Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
File Path: C:\Users\Dad\.m2\repository\antlr\antlr\2.7.7\antlr-2.7.7.jar
MD5: f8f1352c52a4c6a500b597596501fc64
SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: AOP Alliance
License:
Public DomainFile Path: C:\Users\Dad\.m2\repository\aopalliance\aopalliance\1.0\aopalliance-1.0.jar
File Path: C:\Users\Dad\.m2\repository\asm\asm\3.3.1\asm-3.3.1.jar
MD5: 1ad1e8959324b0f680b8e62406955642
SHA1: 1d5f20b4ea675e6fab6ab79f1cd60ec268ddc015
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: JAXB (JSR 222) reference implementation
License:
CDDL 1.0: https://glassfish.dev.java.net/public/CDDL+GPL.html GPL2 w/ CPE: https://glassfish.dev.java.net/public/CDDL+GPL.htmlFile Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-impl\2.1.13\jaxb-impl-2.1.13.jar
Description: The core functionality of the CodeModel java source code generation library
File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.1.13\jaxb-xjc-2.1.13.jar
MD5: bd159bfd1ad36963f8f7bb05d7e8f644
SHA1: 0a953200fed20f683c09e8f419c2babb1d89d82a
Referenced In Project/Scope:
fgsms Agent Core:provided
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\commons-codec\commons-codec\1.10\commons-codec-1.10.jar
Description: Types that extend and augment the Java Collections Framework.
License:
The Apache Software License, Version 2.0: /LICENSE.txtFile Path: C:\Users\Dad\.m2\repository\commons-collections\commons-collections\3.2\commons-collections-3.2.jar
Severity:
High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Vulnerable Software & Versions: (show all)
File Path: C:\Users\Dad\.m2\repository\commons-daemon\commons-daemon\1.0.15\commons-daemon-1.0.15-bin-windows.zip\amd64\prunsrv.exe
MD5: c8a57f4ca413effd5897d8a20e05fc80
SHA1: aac510a623eeb46aad1af2a91930535e4fe28f91
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\commons-daemon\commons-daemon\1.0.15\commons-daemon-1.0.15-bin-windows.zip\ia64\prunsrv.exe
MD5: 3b06d0e5454e6812bba21b39ecfc83ba
SHA1: 0715fee00e5fcc4ce1c2b3dabbbddc4f3fa13e7e
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\commons-daemon\commons-daemon\1.0.15\commons-daemon-1.0.15-bin-windows.zip\prunmgr.exe
MD5: dcf47773e046ee212d937d5cabea5f4c
SHA1: 57483ea86f52ee8e529a9a53e2e18d7ddcd47e51
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\commons-daemon\commons-daemon\1.0.15\commons-daemon-1.0.15-bin-windows.zip\prunsrv.exe
MD5: 0be207e358e5c198e7cb005c08e96e89
SHA1: 8c31d27449cee7bf326485987dc3145f17ffaa66
Referenced In Project/Scope:
fgsms Agent Core:provided
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\commons-lang\commons-lang\2.6\commons-lang-2.6.jar
Description: Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems.
License:
The Apache Software License, Version 2.0: /LICENSE.txtFile Path: C:\Users\Dad\.m2\repository\commons-logging\commons-logging\1.1\commons-logging-1.1.jar
Description: Java.net - The Source for Java Technology Collaboration
License:
CDDL 1.1: http://glassfish.java.net/public/CDDL+GPL_1_1.html GPL2 w/ CPE: http://glassfish.java.net/public/CDDL+GPL_1_1.htmlFile Path: C:\Users\Dad\.m2\repository\javax\ws\rs\javax.ws.rs-api\2.0-m10\javax.ws.rs-api-2.0-m10.jar
Description: Date and time library to replace JDK date handling
License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\joda-time\joda-time\2.2\joda-time-2.2.jar
Description: Apache Log4j 1.2
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\log4j\log4j\1.2.17\log4j-1.2.17.jar
File Path: C:\Users\Dad\.m2\repository\net\oauth\core\oauth-provider\20100527\oauth-provider-20100527.jar
MD5: afdc85d3f14481e4842c317c4f414f7e
SHA1: 165bfc97e63e5af8e052a47f4dee832ce06bf7d7
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\net\oauth\core\oauth\20100527\oauth-20100527.jar
MD5: 91c7c70579f95b7ddee95b2143a49b41
SHA1: a84c5331e225bc25a5a288db328048d6b1bb6fd5
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: This is the ehcache core module. Pair it with other modules for added functionality.
