Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 1.4.5
Report Generated On: Mar 11, 2017 at 23:52:30 EST
Dependencies Scanned: 55 (55 unique)
Vulnerable Dependencies: 3
Vulnerabilities Found: 4
Vulnerabilities Suppressed: 0
...
CurrentEngineRelease:
NVD CVE 2002: 19/02/2017 03:25:58
NVD CVE 2003: 19/02/2017 03:24:25
NVD CVE 2004: 19/02/2017 03:23:59
NVD CVE 2005: 24/02/2017 03:12:32
NVD CVE 2006: 19/02/2017 03:20:36
NVD CVE 2007: 19/02/2017 03:18:20
NVD CVE 2008: 19/02/2017 03:16:18
NVD CVE 2009: 19/02/2017 03:14:03
NVD CVE 2010: 09/02/2017 03:09:26
NVD CVE 2011: 19/02/2017 03:11:57
NVD CVE 2012: 24/02/2017 03:11:07
NVD CVE 2013: 24/02/2017 03:09:00
NVD CVE 2014: 01/03/2017 03:07:38
NVD CVE 2015: 04/03/2017 03:06:02
NVD CVE 2016: 05/03/2017 03:02:53
NVD CVE 2017: 05/03/2017 03:00:24
NVD CVE Checked: 11/03/2017 23:34:50
NVD CVE Modified: 11/03/2017 20:00:24
VersionCheckOn: 1486838497071

Display: Showing Vulnerable Dependencies (click to show all)

Dependency	CPE	GAV	Highest Severity	CVE Count	CPE Confidence	Evidence Count
avalon-framework-4.1.3.jar		avalon-framework:avalon-framework:4.1.3		0		12
resolver-20050927.jar		com.sun.org.apache.xml.internal:resolver:20050927		0		14
jaxb-impl-2.2.4.jar		com.sun.xml.bind:jaxb-impl:2.2.4		0		20
jaxb-xjc-2.2.4.jar		com.sun.xml.bind:jaxb-xjc:2.2.4		0		18
FastInfoset-1.2.7.jar		com.sun.xml.fastinfoset:FastInfoset:1.2.7		0		15
streambuffer-1.0.jar		com.sun.xml.stream.buffer:streambuffer:1.0		0		14
txw2-20090102.jar		com.sun.xml.txw2:txw2:20090102		0		14
jaxws-rt-2.2.jar		com.sun.xml.ws:jaxws-rt:2.2		0		20
jaxws-tools-2.2.jar		com.sun.xml.ws:jaxws-tools:2.2		0		19
policy-2.0-b01.jar		com.sun.xml.ws:policy:2.0-b01		0		17
commons-beanutils-1.8.0.jar	cpe:/a:apache:commons_beanutils:1.8.0	commons-beanutils:commons-beanutils:1.8.0	High	1	LOW	23
commons-logging-1.1.jar		commons-logging:commons-logging:1.1		0		19
getopt-1.0.13.jar		gnu-getopt:getopt:1.0.13		0		10
activation-1.1.jar		javax.activation:activation:1.1		0		17
jsr181-api-1.0-MR1.jar		javax.jws:jsr181-api:1.0-MR1		0		10
mail-1.4.7.jar	cpe:/a:sun:javamail:1.4.7	javax.mail:mail:1.4.7		0	LOW	26
servlet-api-2.5.jar		javax.servlet:servlet-api:2.5		0		11
jaxb-api-2.2.3.jar		javax.xml.bind:jaxb-api:2.2.3		0		17
stax-api-1.0-2.jar		javax.xml.stream:stax-api:1.0-2		0		11
jboss-jaxb-intros-1.0.2.GA.jar		jboss.jaxbintros:jboss-jaxb-intros:1.0.2.GA		0		12
log4j-1.2.17.jar		log4j:log4j:1.2.17		0		18
logkit-1.0.1.jar		logkit:logkit:1.0.1		0		11
commons-lang3-3.5.jar		org.apache.commons:commons-lang3:3.5		0		27
xmlsec-1.5.1.jar	cpe:/a:apache:xml_security_for_java:1.5.1	org.apache.santuario:xmlsec:1.5.1	Medium	2	HIGHEST	23
jettison-1.3.4.jar		org.codehaus.jettison:jettison:1.3.4		0		18
wstx-asl-3.2.3.jar		org.codehaus.woodstox:wstx-asl:3.2.3		0		19
wstx-lgpl-3.2.6.jar		org.codehaus.woodstox:wstx-lgpl:3.2.6		0		19
javassist-3.15.0-GA.jar		org.javassist:javassist:3.15.0-GA		0		14
jboss-logging-3.1.0.GA.jar		org.jboss.logging:jboss-logging:3.1.0.GA		0		25
netty-3.2.6.Final.jar	cpe:/a:netty_project:netty:3.2.6	org.jboss.netty:netty:3.2.6.Final	Medium	1	LOW	18
jboss-servlet-api_3.0_spec-1.0.0.Final.jar		org.jboss.spec.javax.servlet:jboss-servlet-api_3.0_spec:1.0.0.Final		0		19
jboss-jaxb-api_2.2_spec-1.0.3.Final.jar		org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.2_spec:1.0.3.Final		0		19
jboss-jaxrpc-api_1.1_spec-1.0.0.Final.jar		org.jboss.spec.javax.xml.rpc:jboss-jaxrpc-api_1.1_spec:1.0.0.Final		0		19
jboss-saaj-api_1.3_spec-1.0.1.Final.jar		org.jboss.spec.javax.xml.soap:jboss-saaj-api_1.3_spec:1.0.1.Final		0		19
jboss-jaxws-api_2.2_spec-2.0.2.Final.jar		org.jboss.spec.javax.xml.ws:jboss-jaxws-api_2.2_spec:2.0.2.Final		0		27
jbossws-api-1.0.0.GA.jar		org.jboss.ws:jbossws-api:1.0.0.GA		0		14
jbossws-common-tools-1.0.0.GA.jar		org.jboss.ws:jbossws-common-tools:1.0.0.GA		0		14
jbossws-common-3.1.3.Final.jar		org.jboss.ws:jbossws-common:3.1.3.Final		0		17
jbossws-spi-3.1.2.Final.jar		org.jboss.ws:jbossws-spi:3.1.2.Final		0		17
jbossws-native-client-4.0.2.GA.jar		org.jboss.ws.native:jbossws-native-client:4.0.2.GA		0		13
jbossws-native-core-4.0.2.GA.jar	cpe:/a:redhat:jboss_web_server:4.0.2	org.jboss.ws.native:jbossws-native-core:4.0.2.GA		0	LOW	13
jbossws-native-factories-4.0.2.GA.jar		org.jboss.ws.native:jbossws-native-factories:4.0.2.GA		0		13
jbossws-native-services-4.0.2.GA.jar		org.jboss.ws.native:jbossws-native-services:4.0.2.GA		0		13
stax-ex-1.2.jar		org.jvnet.staxex:stax-ex:1.2		0		14
stax-api-1.0.1.jar		stax:stax-api:1.0.1		0		16
wstx-asl-3.2.1.jar		org.codehaus.woodstox:wstx-asl:3.2.1		0		14
policy-1.0.jar		ws-commons:policy:1.0		0		14
wsdl4j-1.6.2.jar		wsdl4j:wsdl4j:1.6.2		0		15
jaxb-impl-2.2.4.jar\META-INF/maven/com.sun.istack/istack-commons-runtime/pom.xml		com.sun.istack:istack-commons-runtime:2.4-SNAPSHOT		0		6
jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.codemodel/codemodel/pom.xml		com.sun.codemodel:codemodel:2.5-SNAPSHOT		0		7
jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.istack/istack-commons-tools/pom.xml		com.sun.istack:istack-commons-tools:2.4-SNAPSHOT		0		6
jaxb-impl-2.2.4.jar\META-INF/maven/com.sun.xml.txw2/txw2/pom.xml		com.sun.xml.txw2:txw2:201103-SNAPSHOT		0		6
jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.xml.dtd-parser/dtd-parser/pom.xml		com.sun.xml.dtd-parser:dtd-parser:1.2-SNAPSHOT		0		7
jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.xsom/xsom/pom.xml		com.sun.xsom:xsom:20110101-SNAPSHOT		0		7
jaxb-xjc-2.2.4.jar\META-INF/maven/org.kohsuke.rngom/rngom/pom.xml		org.kohsuke.rngom:rngom:201103-SNAPSHOT		0		6

