Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 1.4.5Report Generated On : Mar 11, 2017 at 23:44:30 ESTDependencies Scanned : 15 (15 unique)Vulnerable Dependencies : 2 Vulnerabilities Found : 3Vulnerabilities Suppressed : 0...
CurrentEngineRelease : NVD CVE 2002 : 19/02/2017 03:25:58NVD CVE 2003 : 19/02/2017 03:24:25NVD CVE 2004 : 19/02/2017 03:23:59NVD CVE 2005 : 24/02/2017 03:12:32NVD CVE 2006 : 19/02/2017 03:20:36NVD CVE 2007 : 19/02/2017 03:18:20NVD CVE 2008 : 19/02/2017 03:16:18NVD CVE 2009 : 19/02/2017 03:14:03NVD CVE 2010 : 09/02/2017 03:09:26NVD CVE 2011 : 19/02/2017 03:11:57NVD CVE 2012 : 24/02/2017 03:11:07NVD CVE 2013 : 24/02/2017 03:09:00NVD CVE 2014 : 01/03/2017 03:07:38NVD CVE 2015 : 04/03/2017 03:06:02NVD CVE 2016 : 05/03/2017 03:02:53NVD CVE 2017 : 05/03/2017 03:00:24NVD CVE Checked : 11/03/2017 23:34:50NVD CVE Modified : 11/03/2017 20:00:24VersionCheckOn : 1486838497071
Display:
Showing Vulnerable Dependencies (click to show all)
Dependencies
Description:
The Apache Commons Codec package contains simple encoder and decoders for
various formats such as Base64 and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: C:\Users\Dad\.m2\repository\commons-codec\commons-codec\1.10\commons-codec-1.10.jar
MD5: 353cf6a2bdba09595ccfa073b78c7fcb
SHA1: 4b95f4897fa13f2cd904aee711aeafc0c5295cd8
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-codec central groupid commons-codec central version 1.10 file name commons-codec file version 1.10 manifest Bundle-Description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. Manifest bundle-docurl http://commons.apache.org/proper/commons-codec/ Manifest Bundle-Name Apache Commons Codec Manifest bundle-symbolicname org.apache.commons.codec Manifest implementation-build trunk@r1637108; 2014-11-06 14:14:12+0000 Manifest Implementation-Title Apache Commons Codec Manifest Implementation-Vendor The Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 1.10 Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Manifest specification-title Apache Commons Codec Manifest specification-vendor The Apache Software Foundation pom artifactid commons-codec pom description The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. pom groupid commons-codec pom name Apache Commons Codec pom parent-artifactid commons-parent pom parent-groupid org.apache.commons pom url http://commons.apache.org/proper/commons-codec/ pom version 1.10
Description: Types that extend and augment the Java Collections Framework.
License:
The Apache Software License, Version 2.0: /LICENSE.txt
File Path: C:\Users\Dad\.m2\repository\commons-collections\commons-collections\3.2\commons-collections-3.2.jar
MD5: 7b9216b608d550787bdf43a63d88bf3b
SHA1: f951934aa5ae5a88d7e6dfaa6d32307d834a88be
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-collections central groupid commons-collections central version 3.2 file name commons-collections file version 3.2 Manifest extension-name commons-collections Manifest Implementation-Title Commons Collections Manifest Implementation-Vendor Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 3.2 Manifest specification-title Commons Collections Manifest specification-vendor Apache Software Foundation pom artifactid commons-collections pom description Types that extend and augment the Java Collections Framework. pom groupid commons-collections pom name Collections pom organization name http://jakarta.apache.org
pom url http://jakarta.apache.org/commons/collections/ pom version 3.2
Published Vulnerabilities
CVE-2015-6420 suppress
Severity:
High
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Vulnerable Software & Versions: (show all )
Description:
Tools to assist in the reading of configuration/preferences files in
various formats
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: C:\Users\Dad\.m2\repository\commons-configuration\commons-configuration\1.9\commons-configuration-1.9.jar
MD5: a433303bae1cd9ec6313fe7bbac8fbe9
SHA1: 5e8a4890284cf7eaa9241ace2cc07518d9519d22