License:
The Apache Software License, Version 2.0: src/assemble/EHCACHE-CORE-LICENSE.txtFile Path: C:\Users\Dad\.m2\repository\net\sf\ehcache\ehcache-core\2.5.1\ehcache-core-2.5.1.jar
File Path: C:\Users\Dad\.m2\repository\net\sf\ehcache\ehcache-core\2.5.1\ehcache-core-2.5.1.jar\net\sf\ehcache\pool\sizeof\sizeof-agent.jar
MD5: 5ad919b3ac0516897bdca079c9a222a8
SHA1: e86399a80ae6a6c7a563717eaa0ce9ba4708571c
Referenced In Project/Scope:
fgsms Agent Core:provided
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
https://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\commons\commons-lang3\3.5\commons-lang3-3.5.jar
Description: Apache CXF Runtime Core
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\cxf\cxf-rt-core\2.7.11\cxf-rt-core-2.7.11.jar
Severity:
Medium
CVSS Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-287 Improper Authentication
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-20 Improper Input Validation
The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerable Software & Versions: (show all)
Description: Javamail 1.4 Specification
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\geronimo\specs\geronimo-javamail_1.4_spec\1.7.1\geronimo-javamail_1.4_spec-1.7.1.jar
Description: Java API for XML Web Services 2.2
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\geronimo\specs\geronimo-jaxws_2.2_spec\1.1\geronimo-jaxws_2.2_spec-1.1.jar
Description: Provides open-source implementations of Sun specifications.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\geronimo\specs\geronimo-jms_1.1_spec\1.1.1\geronimo-jms_1.1_spec-1.1.1.jar
Description: Servlet 3.0 API
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\geronimo\specs\geronimo-servlet_3.0_spec\1.0\geronimo-servlet_3.0_spec-1.0.jar
Description:
HttpComponents AsyncClient (base module)
File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpasyncclient\4.0-beta3\httpasyncclient-4.0-beta3.jar
MD5: 0d7de844d1e348bf2d01ea84da612edf
SHA1: c841ffe78b77d6ca1fd38f744e2b107b5f6f74d6
Referenced In Project/Scope:
fgsms Agent Core:provided
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerable Software & Versions: (show all)
Description:
HttpComponents Client
File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar
MD5: 88cc3123fce88d61b7c2cdbfc33542c5
SHA1: 18f4247ff4572a074444572cee34647c43e7c9c7
Referenced In Project/Scope:
fgsms Agent Core:provided
Severity:
Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Vulnerable Software & Versions:
Severity:
Medium
CVSS Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerable Software & Versions: (show all)
Description:
HttpComponents Core (non-blocking I/O)
File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpcore-nio\4.2.4\httpcore-nio-4.2.4.jar
MD5: db3f32abe8abad5b442e77d624db666f
SHA1: 78afeee7048b6f541f0b2290a926b2af5768410f
Referenced In Project/Scope:
fgsms Agent Core:provided
Description:
HttpComponents Core (blocking I/O)
File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpcore\4.2.4\httpcore-4.2.4.jar
MD5: 6ccb86231d8a8b99c551b4ddf926ddd1
SHA1: 3b7f38df6de5dd8b500e602ae8c2dd5ee446f883
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: Apache MINA is a network application framework which helps users develop high performance and highly scalable network applications easily. It provides an abstract event-driven asynchronous API over various transports such as TCP/IP and UDP/IP via Java NIO.
License:
http://www.apache.org/licenses/LICENSE-2.0File Path: C:\Users\Dad\.m2\repository\org\apache\mina\mina-core\2.0.7\mina-core-2.0.7.jar
Description: Apache Neethi provides general framework for the programmers to use WS Policy. It is compliant with latest WS Policy specification which was published in March 2006. This framework is specifically written to enable the Apache Web services stack to use WS Policy as a way of expressing it's requirements and capabilities.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\neethi\neethi\3.0.3\neethi-3.0.3.jar
Description:
Apache XML Security for Java supports XML-Signature Syntax and Processing,
W3C Recommendation 12 February 2002, and XML Encryption Syntax and
Processing, W3C Recommendation 10 December 2002. As of version 1.4,
the library supports the standard Java API JSR-105: XML Digital Signature APIs.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\santuario\xmlsec\1.5.6\xmlsec-1.5.6.jar
Description: Apache Velocity is a general purpose template engine.