Dependencies

avalon-framework-4.1.3.jar

File Path: C:\Users\Dad\.m2\repository\avalon-framework\avalon-framework\4.1.3\avalon-framework-4.1.3.jar
MD5: bef9f9be8ba066273fdef72b3503a307
SHA1: 92315ee1c4a4c90bee05055713811f28f8509075
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	avalon-framework
central	groupid	avalon-framework
central	version	4.1.3
file	name	avalon-framework
file	version	4.1.3
Manifest	extension-name	avalon-framework
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Version	4.1.3
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	avalon-framework
pom	groupid	avalon-framework
pom	version	4.1.3

Identifiers

maven: avalon-framework:avalon-framework:4.1.3 Confidence:HIGHEST

resolver-20050927.jar

File Path: C:\Users\Dad\.m2\repository\com\sun\org\apache\xml\internal\resolver\20050927\resolver-20050927.jar
MD5: 96d75a90d89ff0cb6b96282171a212de
SHA1: ee4db4a5f15cbdb453808c2839f08240ac231e46
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	resolver
central	groupid	com.sun.org.apache.xml.internal
central	version	20050927
file	name	resolver-20050927
file	version	20050927
jar	package name	apache
jar	package name	org
jar	package name	sun
jar	package name	xml
jar (hint)	package name	oracle
pom	artifactid	resolver
pom	groupid	com.sun.org.apache.xml.internal
pom	groupid	sun.org.apache.xml.internal
pom	version	20050927

Identifiers

maven: com.sun.org.apache.xml.internal:resolver:20050927 Confidence:HIGHEST

jaxb-impl-2.2.4.jar

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-impl\2.2.4\jaxb-impl-2.2.4.jar
MD5: a530a338b0551b01e7ca1728b38b948d
SHA1: 14d785b91bafbd91c312efd73c5c4528a8adbdfb
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jaxb-impl
central	groupid	com.sun.xml.bind
central	version	2.2.4
file	name	jaxb-impl
file	version	2.2.4
jar	package name	bind
jar	package name	sun
jar	package name	v2
jar	package name	xml
jar (hint)	package name	oracle
Manifest	extension-name	com.sun.xml.bind
Manifest	Implementation-Title	JAXB Reference Implementation
Manifest	Implementation-Vendor	Oracle Corporation
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	2.2.4
Manifest	specification-title	Java Architecture for XML Binding
Manifest	specification-vendor	Oracle Corporation
pom	artifactid	jaxb-impl
pom	groupid	com.sun.xml.bind
pom	version	2.2.4

Identifiers

maven: com.sun.xml.bind:jaxb-impl:2.2.4 Confidence:HIGHEST

jaxb-xjc-2.2.4.jar

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.2.4\jaxb-xjc-2.2.4.jar
MD5: d2b6fdb0003c2835d4a846da38ba7260
SHA1: be3ae2d6016b3e0902756bbdd800f44d40c7f9cd
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jaxb-xjc
central	groupid	com.sun.xml.bind
central	version	2.2.4
file	name	jaxb-xjc
file	version	2.2.4
jar	package name	sun
jar	package name	tools
jar (hint)	package name	oracle
Manifest	extension-name	com.sun.tools.xjc
Manifest	Implementation-Title	JAXB Reference Implementation
Manifest	Implementation-Vendor	Oracle Corporation
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	2.2.4
Manifest	specification-title	Java Architecture for XML Binding
Manifest	specification-vendor	Oracle Corporation
pom	artifactid	jaxb-xjc
pom	groupid	com.sun.xml.bind
pom	version	2.2.4

Identifiers

maven: com.sun.xml.bind:jaxb-xjc:2.2.4 Confidence:HIGHEST

FastInfoset-1.2.7.jar

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\fastinfoset\FastInfoset\1.2.7\FastInfoset-1.2.7.jar
MD5: 92f780ed9e034f24bdd73d4a8fecb00e
SHA1: ad5d03a88f48c00f9c50ad46874847cd833e223e
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	FastInfoset
central	groupid	com.sun.xml.fastinfoset
central	version	1.2.7
file	name	FastInfoset
file	version	1.2.7
Manifest	extension-name	com.sun.xml.fastinfoset
Manifest	Implementation-Title	Fast Infoset Implementation
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.2.7
Manifest	specification-title	ITU-T Rec. X.891 \| ISO/IEC 24824-1 (Fast Infoset)
pom	artifactid	FastInfoset
pom	groupid	com.sun.xml.fastinfoset
pom	groupid	sun.xml.fastinfoset
pom	version	1.2.7

Identifiers

maven: com.sun.xml.fastinfoset:FastInfoset:1.2.7 Confidence:HIGHEST

streambuffer-1.0.jar

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\stream\buffer\streambuffer\1.0\streambuffer-1.0.jar
MD5: f59e61ba55a75d3b4924097f36d2f4e9
SHA1: c5f2e0bca928f350356f379de68b9db9a12a230a
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	streambuffer
central	groupid	com.sun.xml.stream.buffer
central	version	1.0
file	name	streambuffer
file	version	1.0
Manifest	extension-name	com.sun.xml.stream.buffer
Manifest	Implementation-Title	XML Stream Buffer Implementation
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.0
pom	artifactid	streambuffer
pom	groupid	com.sun.xml.stream.buffer
pom	groupid	sun.xml.stream.buffer
pom	version	1.0

Identifiers

maven: com.sun.xml.stream.buffer:streambuffer:1.0 Confidence:HIGHEST

txw2-20090102.jar

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\txw2\txw2\20090102\txw2-20090102.jar
MD5: 6badd3a7414afc68a2bd465f94f83d44
SHA1: f27de1e6739865ec6525126655e1ed11d75f41f9
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	txw2
central	groupid	com.sun.xml.txw2
central	version	20090102
file	name	txw2-20090102
file	version	2.20090102
Manifest	build-id	01/03/2009 05:5
Manifest	date	2009
Manifest	date	3
Manifest	date	January 3 2009
pom	artifactid	txw2
pom	groupid	com.sun.xml.txw2
pom	groupid	sun.xml.txw2
pom	name	Typed XML Writer runtime
pom	version	20090102

Identifiers

maven: com.sun.xml.txw2:txw2:20090102 Confidence:HIGHEST

jaxws-rt-2.2.jar

Description: Open source Reference Implementation of JSR-224: Java API for XML Web Services

License:

            Dual license consisting of the CDDL v1.0 and GPL v2
        : https://glassfish.dev.java.net/public/CDDL+GPL.html

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\ws\jaxws-rt\2.2\jaxws-rt-2.2.jar
MD5: 7c3b6a819621109f5efa02f6b5b56804
SHA1: a8818fa4e13d8bc2758643bda1860494026a1770
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jaxws-rt
central	groupid	com.sun.xml.ws
central	version	2.2
file	name	jaxws-rt
file	version	2.2
Manifest	extension-name	com.sun.xml.ws
Manifest	Implementation-Title	JAX-WS Implementation
Manifest	Implementation-Vendor	Sun Microsystems Inc
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	2.2
Manifest	probe-provider-class-names	com.sun.xml.ws.transport.http.servlet.JAXWSRIDeploymentProbeProvider
Manifest	specification-title	The Java API for XML Web Services
pom	artifactid	jaxws-rt
pom	description	Open source Reference Implementation of JSR-224: Java API for XML Web Services
pom	groupid	com.sun.xml.ws
pom	groupid	sun.xml.ws
pom	name	JAX-WS (JSR-224) Reference Implementation
pom	organization name	http://www.sun.com/
pom	url	https://jax-ws.dev.java.net//
pom	version	2.2

Identifiers

maven: com.sun.xml.ws:jaxws-rt:2.2 Confidence:HIGHEST

jaxws-tools-2.2.jar

Description: Open source Reference Implementation of JSR-224: Java API for XML Web Services