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-configuration central groupid commons-configuration central version 1.9 file name commons-configuration file version 1.9 manifest Bundle-Description Tools to assist in the reading of configuration/preferences files in various formats Manifest bundle-docurl http://commons.apache.org/configuration/ Manifest Bundle-Name Commons Configuration Manifest bundle-symbolicname org.apache.commons.configuration Manifest implementation-build tags/CONFIGURATION_1_9RC1@r1369345; 2012-08-04 17:37:27+0200 Manifest Implementation-Title Commons Configuration Manifest Implementation-Vendor The Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 1.9 Manifest specification-title Commons Configuration Manifest specification-vendor The Apache Software Foundation pom artifactid commons-configuration pom description Tools to assist in the reading of configuration/preferences files in various formats pom groupid commons-configuration pom name Commons Configuration pom parent-artifactid commons-parent pom parent-groupid org.apache.commons pom url http://commons.apache.org/configuration/ pom version 1.9
Description:
Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: C:\Users\Dad\.m2\repository\commons-lang\commons-lang\2.6\commons-lang-2.6.jar
MD5: 4d5c1693079575b362edf41500630bbd
SHA1: 0ce1edb914c94ebc388f086c6827e8bdeec71ac2
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-lang central groupid commons-lang central version 2.6 file name commons-lang file version 2.6 manifest Bundle-Description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Manifest bundle-docurl http://commons.apache.org/lang/ Manifest Bundle-Name Commons Lang Manifest bundle-symbolicname org.apache.commons.lang Manifest Implementation-Title Commons Lang Manifest Implementation-Vendor The Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 2.6 Manifest specification-title Commons Lang Manifest specification-vendor The Apache Software Foundation pom artifactid commons-lang pom description Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. pom groupid commons-lang pom name Commons Lang pom parent-artifactid commons-parent pom parent-groupid org.apache.commons pom url http://commons.apache.org/lang/ pom version 2.6
Description: Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems.
License:
The Apache Software License, Version 2.0: /LICENSE.txt
File Path: C:\Users\Dad\.m2\repository\commons-logging\commons-logging-api\1.1\commons-logging-api-1.1.jar
MD5: 4374238076ab08e60e0d296234480837
SHA1: 7d4cf5231d46c8524f9b9ed75bb2d1c69ab93322
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-logging-api central groupid commons-logging central version 1.1 file name commons-logging-api file version 1.1 Manifest extension-name org.apache.commons.logging Manifest Implementation-Title Jakarta Commons Logging Manifest Implementation-Vendor Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 1.1 Manifest specification-title Jakarta Commons Logging Manifest specification-vendor Apache Software Foundation pom artifactid commons-logging-api pom description Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems. pom groupid commons-logging pom name Logging pom organization name http://jakarta.apache.org
pom url http://jakarta.apache.org/commons/logging/ pom version 1.1
Description: Commons Logging is a thin adapter allowing configurable bridging to other,
well known logging systems.
License:
The Apache Software License, Version 2.0: /LICENSE.txt
File Path: C:\Users\Dad\.m2\repository\commons-logging\commons-logging\1.1\commons-logging-1.1.jar
MD5: 6b62417e77b000a87de66ee3935edbf5
SHA1: ba24d5de831911b684c92cd289ed5ff826271824
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-logging central groupid commons-logging central version 1.1 file name commons-logging file version 1.1 Manifest extension-name org.apache.commons.logging Manifest Implementation-Title Jakarta Commons Logging Manifest Implementation-Vendor Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 1.1 Manifest specification-title Jakarta Commons Logging Manifest specification-vendor Apache Software Foundation pom artifactid commons-logging pom description Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems. pom groupid commons-logging pom name Logging pom organization name http://jakarta.apache.org
pom url http://jakarta.apache.org/commons/${pom.artifactId.substring(8)}/ pom version 1.1
Description: dnsjava is an implementation of DNS in Java
License:
BSD license: http://www.dnsjava.org/README
File Path: C:\Users\Dad\.m2\repository\dnsjava\dnsjava\2.0.6\dnsjava-2.0.6.jar
MD5: 3a783229899ea708d3a7c73624d305c4
SHA1: e367971f81d95e653552b5c8f3065d0fad724369
