpacked/LICENSE.txt
File Path: /home/grprdist/.m2/repository/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar
MD5: cc57dacc720eca721a50e78934b822d2
SHA1: 2b8e230d2ab644e4ecaa94db7cdedbc40c805dfa
SHA256:34e08ee62116071cbb69c0ed70d15a7a5b208d62798c59f2120bb8929324cb63
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

xmlsec-1.5.8.jar

Description:

        Apache XML Security for Java supports XML-Signature Syntax and Processing,
        W3C Recommendation 12 February 2002, and XML Encryption Syntax and
        Processing, W3C Recommendation 10 December 2002. As of version 1.4,
        the library supports the standard Java API JSR-105: XML Digital Signature APIs.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar
MD5: 56b5b9c7aef3270bc9056f5332a5a325
SHA1: d0b5e51f571069a86c9578ec15d6d7f9da8c0e76
SHA256:f5965da6ba78949bc17724c56de70c4aeb2598663f6abb1ece63854ba21713ba
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

  • pkg:maven/org.apache.santuario/xmlsec@1.5.8  (Confidence:High)
  • cpe:2.3:a:apache:santuario_xml_security_for_java:1.5.8:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:apache:xml_security_for_java:1.5.8:*:*:*:*:*:*:*  (Confidence:Low)  

CVE-2021-40690  

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
CWE-200 Information Exposure

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

xmltooling-1.4.4.jar

Description:

XMLTooling-J is a low-level library that may be used to construct libraries that allow developers to work with XML in a Java beans manner.

License:

Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/org/opensaml/xmltooling/1.4.4/xmltooling-1.4.4.jar
MD5: 03e3929084aabe1b2a91a191a6932a57
SHA1: 8cf44998d4b9cca5f9eeb47cc95d95cea9f86714
SHA256:b2fb3f2b0c0c62b3aae6d83ccc127b972a0fd64b494fb435fdb4bbbaf329ddbd
Referenced In Projects/Scopes:
  • Grouper WS:compile
  • Grouper WS Test:compile
  • Grouper WS Generated Client:compile

Identifiers

CVE-2015-1796 (OSSINDEX)  

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
CWE-254 7PK - Security Features

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.opensaml:xmltooling:1.4.4:*:*:*:*:*:*:*

xstream-1.4.19.jar

Description:

XStream is a serialization library from Java objects to XML and back.

License:

BSD-3-Clause
File Path: /home/grprdist/.m2/repository/com/thoughtworks/xstream/xstream/1.4.19/xstream-1.4.19.jar
MD5: eb850b8fe0405670938f7e899ed8630f
SHA1: e0e581d812aa92ae12f07234f3398e06af74b112
SHA256:c9ac93527942189ae89fc9120676358f11ea8f713c635a9f2c70063fe6716634
Referenced In Projects/Scopes:
  • Grouper AWS Messaging:provided
  • Grouper PSP-NG:compile
  • Grouper WS Test:compile
  • Grouper Google Apps Provisioner:provided
  • Grouper WS Generated Client:compile
  • Grouper UI webapp:compile
  • Grouper Office365 and Azure Provisioner:provided
  • Grouper WS SCIM:compile
  • Grouper Box:provided
  • Grouper Rabbitmq:provided
  • Grouper API:compile
  • Grouper SCIM:provided
  • Grouper WS:compile
  • Grouper AMQ:compile
  • Grouper ActiveMQ Messaging:provided
  • Grouper Duo:compile
  • Grouper UI:compile

Identifiers

CVE-2022-40151  

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-40152  

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-41966  

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
CWE-502 Deserialization of Untrusted Data, CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), CWE-121 Stack-based Buffer Overflow

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

zjsonpatch-0.2.4.jar

Description:

Java Library to find / apply JSON Patches according to RFC 6902

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/grprdist/.m2/repository/com/flipkart/zjsonpatch/zjsonpatch/0.2.4/zjsonpatch-0.2.4.jar
MD5: ecf257dc37a5bb543456846a4fef6794
SHA1: 1211b0196b3e7db5eac3e4cf1bf338beaa18049b
SHA256:96f42ffb5956379f065b9e2cf79afa8e3bb24153eb31e77cfacc496b1f7eb8de
Referenced In Project/Scope:Grouper WS SCIM:compile

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the NPM Public Advisories.
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.