License:

            Dual license consisting of the CDDL v1.0 and GPL v2
        : https://glassfish.dev.java.net/public/CDDL+GPL.html

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\ws\jaxws-tools\2.2\jaxws-tools-2.2.jar
MD5: a0729cfe7d4444606b10a30555d592a2
SHA1: 26df78a9218c4fb2f75fb676ccbac9def7e9ee64
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jaxws-tools
central	groupid	com.sun.xml.ws
central	version	2.2
file	name	jaxws-tools
file	version	2.2
Manifest	extension-name	com.sun.tools.ws
Manifest	Implementation-Title	JAX-WS Implementation
Manifest	Implementation-Vendor	Sun Microsystems Inc
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	2.2
Manifest	specification-title	The Java API for XML Web Services
pom	artifactid	jaxws-tools
pom	description	Open source Reference Implementation of JSR-224: Java API for XML Web Services
pom	groupid	com.sun.xml.ws
pom	groupid	sun.xml.ws
pom	name	JAX-WS (JSR-224) Reference Implementation Tools
pom	organization name	http://www.sun.com/
pom	url	https://jax-ws.dev.java.net//
pom	version	2.2

Identifiers

maven: com.sun.xml.ws:jaxws-tools:2.2 Confidence:HIGHEST

policy-2.0-b01.jar

License:

Dual License: CDDL 1.0 and GPL V2 with Classpath Exception: https://glassfish.dev.java.net/public/CDDL+GPL.html

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\ws\policy\2.0-b01\policy-2.0-b01.jar
MD5: 56595a9fad624d0d06b9b6d5e399d4b7
SHA1: 00dc30f945e61723fceb481659a440d9810d22f8
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	policy
central	groupid	com.sun.xml.ws
central	version	2.0-b01
file	name	policy
file	version	2.0.b01
Manifest	build-tag	hudson-policy-core_METRO-2_0-BRANCH-1
Manifest	Implementation-Title	policy
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun.xml.ws
Manifest	Implementation-Version	2.0-b01
pom	artifactid	policy
pom	groupid	com.sun.xml.ws
pom	groupid	sun.xml.ws
pom	name	policy
pom	organization name	http://www.sun.com/
pom	url	https://policy.dev.java.net/
pom	version	2.0-b01

Identifiers

maven: com.sun.xml.ws:policy:2.0-b01 Confidence:HIGHEST

commons-beanutils-1.8.0.jar

Description: BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\commons-beanutils\commons-beanutils\1.8.0\commons-beanutils-1.8.0.jar
MD5: d93127c2aa1815a25b13d971e974e9b1
SHA1: 0c651d5103c649c12b20d53731643e5fffceb536
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	commons-beanutils
central	groupid	commons-beanutils
central	version	1.8.0
file	name	commons-beanutils
file	version	1.8.0
manifest	Bundle-Description	BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
Manifest	bundle-docurl	http://commons.apache.org/beanutils/
Manifest	Bundle-Name	Commons BeanUtils
Manifest	bundle-symbolicname	org.apache.commons.beanutils
Manifest	Implementation-Title	Commons BeanUtils
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	1.8.0
Manifest	specification-title	Commons BeanUtils
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	commons-beanutils
pom	description	BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.
pom	groupid	commons-beanutils
pom	name	Commons BeanUtils
pom	parent-artifactid	commons-parent
pom	parent-groupid	org.apache.commons
pom	url	http://commons.apache.org/beanutils/
pom	version	1.8.0

Identifiers

maven: commons-beanutils:commons-beanutils:1.8.0 Confidence:HIGHEST
cpe: cpe:/a:apache:commons_beanutils:1.8.0 Confidence:LOW

Published Vulnerabilities

CVE-2014-0114

Severity: High
CVSS Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-20 Improper Input Validation

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

BID - 67121
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://advisories.mageia.org/MGASA-2014-0219.html
CONFIRM - http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21674128
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21674812
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675266
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675387
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675689
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675898
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21675972
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676091
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676110
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676303
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676375
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21676931
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21677110
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg27042296
CONFIRM - http://www.ibm.com/support/docview.wss?uid=swg21675496
CONFIRM - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0008.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
CONFIRM - https://access.redhat.com/solutions/869353
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1091938
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1116665
CONFIRM - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
CONFIRM - https://issues.apache.org/jira/browse/BEANUTILS-463
DEBIAN - DSA-2940
FEDORA - FEDORA-2014-9380
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
GENTOO - GLSA-201607-09
HP - HPSBGN03041
HP - HPSBMU03090
HP - HPSBST03160
MANDRIVA - MDVSA-2014:095
MLIST - [oss-security] 20140616 CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE
MLIST - [oss-security] 20140707 Re: CVE request for commons-beanutils: 'class' property is exposed, potentially leading to RCE
SECUNIA - 57477
SECUNIA - 58710
SECUNIA - 58947
SECUNIA - 59118
SECUNIA - 59228
SECUNIA - 59245
SECUNIA - 59246
SECUNIA - 59430
SECUNIA - 59464
SECUNIA - 59479
SECUNIA - 59480
SECUNIA - 59718

Vulnerable Software & Versions: (show all)

cpe:/a:apache:commons_beanutils:1.9.1 and all previous versions
...
cpe:/a:apache:commons_beanutils:1.9.1 and all previous versions
cpe:/a:apache:struts:1.0
cpe:/a:apache:struts:1.0.2
cpe:/a:apache:struts:1.1
cpe:/a:apache:struts:1.1:b1
cpe:/a:apache:struts:1.1:b2
cpe:/a:apache:struts:1.1:b3
cpe:/a:apache:struts:1.1:rc1
cpe:/a:apache:struts:1.1:rc2
cpe:/a:apache:struts:1.2.2
cpe:/a:apache:struts:1.2.4
cpe:/a:apache:struts:1.2.6
cpe:/a:apache:struts:1.2.7
cpe:/a:apache:struts:1.2.8
cpe:/a:apache:struts:1.2.9
cpe:/a:apache:struts:1.3.5
cpe:/a:apache:struts:1.3.8
cpe:/a:apache:struts:1.3.10

commons-logging-1.1.jar

Description: Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.

License:

The Apache Software License, Version 2.0: /LICENSE.txt

File Path: C:\Users\Dad\.m2\repository\commons-logging\commons-logging\1.1\commons-logging-1.1.jar
MD5: 6b62417e77b000a87de66ee3935edbf5
SHA1: ba24d5de831911b684c92cd289ed5ff826271824
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	commons-logging
central	groupid	commons-logging
central	version	1.1
file	name	commons-logging
file	version	1.1
Manifest	extension-name	org.apache.commons.logging
Manifest	Implementation-Title	Jakarta Commons Logging
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	1.1
Manifest	specification-title	Jakarta Commons Logging
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	commons-logging
pom	description	Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.
pom	groupid	commons-logging
pom	name	Logging
pom	organization name	http://jakarta.apache.org
pom	url	http://jakarta.apache.org/commons/${pom.artifactId.substring(8)}/
pom	version	1.1

Identifiers

maven: commons-logging:commons-logging:1.1 Confidence:HIGHEST

getopt-1.0.13.jar

Description: JON enterprise server main JAR

License:

GNU Lesser General Public License (LGPL): http://www.gnu.org/licenses/lgpl.html

File Path: C:\Users\Dad\.m2\repository\gnu-getopt\getopt\1.0.13\getopt-1.0.13.jar
MD5: f8532fcaaf3245e90331edfc48a13aca
SHA1: 5ec838b4363d7d17c8bd133353affc87fdfde184
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	getopt
file	version	1.0.13
jar	package name	getopt
jar	package name	gnu
pom	artifactid	getopt
pom	description	JON enterprise server main JAR
pom	groupid	gnu-getopt
pom	name	ON Enterprise Server JAR
pom	url	http://www.urbanophile.com/arenn/hacking/download.html
pom	version	1.0.13

Identifiers

maven: gnu-getopt:getopt:1.0.13 Confidence:HIGH

activation-1.1.jar

Description: JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).