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid dnsjava central groupid dnsjava central groupid org.dnsjava central groupid org.dspace.dnsjava central version 2.0.6 file name dnsjava file version 2.0.6 Manifest Implementation-Title dnsjava Manifest Implementation-Version 2.0.6 pom artifactid dnsjava pom description dnsjava is an implementation of DNS in Java pom groupid dnsjava pom name dnsjava pom url http://www.dnsjava.org pom version 2.0.6
File Path: C:\Users\Dad\.m2\repository\javax\servlet\servlet-api\2.5\servlet-api-2.5.jarMD5: 116fc16f3f700d756a57a2b8ea7c1044SHA1: e69999122202bb1c275a80ad3281c4f69f2ea0b2
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:provided
Evidence
Source Name Value file name servlet-api file version 2.5 Manifest extension-name javax.servlet Manifest Implementation-Vendor Sun Microsystems, Inc. Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 2.5 Manifest specification-title JavaServlet(TM) Specification Manifest specification-vendor Sun Microsystems, Inc. pom artifactid servlet-api pom groupid javax.servlet pom version 2.5
maven: javax.servlet:servlet-api:2.5
Confidence :HIGH
Description: Apache Log4j 1.2
License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: C:\Users\Dad\.m2\repository\log4j\log4j\1.2.17\log4j-1.2.17.jar
MD5: 04a41f0a068986f0f73485cf507c0f40
SHA1: 5af35056b4d257e4b64b9e8069c0746e8b08629f
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid log4j central groupid log4j central version 1.2.17 file name log4j file version 1.2.17 manifest Bundle-Description Apache Log4j 1.2 Manifest bundle-docurl http://logging.apache.org/log4j/1.2 Manifest Bundle-Name Apache Log4j Manifest bundle-symbolicname log4j manifest: org.apache.log4j Implementation-Title log4j manifest: org.apache.log4j Implementation-Vendor "Apache Software Foundation" pom artifactid log4j pom description Apache Log4j 1.2 pom groupid log4j pom name Apache Log4j pom organization name http://www.apache.org
pom url http://logging.apache.org/log4j/1.2/ pom version 1.2.17
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: C:\Users\Dad\.m2\repository\org\apache\commons\commons-lang3\3.5\commons-lang3-3.5.jar
MD5: 780b5a8b72eebe6d0dbff1c11b5658fa
SHA1: 6c6c702c89bfff3cd9e80b04d668c5e190d588c6
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid commons-lang3 central groupid org.apache.commons central version 3.5 file name commons-lang3 file version 3.5 manifest Bundle-Description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. Manifest bundle-docurl http://commons.apache.org/proper/commons-lang/ Manifest Bundle-Name Apache Commons Lang Manifest bundle-symbolicname org.apache.commons.lang3 Manifest implementation-build release@r36f98d87b24c2f542b02abbf6ec1ee742f1b158b; 2016-10-13 19:52:17+0000 Manifest Implementation-Title Apache Commons Lang Manifest implementation-url http://commons.apache.org/proper/commons-lang/ Manifest Implementation-Vendor The Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 3.5 Manifest require-capability osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))" Manifest specification-title Apache Commons Lang Manifest specification-vendor The Apache Software Foundation pom artifactid commons-lang3 pom description Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang. pom groupid apache.commons pom groupid org.apache.commons pom name Apache Commons Lang pom parent-artifactid commons-parent pom parent-groupid org.apache.commons pom url http://commons.apache.org/proper/commons-lang/ pom version 3.5
Description:
HttpComponents Client
File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jarMD5: 88cc3123fce88d61b7c2cdbfc33542c5SHA1: 18f4247ff4572a074444572cee34647c43e7c9c7
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid httpclient central groupid org.apache.httpcomponents central version 4.3.3 file name httpclient file version 4.3.3 Manifest implementation-build tags/4.3.3-RC1/httpclient@r1570731; 2014-02-22 09:04:11-0500 Manifest Implementation-Title HttpComponents Apache HttpClient Manifest Implementation-Vendor The Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 4.3.3 Manifest specification-title HttpComponents Apache HttpClient Manifest specification-vendor The Apache Software Foundation Manifest url http://hc.apache.org/httpcomponents-client pom artifactid httpclient pom description
HttpComponents Client
pom groupid apache.httpcomponents pom groupid org.apache.httpcomponents pom name Apache HttpClient pom parent-artifactid httpcomponents-client pom parent-groupid org.apache.httpcomponents pom url http://hc.apache.org/httpcomponents-client pom version 4.3.3
Published Vulnerabilities
CVE-2015-5262 suppress
Severity:
Medium
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Vulnerable Software & Versions:
CVE-2014-3577 suppress
Severity:
Medium
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerable Software & Versions: (show all )
Description:
HttpComponents Core (blocking I/O)
File Path: C:\Users\Dad\.m2\repository\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jarMD5: ee3d34dce4a30c7d3002cadf8c9172c1SHA1: 31fbbff1ddbf98f3aa7377c94d33b0447c646b6e
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid httpcore central groupid org.apache.httpcomponents central version 4.3.2 file name httpcore file version 4.3.2 Manifest implementation-build UNKNOWN_BRANCH@r??????; 2014-02-12 21:43:05+0100 Manifest Implementation-Title HttpComponents Apache HttpCore Manifest Implementation-Vendor The Apache Software Foundation Manifest Implementation-Vendor-Id org.apache Manifest Implementation-Version 4.3.2 Manifest specification-title HttpComponents Apache HttpCore Manifest specification-vendor The Apache Software Foundation Manifest url http://hc.apache.org/httpcomponents-core-ga pom artifactid httpcore pom description
HttpComponents Core (blocking I/O)
pom groupid apache.httpcomponents pom groupid org.apache.httpcomponents pom name Apache HttpCore pom parent-artifactid httpcomponents-core pom parent-groupid org.apache.httpcomponents pom url http://hc.apache.org/httpcomponents-core-ga pom version 4.3.2
Description: jUDDI (pronounced "Judy") is an open source Java implementation of the Universal Description, Discovery, and Integration (UDDI) specification for Web Services.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: C:\Users\Dad\.m2\repository\org\apache\juddi\juddi-client\3.3.3\juddi-client-3.3.3.jar
MD5: 97c5bdf27e8b2b177d0621f8476942fd
SHA1: 02956c0e30405af75c9866ccf1dba30697d19781
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid juddi-client central groupid org.apache.juddi central version 3.3.3 file name juddi-client file version 3.3.3 manifest Bundle-Description jUDDI (pronounced "Judy") is an open source Java implementation of the Universal Description, Discovery, and Integration (UDDI) specification for Web Services. Manifest bundle-docurl http://www.apache.org/ Manifest Bundle-Name jUDDI Client side Code Manifest bundle-symbolicname org.apache.juddi.client pom artifactid juddi-client pom groupid apache.juddi pom groupid org.apache.juddi pom name jUDDI Client side Code pom parent-artifactid juddi-parent pom parent-groupid org.apache.juddi pom version 3.3.3
Description: jUDDI (pronounced "Judy") is an open source Java implementation of the Universal Description, Discovery, and Integration (UDDI) specification for Web Services.
License:
http://www.apache.org/licenses/LICENSE-2.0.txt File Path: C:\Users\Dad\.m2\repository\org\apache\juddi\uddi-ws\3.3.3\uddi-ws-3.3.3.jar
MD5: bb20c0b7902db12bc44154a7883ba79a
SHA1: ba7abcb195c7fe6048e734925fd29622b1959447
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid uddi-ws central groupid org.apache.juddi central version 3.3.3 file name uddi-ws file version 3.3.3 manifest Bundle-Description jUDDI (pronounced "Judy") is an open source Java implementation of the Universal Description, Discovery, and Integration (UDDI) specification for Web Services. Manifest bundle-docurl http://www.apache.org/ Manifest Bundle-Name UDDIv2 and v3 WS Stubs and Schema Bindings Generated from WSDL Manifest bundle-symbolicname org.apache.juddi.uddi-ws pom artifactid uddi-ws pom groupid apache.juddi pom groupid org.apache.juddi pom name UDDIv2 and v3 WS Stubs and Schema Bindings Generated from WSDL pom parent-artifactid juddi-parent pom parent-groupid org.apache.juddi pom version 3.3.3
Description: Java stub generator for WSDL
License:
CPL: http://www.opensource.org/licenses/cpl1.0.txt
File Path: C:\Users\Dad\.m2\repository\wsdl4j\wsdl4j\1.6.2\wsdl4j-1.6.2.jar
MD5: 2608a8ea3f07b0c08de8a7d3d0d3fc09
SHA1: dec1669fb6801b7328e01ad72fc9e10b69ea06c1
Referenced In Project/Scope:
fgsms Generic JAXWS Agent:compile
Evidence
Source Name Value central artifactid wsdl4j central groupid wsdl4j central version 1.6.2 file name wsdl4j file version 1.6.2 Manifest Implementation-Title WSDL4J Manifest Implementation-Vendor IBM Manifest specification-title JWSDL Manifest specification-vendor IBM (Java Community Process) pom artifactid wsdl4j pom description Java stub generator for WSDL pom groupid wsdl4j pom name WSDL4J pom url http://sf.net/projects/wsdl4j pom version 1.6.2