File Path: C:\Users\Dad\.m2\repository\org\apache\velocity\velocity\1.7\velocity-1.7.jar
MD5: 3692dd72f8367cb35fb6280dc2916725
SHA1: 2ceb567b8f3f21118ecdec129fe1271dbc09aa7a
Referenced In Project/Scope:
fgsms Agent Core:provided
Description:
The Apache WSS4J project provides a Java implementation of the primary security standards
for Web Services, namely the OASIS Web Services Security (WS-Security) specifications
from the OASIS Web Services Security TC.
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\ws\security\wss4j\1.6.15\wss4j-1.6.15.jar
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-264 Permissions, Privileges, and Access Controls
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-287 Improper Authentication
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Vulnerable Software & Versions: (show all)
Description: Commons XMLSchema is a light weight schema object model that can be used to manipulate or
generate XML schema.
License:
http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\ws\xmlschema\xmlschema-core\2.1.0\xmlschema-core-2.1.0.jar
Description: XmlBeans main jar
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\apache\xmlbeans\xmlbeans\2.6.0\xmlbeans-2.6.0.jar
Description: tax2 API is an extension to basic Stax 1.0 API that adds significant new functionality, such as full-featured bi-direction validation interface and high-performance Typed Access API.
License:
The BSD License: http://www.opensource.org/licenses/bsd-license.phpFile Path: C:\Users\Dad\.m2\repository\org\codehaus\woodstox\stax2-api\3.1.4\stax2-api-3.1.4.jar
Description: Woodstox is a high-performance XML processor that
implements Stax (JSR-173) and SAX2 APIs
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\codehaus\woodstox\woodstox-core-asl\4.2.1\woodstox-core-asl-4.2.1.jar
Description: Administrative parent pom for Jetty modules
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.phpFile Path: C:\Users\Dad\.m2\repository\org\eclipse\jetty\jetty-http\8.1.14.v20131031\jetty-http-8.1.14.v20131031.jar
Description: Administrative parent pom for Jetty modules
License:
http://www.apache.org/licenses/LICENSE-2.0, http://www.eclipse.org/org/documents/epl-v10.phpFile Path: C:\Users\Dad\.m2\repository\org\eclipse\jetty\jetty-io\8.1.14.v20131031\jetty-io-8.1.14.v20131031.jar
Description:
The OpenSAML-J library provides tools to support developers working with the Security Assertion Markup Language
(SAML).
File Path: C:\Users\Dad\.m2\repository\org\opensaml\opensaml\2.6.1\opensaml-2.6.1.jar
MD5: ba52e68b7522c3804fc196f56e31ca64
SHA1: 66992ce167f18e4552b79bc38d412f53ad2d80a1
Referenced In Project/Scope:
fgsms Agent Core:provided
Description:
The OpenWS library provides a growing set of tools to work with web services at a low level. These tools include
classes for creating and reading SOAP messages, transport-independent clients for connecting to web services,
and various transports for use with those clients.
File Path: C:\Users\Dad\.m2\repository\org\opensaml\openws\1.5.1\openws-1.5.1.jar
MD5: 4a6340e00990a21cc822e9430c70e022
SHA1: 5e9b1075c477871f78983d1c24eb3dacf6b2aa65
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: XMLTooling-J is a low-level library that may be used to construct libraries that allow developers to work with XML in a Java beans manner.