License:

Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html

File Path: C:\Users\Dad\.m2\repository\javax\activation\activation\1.1\activation-1.1.jar
MD5: 8ae38e87cd4f86059c0294a8fe3e0b18
SHA1: e6cb541461c2834bdea3eb920f1884d1eb508b50
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	activation
central	groupid	javax.activation
central	version	1.1
file	name	activation
file	version	1.1
Manifest	extension-name	javax.activation
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.1
Manifest	specification-title	JavaBeans(TM) Activation Framework Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	activation
pom	description	JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).
pom	groupid	javax.activation
pom	name	JavaBeans Activation Framework (JAF)
pom	url	http://java.sun.com/products/javabeans/jaf/index.jsp
pom	version	1.1

Identifiers

maven: javax.activation:activation:1.1 Confidence:HIGHEST

jsr181-api-1.0-MR1.jar

File Path: C:\Users\Dad\.m2\repository\javax\jws\jsr181-api\1.0-MR1\jsr181-api-1.0-MR1.jar
MD5: c302b9eeac623e7ba29a4e7f5d4dd258
SHA1: 401cc1d0e5f0d8f4d0532a54928ceaa27ec21258
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jsr181-api
central	groupid	javax.jws
central	version	1.0-MR1
file	name	jsr181-api
file	version	1.0.mr1
jar	package name	javax
jar	package name	jws
pom	artifactid	jsr181-api
pom	groupid	javax.jws
pom	version	1.0-MR1

Identifiers

maven: javax.jws:jsr181-api:1.0-MR1 Confidence:HIGHEST

mail-1.4.7.jar

Description: JavaMail API (compat)

License:

http://www.sun.com/cddl, https://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\Dad\.m2\repository\javax\mail\mail\1.4.7\mail-1.4.7.jar
MD5: 77f53ff0c78ba43c4812ecc9f53e20f8
SHA1: 9add058589d5d85adeb625859bf2c5eeaaedf12d
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	mail
central	groupid	javax.mail
central	version	1.4.7
file	name	mail
file	version	1.4.7
manifest	Bundle-Description	JavaMail API (compat)
Manifest	bundle-docurl	http://www.oracle.com
Manifest	Bundle-Name	JavaMail API (compat)
Manifest	bundle-symbolicname	javax.mail
Manifest	extension-name	javax.mail
Manifest	Implementation-Title	javax.mail
Manifest	Implementation-Vendor	Oracle
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.4.7
Manifest	originally-created-by	1.7.0_15 (Oracle Corporation)
Manifest	probe-provider-xml-file-names	META-INF/gfprobe-provider.xml
Manifest	specification-title	JavaMail(TM) API Design Specification
Manifest	specification-vendor	Oracle
Manifest (hint)	Implementation-Vendor	sun
Manifest (hint)	specification-vendor	sun
pom	artifactid	mail
pom	groupid	javax.mail
pom	name	JavaMail API (compat)
pom	parent-artifactid	all
pom	parent-groupid	com.sun.mail
pom	version	1.4.7

Identifiers

cpe: cpe:/a:sun:javamail:1.4.7 Confidence:LOW
maven: javax.mail:mail:1.4.7 Confidence:HIGHEST

servlet-api-2.5.jar

File Path: C:\Users\Dad\.m2\repository\javax\servlet\servlet-api\2.5\servlet-api-2.5.jar
MD5: 116fc16f3f700d756a57a2b8ea7c1044
SHA1: e69999122202bb1c275a80ad3281c4f69f2ea0b2
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	servlet-api
file	version	2.5
Manifest	extension-name	javax.servlet
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	2.5
Manifest	specification-title	JavaServlet(TM) Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	servlet-api
pom	groupid	javax.servlet
pom	version	2.5

Identifiers

maven: javax.servlet:servlet-api:2.5 Confidence:HIGH

jaxb-api-2.2.3.jar

Description: JAXB (JSR 222) API

License:

CDDL 1.1: https://glassfish.java.net/public/CDDL+GPL_1_1.html
GPL2 w/ CPE: https://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\Dad\.m2\repository\javax\xml\bind\jaxb-api\2.2.3\jaxb-api-2.2.3.jar
MD5: 6a889a54e7729d7e7cf0f3487260d1b4
SHA1: 184d5f1060c41a8fa28e55b8b7d2c96bec99b079
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jaxb-api
central	groupid	javax.xml.bind
central	version	2.2.3
file	name	jaxb-api
file	version	2.2.3
Manifest	extension-name	javax.xml.bind
Manifest	specification-title	Java Architecture for XML Binding
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	jaxb-api
pom	description	JAXB (JSR 222) API
pom	groupid	javax.xml.bind
pom	name	Java Architecture for XML Binding
pom	organization name	http://www.oracle.com/
pom	parent-artifactid	jvnet-parent
pom	parent-groupid	net.java
pom	url	http://jaxb.java.net/
pom	version	2.2.3

Identifiers

maven: javax.xml.bind:jaxb-api:2.2.3 Confidence:HIGHEST

stax-api-1.0-2.jar

File Path: C:\Users\Dad\.m2\repository\javax\xml\stream\stax-api\1.0-2\stax-api-1.0-2.jar
MD5: 7d18b63063580284c3f5734081fdc99f
SHA1: d6337b0de8b25e53e81b922352fbea9f9f57ba0b
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	stax-api
central	groupid	javax.xml.stream
central	version	1.0-2
file	name	stax-api
file	version	1.0.2
jar	package name	javax
jar	package name	stream
jar	package name	xml
pom	artifactid	stax-api
pom	groupid	javax.xml.stream
pom	version	1.0-2

Identifiers

maven: javax.xml.stream:stax-api:1.0-2 Confidence:HIGHEST

jboss-jaxb-intros-1.0.2.GA.jar

License:

lgpl: http://repository.jboss.com/licenses/lgpl.txt

File Path: C:\Users\Dad\.m2\repository\jboss\jaxbintros\jboss-jaxb-intros\1.0.2.GA\jboss-jaxb-intros-1.0.2.GA.jar
MD5: a9c7976831c538b95bb0a9f6132eb425
SHA1: 01c2cfbb1314ccfd041080c3f522f23ba194193c
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-jaxb-intros
central	groupid	jboss.jaxbintros
central	version	1.0.2.GA
file	name	jboss-jaxb-intros
file	version	1.0.2
Manifest	Implementation-Title	JBoss JAXB Introductions
Manifest	Implementation-Vendor-Id	jboss.jaxbintros
Manifest	Implementation-Version	1.0.2.GA
pom	artifactid	jboss-jaxb-intros
pom	groupid	jboss.jaxbintros
pom	name	JBoss JAXB Introductions
pom	version	1.0.2.GA

Identifiers

maven: jboss.jaxbintros:jboss-jaxb-intros:1.0.2.GA Confidence:HIGHEST

log4j-1.2.17.jar

Description: Apache Log4j 1.2

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\log4j\log4j\1.2.17\log4j-1.2.17.jar
MD5: 04a41f0a068986f0f73485cf507c0f40
SHA1: 5af35056b4d257e4b64b9e8069c0746e8b08629f
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:compile

Evidence

Source	Name	Value
central	artifactid	log4j
central	groupid	log4j
central	version	1.2.17
file	name	log4j
file	version	1.2.17
manifest	Bundle-Description	Apache Log4j 1.2
Manifest	bundle-docurl	http://logging.apache.org/log4j/1.2
Manifest	Bundle-Name	Apache Log4j
Manifest	bundle-symbolicname	log4j
manifest: org.apache.log4j	Implementation-Title	log4j
manifest: org.apache.log4j	Implementation-Vendor	"Apache Software Foundation"
pom	artifactid	log4j
pom	description	Apache Log4j 1.2
pom	groupid	log4j
pom	name	Apache Log4j
pom	organization name	http://www.apache.org
pom	url	http://logging.apache.org/log4j/1.2/
pom	version	1.2.17

Identifiers

maven: log4j:log4j:1.2.17 Confidence:HIGHEST

logkit-1.0.1.jar

File Path: C:\Users\Dad\.m2\repository\logkit\logkit\1.0.1\logkit-1.0.1.jar
MD5: 32240100a5c15d53f00392fae4b0aab7
SHA1: aaf5649b523c5ffc925e746074979150bb74bfdc
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	logkit
central	groupid	logkit
central	version	1.0.1
file	name	logkit
file	version	1.0.1
jar	package name	apache
jar	package name	log
jar	package name	output
pom	artifactid	logkit
pom	groupid	logkit
pom	version	1.0.1

Identifiers

maven: logkit:logkit:1.0.1 Confidence:HIGHEST

commons-lang3-3.5.jar

Description: Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\org\apache\commons\commons-lang3\3.5\commons-lang3-3.5.jar
MD5: 780b5a8b72eebe6d0dbff1c11b5658fa
SHA1: 6c6c702c89bfff3cd9e80b04d668c5e190d588c6
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:compile

Evidence

Source	Name	Value
central	artifactid	commons-lang3
central	groupid	org.apache.commons
central	version	3.5
file	name	commons-lang3
file	version	3.5
manifest	Bundle-Description	Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Manifest	bundle-docurl	http://commons.apache.org/proper/commons-lang/
Manifest	Bundle-Name	Apache Commons Lang
Manifest	bundle-symbolicname	org.apache.commons.lang3
Manifest	implementation-build	release@r36f98d87b24c2f542b02abbf6ec1ee742f1b158b; 2016-10-13 19:52:17+0000
Manifest	Implementation-Title	Apache Commons Lang
Manifest	implementation-url	http://commons.apache.org/proper/commons-lang/
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	3.5
Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
Manifest	specification-title	Apache Commons Lang
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	commons-lang3
pom	description	Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
pom	groupid	apache.commons
pom	groupid	org.apache.commons
pom	name	Apache Commons Lang
pom	parent-artifactid	commons-parent
pom	parent-groupid	org.apache.commons
pom	url	http://commons.apache.org/proper/commons-lang/
pom	version	3.5

Identifiers

maven: org.apache.commons:commons-lang3:3.5 Confidence:HIGHEST

xmlsec-1.5.1.jar

Description: Apache XML Security for Java supports XML-Signature Syntax and Processing, W3C Recommendation 12 February 2002, and XML Encryption Syntax and Processing, W3C Recommendation 10 December 2002. As of version 1.4, the library supports the standard Java API JSR-105: XML Digital Signature APIs.

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\org\apache\santuario\xmlsec\1.5.1\xmlsec-1.5.1.jar
MD5: ecf0046cfea8b48a12a6063396b2ca67
SHA1: bbf5d96a49a2b58b8988202a3c8728461639090e
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	xmlsec
central	groupid	org.apache.santuario
central	version	1.5.1
file	name	xmlsec
file	version	1.5.1
manifest	Bundle-Description	Apache XML Security for Java supports XML-Signature Syntax and Processing, W3C Recommendation 12 February 2002, and XML Encryption Syntax and Processing, W3C Recommendation 10 December 2002. As of version 1.4, the library supports the standard Java API JSR-105: XML Digital Signature APIs.
Manifest	bundle-docurl	http://www.apache.org/
Manifest	Bundle-Name	Apache XML Security for Java
Manifest	bundle-symbolicname	org.apache.santuario.xmlsec
Manifest	Implementation-Title	Apache XML Security
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	1.5.1
Manifest	specification-title	Apache XML Security
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	xmlsec
pom	description	Apache XML Security for Java supports XML-Signature Syntax and Processing, W3C Recommendation 12 February 2002, and XML Encryption Syntax and Processing, W3C Recommendation 10 December 2002. As of version 1.4, the library supports the standard Java API JSR-105: XML Digital Signature APIs.
pom	groupid	apache.santuario
pom	groupid	org.apache.santuario
pom	name	Apache XML Security for Java
pom	organization name	http://www.apache.org/
pom	url	http://santuario.apache.org/
pom	version	1.5.1

Identifiers

cpe: cpe:/a:apache:xml_security_for_java:1.5.1 Confidence:HIGHEST
maven: org.apache.santuario:xmlsec:1.5.1 Confidence:HIGHEST

Published Vulnerabilities

CVE-2013-4517

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-399 Resource Management Errors

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

BID - 64437
CONFIRM - http://packetstormsecurity.com/files/124554/Java-XML-Signature-Denial-Of-Service-Attack.html
CONFIRM - http://santuario.apache.org/secadv.data/cve-2013-4517.txt.asc
FULLDISC - 20131218 Apache Santuario security advisory CVE-2013-4517 released
REDHAT - RHSA-2014:0170
REDHAT - RHSA-2014:0171
REDHAT - RHSA-2014:0172
REDHAT - RHSA-2014:0195
REDHAT - RHSA-2014:1725
REDHAT - RHSA-2014:1726
REDHAT - RHSA-2014:1727
REDHAT - RHSA-2014:1728
REDHAT - RHSA-2015:0675
REDHAT - RHSA-2015:0850
REDHAT - RHSA-2015:0851
SECTRACK - 1029524
XF - santuario-xmlsecurity-cve20134517-dos(89891)

Vulnerable Software & Versions: (show all)

CVE-2013-2172

Severity: Medium
CVSS Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-310 Cryptographic Issues

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

BID - 60846
BUGTRAQ - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
CONFIRM - http://santuario.apache.org/secadv.data/CVE-2013-2172.txt.asc
CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
CONFIRM - http://www.vmware.com/security/advisories/VMSA-2014-0012.html
DEBIAN - DSA-3065
FULLDISC - 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
MISC - http://svn.apache.org/viewvc/santuario/xml-security-java/branches/1.5.x-fixes/src/main/java/org/apache/jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java?r1=1353876&r2=1493772&pathrev=1493772&diff_format=h
REDHAT - RHSA-2013:1207
REDHAT - RHSA-2013:1208
REDHAT - RHSA-2013:1209
REDHAT - RHSA-2013:1217
REDHAT - RHSA-2013:1218
REDHAT - RHSA-2013:1219
REDHAT - RHSA-2013:1220
REDHAT - RHSA-2013:1375
REDHAT - RHSA-2013:1437
REDHAT - RHSA-2013:1853
REDHAT - RHSA-2014:0212

Vulnerable Software & Versions: (show all)

jettison-1.3.4.jar

Description: A StAX implementation for JSON.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

File Path: C:\Users\Dad\.m2\repository\org\codehaus\jettison\jettison\1.3.4\jettison-1.3.4.jar
MD5: 511ae111646da8c9044710dca1cb58fc
SHA1: 3c08d8f699432e23023080cdc8b4073132473dc8
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jettison
central	groupid	org.codehaus.jettison
central	version	1.3.4
file	name	jettison
file	version	1.3.4
manifest	Bundle-Description	A StAX implementation for JSON.
Manifest	Bundle-Name	jettison
Manifest	bundle-symbolicname	org.codehaus.jettison.jettison
Manifest	Implementation-Title	Jettison
Manifest	Implementation-Version	1.3.4
pom	artifactid	jettison
pom	description	A StAX implementation for JSON.
pom	groupid	codehaus.jettison
pom	groupid	org.codehaus.jettison
pom	name	Jettison
pom	parent-artifactid	codehaus-parent
pom	parent-groupid	org.codehaus
pom	version	1.3.4

Identifiers

maven: org.codehaus.jettison:jettison:1.3.4 Confidence:HIGHEST

wstx-asl-3.2.3.jar

Description: Woodstox is a high-performance XML processor that implements Stax (JSR-173) API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\org\codehaus\woodstox\wstx-asl\3.2.3\wstx-asl-3.2.3.jar
MD5: f38076f35178eeff694ad1d9f3da8149
SHA1: cd702d934c0dc3c83c4842cc0711f402eba5c0ee
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	wstx-asl
central	groupid	org.codehaus.woodstox
central	groupid	woodstox
central	version	3.2.3
file	name	wstx-asl
file	version	3.2.3
Manifest	Implementation-Title	WoodSToX XML-processor
Manifest	Implementation-Vendor	woodstox.codehaus.org
Manifest	Implementation-Version	3.2.3
Manifest	specification-title	StAX 1.0 API
Manifest	specification-vendor	http://jcp.org/en/jsr/detail?id=173
pom	artifactid	wstx-asl
pom	description	Woodstox is a high-performance XML processor that implements Stax (JSR-173) API
pom	groupid	codehaus.woodstox
pom	groupid	org.codehaus.woodstox
pom	name	Woodstox
pom	organization name	http://www.codehaus.org/
pom	url	http://woodstox.codehaus.org
pom	version	3.2.3