File Path: C:\Users\Dad\.m2\repository\org\opensaml\xmltooling\1.4.1\xmltooling-1.4.1.jar
MD5: 5f29a776cece576a6bf8a2529d3b8419
SHA1: aa39174a71035bdd28b3a3c890cac86b705c4980
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: The slf4j API
File Path: C:\Users\Dad\.m2\repository\org\slf4j\slf4j-api\1.7.7\slf4j-api-1.7.7.jar
MD5: ca4280bf93d64367723ae5c8d42dd0b9
SHA1: 2b8019b6249bb05d81d3a3094e468753e2b21311
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-aop\3.0.7.RELEASE\spring-aop-3.0.7.RELEASE.jar
MD5: 833e6c239fa50bada08e5cb82582c82b
SHA1: e52176ba360e47d132bbc80dc144a916dd75eee7
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-asm\3.0.7.RELEASE\spring-asm-3.0.7.RELEASE.jar
MD5: 5d479c7bf32d4bb3cb3b81dfdf3080f7
SHA1: cadd0ed7b1aeea0c2858ada0d6397e8423aad6a3
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-beans\3.0.7.RELEASE\spring-beans-3.0.7.RELEASE.jar
MD5: 0b9954842f12133fcff91bd90235182d
SHA1: 5915c3eee8dc193b19b648719d653439c57fc0d8
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: Spring Context
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txtFile Path: C:\Users\Dad\.m2\repository\org\springframework\spring-context\3.2.8.RELEASE\spring-context-3.2.8.RELEASE.jar
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-core\3.0.7.RELEASE\spring-core-3.0.7.RELEASE.jar
MD5: feeca5dd71af07bda262b0ed14dc1951
SHA1: 2c90825834a037aab6f6a71bbd05d81680832c49
Referenced In Project/Scope:
fgsms Agent Core:provided
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-352
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Vulnerable Software & Versions: (show all)
Severity:
Medium
CVSS Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Vulnerable Software & Versions: (show all)
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-expression\3.0.7.RELEASE\spring-expression-3.0.7.RELEASE.jar
MD5: 7880f6d36ee0352560700517d59e80a1
SHA1: 61999bb2e1e5f7a1c13e91a58761c48dc1d71cf9
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-jms\3.0.7.RELEASE\spring-jms-3.0.7.RELEASE.jar
MD5: bb872e0744176677ae65705317efa46f
SHA1: 1647b17010e96c713f589ec1b0265556443db00e
Referenced In Project/Scope:
fgsms Agent Core:provided
File Path: C:\Users\Dad\.m2\repository\org\springframework\spring-tx\3.0.7.RELEASE\spring-tx-3.0.7.RELEASE.jar
MD5: 9d8af113502df57b03734164654df6a3
SHA1: c340bf8606f6bf235bc1277d25315df1abe51c31
Referenced In Project/Scope:
fgsms Agent Core:provided
Description: Rhino is an open-source implementation of JavaScript written entirely in Java. It is typically embedded into Java applications to provide scripting to end users.
License:
Mozilla Public License: http://www.mozilla.org/MPL/MPL-1.1.htmlFile Path: C:\Users\Dad\.m2\repository\rhino\js\1.7R2\js-1.7R2.jar
Description: Java stub generator for WSDL
License:
CPL: http://www.opensource.org/licenses/cpl1.0.txtFile Path: C:\Users\Dad\.m2\repository\wsdl4j\wsdl4j\1.6.3\wsdl4j-1.6.3.jar
Description:
Serializer to write out XML, HTML etc. as a stream of characters from an input DOM or from input
SAX events.
File Path: C:\Users\Dad\.m2\repository\xalan\serializer\2.7.1\serializer-2.7.1.jar
MD5: a6b64dfe58229bdd810263fa0cc54cff
SHA1: 4b4b18df434451249bb65a63f2fb69e215a6a020
Referenced In Project/Scope:
fgsms Agent Core:provided
Severity:
High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-264 Permissions, Privileges, and Access Controls
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
Vulnerable Software & Versions: (show all)
Description: xml-commons provides an Apache-hosted set of DOM, SAX, and
JAXP interfaces for use in other xml-based projects. Our hope is that we
can standardize on both a common version and packaging scheme for these
critical XML standards interfaces to make the lives of both our developers
and users easier.
File Path: C:\Users\Dad\.m2\repository\xml-resolver\xml-resolver\1.2\xml-resolver-1.2.jar
MD5: 706c533146c1f4ee46b66659ea14583a
SHA1: 3d0f97750b3a03e0971831566067754ba4bfd68c
Referenced In Project/Scope:
fgsms Agent Core:provided