Identifiers

maven: org.codehaus.woodstox:wstx-asl:3.2.3 Confidence:HIGHEST
maven: woodstox:wstx-asl:3.2.3 Confidence:HIGHEST

wstx-lgpl-3.2.6.jar

Description: Woodstox is a high-performance XML processor that implements Stax (JSR-173) API

License:

GNU Lesser General Public License (LGPL), Version 2.1: http://www.fsf.org/licensing/licenses/lgpl.txt

File Path: C:\Users\Dad\.m2\repository\org\codehaus\woodstox\wstx-lgpl\3.2.6\wstx-lgpl-3.2.6.jar
MD5: 299c95cc0e877d3744e8d797c75984e8
SHA1: 39e31be0de0f1a4c5755a336fb5fb5599afd7274
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	wstx-lgpl
central	groupid	org.codehaus.woodstox
central	groupid	woodstox
central	version	3.2.6
file	name	wstx-lgpl
file	version	3.2.6
Manifest	Implementation-Title	WoodSToX XML-processor
Manifest	Implementation-Vendor	woodstox.codehaus.org
Manifest	Implementation-Version	3.2.6
Manifest	specification-title	StAX 1.0 API
Manifest	specification-vendor	http://jcp.org/en/jsr/detail?id=173
pom	artifactid	wstx-lgpl
pom	description	Woodstox is a high-performance XML processor that implements Stax (JSR-173) API
pom	groupid	codehaus.woodstox
pom	groupid	org.codehaus.woodstox
pom	name	Woodstox
pom	organization name	http://www.codehaus.org/
pom	url	http://woodstox.codehaus.org
pom	version	3.2.6

Identifiers

maven: org.codehaus.woodstox:wstx-lgpl:3.2.6 Confidence:HIGHEST
maven: woodstox:wstx-lgpl:3.2.6 Confidence:HIGHEST

javassist-3.15.0-GA.jar

Description: Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java.

License:

MPL 1.1: http://www.mozilla.org/MPL/MPL-1.1.html
LGPL 2.1: http://www.gnu.org/licenses/lgpl-2.1.html
Apache License 2.0: http://www.apache.org/licenses/

File Path: C:\Users\Dad\.m2\repository\org\javassist\javassist\3.15.0-GA\javassist-3.15.0-GA.jar
MD5: 2fcae06eedcddd3e5b0fe32416f99c1c
SHA1: 79907309ca4bb4e5e51d4086cc4179b2611358d7
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	javassist
central	groupid	org.javassist
central	version	3.15.0-GA
file	name	javassist
file	version	3.15.0
Manifest	specification-title	Javassist
Manifest	specification-vendor	Shigeru Chiba
pom	artifactid	javassist
pom	description	Javassist (JAVA programming ASSISTant) makes Java bytecode manipulation simple. It is a class library for editing bytecodes in Java.
pom	groupid	javassist
pom	groupid	org.javassist
pom	name	Javassist
pom	url	http://www.javassist.org/
pom	version	3.15.0-GA

Identifiers

maven: org.javassist:javassist:3.15.0-GA Confidence:HIGHEST

jboss-logging-3.1.0.GA.jar

Description: The JBoss Logging Framework

License:

GNU Lesser General Public License, version 2.1: http://www.gnu.org/licenses/lgpl-2.1.txt

File Path: C:\Users\Dad\.m2\repository\org\jboss\logging\jboss-logging\3.1.0.GA\jboss-logging-3.1.0.GA.jar
MD5: 735bcea3e47fd715900cfb95ec68b50f
SHA1: c71f2856e7b60efe485db39b37a31811e6c84365
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-logging
central	groupid	org.jboss.logging
central	version	3.1.0.GA
file	name	jboss-logging
file	version	3.1.0
manifest	Bundle-Description	The JBoss Logging Framework
Manifest	bundle-docurl	http://www.jboss.org
Manifest	Bundle-Name	JBoss Logging 3
Manifest	bundle-symbolicname	org.jboss.logging.jboss-logging
Manifest	Implementation-Title	JBoss Logging 3
Manifest	implementation-url	http://www.jboss.org
Manifest	Implementation-Vendor	JBoss by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.logging
Manifest	Implementation-Version	3.1.0.GA
Manifest	specification-title	JBoss Logging 3
Manifest	specification-vendor	JBoss by Red Hat
pom	artifactid	jboss-logging
pom	description	The JBoss Logging Framework
pom	groupid	jboss.logging
pom	groupid	org.jboss.logging
pom	name	JBoss Logging 3
pom	parent-artifactid	jboss-parent
pom	parent-groupid	org.jboss
pom	url	http://www.jboss.org
pom	version	3.1.0.GA

Identifiers

maven: org.jboss.logging:jboss-logging:3.1.0.GA Confidence:HIGHEST

netty-3.2.6.Final.jar

Description: The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0

File Path: C:\Users\Dad\.m2\repository\org\jboss\netty\netty\3.2.6.Final\netty-3.2.6.Final.jar
MD5: 1de6215db3a110a3e23889678c62abe2
SHA1: 7b0364d483095f912c860a641bd0748d4a386274
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	netty
central	groupid	org.jboss.netty
central	version	3.2.6.Final
file	name	netty
file	version	3.2.6
manifest	Bundle-Description	The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications ...
Manifest	bundle-docurl	http://www.jboss.org/netty/
Manifest	Bundle-Name	The Netty Project
Manifest	bundle-symbolicname	org.jboss.netty
pom	artifactid	netty
pom	description	The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications ...
pom	groupid	jboss.netty
pom	groupid	org.jboss.netty
pom	name	The Netty Project
pom	parent-artifactid	jboss-parent
pom	parent-groupid	org.jboss
pom	url	http://www.jboss.org/netty/
pom	version	3.2.6.Final

Identifiers

cpe: cpe:/a:netty_project:netty:3.2.6 Confidence:LOW
maven: org.jboss.netty:netty:3.2.6.Final Confidence:HIGHEST

Published Vulnerabilities

CVE-2014-3488

Severity: Medium
CVSS Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CONFIRM - http://netty.io/news/2014/06/11/3-9-2-Final.html
CONFIRM - https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994
CONFIRM - https://github.com/netty/netty/issues/2562

Vulnerable Software & Versions: (show all)

jboss-servlet-api_3.0_spec-1.0.0.Final.jar

Description: The Java Servlet 3.0 API classes

File Path: C:\Users\Dad\.m2\repository\org\jboss\spec\javax\servlet\jboss-servlet-api_3.0_spec\1.0.0.Final\jboss-servlet-api_3.0_spec-1.0.0.Final.jar
MD5: b4066d8cc5d2980a4811ef781b1eb8ef
SHA1: 44fb8e9dff4a0ec4081bb5492b9a3a9ab9c3466b
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-servlet-api_3.0_spec
central	groupid	org.jboss.spec.javax.servlet
central	version	1.0.0.Final
file	name	jboss-servlet-api_3.0_spec-1.0.0.Final
Manifest	Implementation-Title	Java Servlet 3.0 API
Manifest	implementation-url	http://www.jboss.org/jboss-servlet-api_3.0_spec
Manifest	Implementation-Vendor	JBoss, a division of Red Hat, Inc.
Manifest	Implementation-Vendor-Id	org.jboss.spec.javax.servlet
Manifest	Implementation-Version	1.0.0.Final
Manifest	specification-title	Java Servlet 3.0 API
Manifest	specification-vendor	JBoss, a division of Red Hat, Inc.
pom	artifactid	jboss-servlet-api_3.0_spec
pom	description	The Java Servlet 3.0 API classes
pom	groupid	jboss.spec.javax.servlet
pom	groupid	org.jboss.spec.javax.servlet
pom	name	Java Servlet 3.0 API
pom	parent-artifactid	jboss-specs-parent
pom	parent-groupid	org.jboss.spec
pom	version	1.0.0.Final

Identifiers

maven: org.jboss.spec.javax.servlet:jboss-servlet-api_3.0_spec:1.0.0.Final Confidence:HIGHEST

jboss-jaxb-api_2.2_spec-1.0.3.Final.jar

Description: Java Architecture for XML Binding Version 2.2 classes

File Path: C:\Users\Dad\.m2\repository\org\jboss\spec\javax\xml\bind\jboss-jaxb-api_2.2_spec\1.0.3.Final\jboss-jaxb-api_2.2_spec-1.0.3.Final.jar
MD5: e64bc49dcc94f287c07e8e017d63f21b
SHA1: cc005681297fb411fba21ddbef43eee48304fde1
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-jaxb-api_2.2_spec
central	groupid	org.jboss.spec.javax.xml.bind
central	version	1.0.3.Final
file	name	jboss-jaxb-api_2.2_spec-1.0.3.Final
Manifest	Implementation-Title	Java Architecture for XML Binding 2.2
Manifest	implementation-url	http://jboss-jaxb-api_2.2_spec/
Manifest	Implementation-Vendor	JBoss, a division of Red Hat, Inc.
Manifest	Implementation-Vendor-Id	org.jboss.spec.javax.xml.bind
Manifest	Implementation-Version	1.0.3.Final
Manifest	specification-title	Java Architecture for XML Binding 2.2
Manifest	specification-vendor	JBoss, a division of Red Hat, Inc.
pom	artifactid	jboss-jaxb-api_2.2_spec
pom	description	Java Architecture for XML Binding Version 2.2 classes
pom	groupid	jboss.spec.javax.xml.bind
pom	groupid	org.jboss.spec.javax.xml.bind
pom	name	Java Architecture for XML Binding 2.2
pom	parent-artifactid	jboss-specs-parent
pom	parent-groupid	org.jboss.spec
pom	version	1.0.3.Final

Identifiers

maven: org.jboss.spec.javax.xml.bind:jboss-jaxb-api_2.2_spec:1.0.3.Final Confidence:HIGHEST

jboss-jaxrpc-api_1.1_spec-1.0.0.Final.jar

Description: The JAX-RPC 1.1 API classes

File Path: C:\Users\Dad\.m2\repository\org\jboss\spec\javax\xml\rpc\jboss-jaxrpc-api_1.1_spec\1.0.0.Final\jboss-jaxrpc-api_1.1_spec-1.0.0.Final.jar
MD5: 94fc2b8394867286fc0f90c64c8e3e78
SHA1: 1a10a2215a433d5102aef193692557709ae49573
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-jaxrpc-api_1.1_spec
central	groupid	org.jboss.spec.javax.xml.rpc
central	version	1.0.0.Final
file	name	jboss-jaxrpc-api_1.1_spec-1.0.0.Final
Manifest	Implementation-Title	Java API for XML-Based RPC (JAX-RPC) 1.1
Manifest	implementation-url	http://www.jboss.org/jboss-jaxrpc-api_1.1_spec
Manifest	Implementation-Vendor	JBoss, a division of Red Hat, Inc.
Manifest	Implementation-Vendor-Id	org.jboss.spec.javax.xml.rpc
Manifest	Implementation-Version	1.0.0.Final
Manifest	specification-title	Java API for XML-Based RPC (JAX-RPC) 1.1
Manifest	specification-vendor	JBoss, a division of Red Hat, Inc.
pom	artifactid	jboss-jaxrpc-api_1.1_spec
pom	description	The JAX-RPC 1.1 API classes
pom	groupid	jboss.spec.javax.xml.rpc
pom	groupid	org.jboss.spec.javax.xml.rpc
pom	name	Java API for XML-Based RPC (JAX-RPC) 1.1
pom	parent-artifactid	jboss-specs-parent
pom	parent-groupid	org.jboss.spec
pom	version	1.0.0.Final

Identifiers

maven: org.jboss.spec.javax.xml.rpc:jboss-jaxrpc-api_1.1_spec:1.0.0.Final Confidence:HIGHEST

jboss-saaj-api_1.3_spec-1.0.1.Final.jar

Description: The SOAP with Attachments API for Java Version 1.3 classes

File Path: C:\Users\Dad\.m2\repository\org\jboss\spec\javax\xml\soap\jboss-saaj-api_1.3_spec\1.0.1.Final\jboss-saaj-api_1.3_spec-1.0.1.Final.jar
MD5: 8eca9cd2c277eb04f3efc31e2102a3d1
SHA1: 6889e071d48a16056df01a1bae38f17157413d64
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-saaj-api_1.3_spec
central	groupid	org.jboss.spec.javax.xml.soap
central	version	1.0.1.Final
file	name	jboss-saaj-api_1.3_spec-1.0.1.Final
Manifest	Implementation-Title	SOAP with Attachments API for Java 1.3
Manifest	implementation-url	http://jboss-saaj-api_1.3_spec/
Manifest	Implementation-Vendor	JBoss, a division of Red Hat, Inc.
Manifest	Implementation-Vendor-Id	org.jboss.spec.javax.xml.soap
Manifest	Implementation-Version	1.0.1.Final
Manifest	specification-title	SOAP with Attachments API for Java 1.3
Manifest	specification-vendor	JBoss, a division of Red Hat, Inc.
pom	artifactid	jboss-saaj-api_1.3_spec
pom	description	The SOAP with Attachments API for Java Version 1.3 classes
pom	groupid	jboss.spec.javax.xml.soap
pom	groupid	org.jboss.spec.javax.xml.soap
pom	name	SOAP with Attachments API for Java 1.3
pom	parent-artifactid	jboss-specs-parent
pom	parent-groupid	org.jboss.spec
pom	version	1.0.1.Final

Identifiers

maven: org.jboss.spec.javax.xml.soap:jboss-saaj-api_1.3_spec:1.0.1.Final Confidence:HIGHEST

jboss-jaxws-api_2.2_spec-2.0.2.Final.jar

Description: JSR-000224: Java(TM) API for XML-Based Web Services 2.2

License:

Common Development and Distribution License: http://repository.jboss.org/licenses/cddl.txt
GNU General Public License, Version 2 with the Classpath Exception: http://repository.jboss.org/licenses/gpl-2.0-ce.txt

File Path: C:\Users\Dad\.m2\repository\org\jboss\spec\javax\xml\ws\jboss-jaxws-api_2.2_spec\2.0.2.Final\jboss-jaxws-api_2.2_spec-2.0.2.Final.jar
MD5: c7aad7459433b86a73d56ab86cf69560
SHA1: 1d72b9108f4d93a168b8e3d377c874ee35cd28d2
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jboss-jaxws-api_2.2_spec
central	groupid	org.jboss.spec.javax.xml.ws
central	version	2.0.2.Final
file	name	jboss-jaxws-api_2.2_spec-2.0.2.Final
Manifest	build-timestamp	Wed, 9 Oct 2013 16:15:09 -0400
manifest	Bundle-Description	JSR-000224: Java(TM) API for XML-Based Web Services 2.2
Manifest	bundle-docurl	http://www.jboss.org
Manifest	Bundle-Name	Java(TM) API for XML-Based Web Services 2.2
Manifest	bundle-symbolicname	org.jboss.spec.javax.xml.ws.jboss-jaxws-api_2.2_spec
Manifest	Implementation-Title	Java(TM) API for XML-Based Web Services 2.2
Manifest	implementation-url	http://www.jboss.org/jboss-jaxws-api_2.2_spec
Manifest	Implementation-Vendor	JBoss by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.spec.javax.xml.ws
Manifest	Implementation-Version	2.0.2.Final
Manifest	java-vendor	Oracle Corporation
Manifest	os-name	Linux
Manifest	specification-title	JSR-000224: Java(TM) API for XML-Based Web Services
Manifest	specification-vendor	Oracle
Manifest (hint)	specification-vendor	sun
pom	artifactid	jboss-jaxws-api_2.2_spec
pom	description	JSR-000224: Java(TM) API for XML-Based Web Services 2.2
pom	groupid	jboss.spec.javax.xml.ws
pom	groupid	org.jboss.spec.javax.xml.ws
pom	name	Java(TM) API for XML-Based Web Services 2.2
pom	parent-artifactid	jboss-parent
pom	parent-groupid	org.jboss
pom	version	2.0.2.Final

Identifiers

maven: org.jboss.spec.javax.xml.ws:jboss-jaxws-api_2.2_spec:2.0.2.Final Confidence:HIGHEST

jbossws-api-1.0.0.GA.jar

Description: JBossWS API

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\jbossws-api\1.0.0.GA\jbossws-api-1.0.0.GA.jar
MD5: caf48a05f7eb99b20cb7e11f82db19c8
SHA1: c55f95e5992cb4631617d1d3334b93e2d0f86530
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	jbossws-api
file	version	1.0.0
Manifest	Implementation-Title	JBoss Web Services - API
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws
Manifest	Implementation-Version	1.0.0.GA
pom	artifactid	jbossws-api
pom	description	JBossWS API
pom	groupid	jboss.ws
pom	groupid	org.jboss.ws
pom	name	JBoss Web Services - API
pom	parent-artifactid	jbossws-parent
pom	parent-groupid	org.jboss.ws
pom	version	1.0.0.GA

Identifiers

maven: org.jboss.ws:jbossws-api:1.0.0.GA Confidence:HIGH

jbossws-common-tools-1.0.0.GA.jar

Description: JBossWS Common Tools

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\jbossws-common-tools\1.0.0.GA\jbossws-common-tools-1.0.0.GA.jar
MD5: 87c7ce1f6b4852434c5d26cf33d457d8
SHA1: 92de6d2c77b9832d5b3ebb04aab3901f24875d07
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	jbossws-common-tools
file	version	1.0.0
Manifest	Implementation-Title	JBoss Web Services - Tools Integration
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws
Manifest	Implementation-Version	1.0.0.GA
pom	artifactid	jbossws-common-tools
pom	description	JBossWS Common Tools
pom	groupid	jboss.ws
pom	groupid	org.jboss.ws
pom	name	JBoss Web Services - Tools Integration
pom	parent-artifactid	jbossws-parent
pom	parent-groupid	org.jboss.ws
pom	version	1.0.0.GA

Identifiers

maven: org.jboss.ws:jbossws-common-tools:1.0.0.GA Confidence:HIGH

jbossws-common-3.1.3.Final.jar

Description: JBossWS Common

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\jbossws-common\3.1.3.Final\jbossws-common-3.1.3.Final.jar
MD5: d6d3dc433ab396a4f5d588cf55c67128
SHA1: f5f349abde594c726d6034eaa2f01a5606300b54
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jbossws-common
central	groupid	org.jboss.ws
central	version	3.1.3.Final
file	name	jbossws-common
file	version	3.1.3
Manifest	Implementation-Title	JBoss Web Services - Common
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws
Manifest	Implementation-Version	3.1.3.Final
pom	artifactid	jbossws-common
pom	description	JBossWS Common
pom	groupid	jboss.ws
pom	groupid	org.jboss.ws
pom	name	JBoss Web Services - Common
pom	parent-artifactid	jbossws-parent
pom	parent-groupid	org.jboss.ws
pom	version	3.1.3.Final

Identifiers

maven: org.jboss.ws:jbossws-common:3.1.3.Final Confidence:HIGHEST

jbossws-spi-3.1.2.Final.jar

Description: JBossWS SPI

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\jbossws-spi\3.1.2.Final\jbossws-spi-3.1.2.Final.jar
MD5: 6b1dbb8f6030745279eda3cd8b1cdd51
SHA1: 4772c33f92417fc3d007b5c0d9a9e92c0111fa94
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	jbossws-spi
central	groupid	org.jboss.ws
central	version	3.1.2.Final
file	name	jbossws-spi
file	version	3.1.2
Manifest	Implementation-Title	JBoss Web Services - SPI
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws
Manifest	Implementation-Version	3.1.2.Final
pom	artifactid	jbossws-spi
pom	description	JBossWS SPI
pom	groupid	jboss.ws
pom	groupid	org.jboss.ws
pom	name	JBoss Web Services - SPI
pom	parent-artifactid	jbossws-parent
pom	parent-groupid	org.jboss.ws
pom	version	3.1.2.Final

Identifiers

maven: org.jboss.ws:jbossws-spi:3.1.2.Final Confidence:HIGHEST

jbossws-native-client-4.0.2.GA.jar

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\native\jbossws-native-client\4.0.2.GA\jbossws-native-client-4.0.2.GA.jar
MD5: b9b25d9db591efa3f53edf4cf88400e4
SHA1: 24d3fd7e2cf22c5f6877b7009e83979d7ae0ed8d
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	jbossws-native-client
file	version	4.0.2
Manifest	Implementation-Title	JBoss Web Services - Stack Native Client
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws.native
Manifest	Implementation-Version	4.0.2.GA
pom	artifactid	jbossws-native-client
pom	groupid	jboss.ws.native
pom	groupid	org.jboss.ws.native
pom	name	JBoss Web Services - Stack Native Client
pom	parent-artifactid	jbossws-native
pom	parent-groupid	org.jboss.ws.native
pom	version	4.0.2.GA

Identifiers

maven: org.jboss.ws.native:jbossws-native-client:4.0.2.GA Confidence:HIGH

jbossws-native-core-4.0.2.GA.jar

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\native\jbossws-native-core\4.0.2.GA\jbossws-native-core-4.0.2.GA.jar
MD5: e1cba91b6727688dbdcd772e711ff031
SHA1: 800a9b139bb273cbd767a57389c7a22a8174abae
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	jbossws-native-core
file	version	4.0.2
Manifest	Implementation-Title	JBoss Web Services - Native Server
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws.native
Manifest	Implementation-Version	4.0.2.GA
pom	artifactid	jbossws-native-core
pom	groupid	jboss.ws.native
pom	groupid	org.jboss.ws.native
pom	name	JBoss Web Services - Native Server
pom	parent-artifactid	jbossws-native
pom	parent-groupid	org.jboss.ws.native
pom	version	4.0.2.GA

Identifiers

cpe: cpe:/a:redhat:jboss_web_server:4.0.2 Confidence:LOW
maven: org.jboss.ws.native:jbossws-native-core:4.0.2.GA Confidence:HIGH

jbossws-native-factories-4.0.2.GA.jar

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\native\jbossws-native-factories\4.0.2.GA\jbossws-native-factories-4.0.2.GA.jar
MD5: 03797155ae34a0f19e303166565f11b9
SHA1: ecc0ad36e21b167a8d8e6155a32ee67bd3f0c4ee
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	jbossws-native-factories
file	version	4.0.2
Manifest	Implementation-Title	JBoss Web Services - Endorsed JAX-WS, JAX-RPC and SAAJ factories
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws.native
Manifest	Implementation-Version	4.0.2.GA
pom	artifactid	jbossws-native-factories
pom	groupid	jboss.ws.native
pom	groupid	org.jboss.ws.native
pom	name	JBoss Web Services - Endorsed JAX-WS, JAX-RPC and SAAJ factories
pom	parent-artifactid	jbossws-native
pom	parent-groupid	org.jboss.ws.native
pom	version	4.0.2.GA

Identifiers

maven: org.jboss.ws.native:jbossws-native-factories:4.0.2.GA Confidence:HIGH

jbossws-native-services-4.0.2.GA.jar

File Path: C:\Users\Dad\.m2\repository\org\jboss\ws\native\jbossws-native-services\4.0.2.GA\jbossws-native-services-4.0.2.GA.jar
MD5: 6d92e327831fb03b6dfb81fef371ad1e
SHA1: 174a193954697f89bb466285b4bd8a4c29c3dfc3
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
file	name	jbossws-native-services
file	version	4.0.2
Manifest	Implementation-Title	JBoss Web Services - Framework services configuration
Manifest	Implementation-Vendor	JBoss, by Red Hat
Manifest	Implementation-Vendor-Id	org.jboss.ws.native
Manifest	Implementation-Version	4.0.2.GA
pom	artifactid	jbossws-native-services
pom	groupid	jboss.ws.native
pom	groupid	org.jboss.ws.native
pom	name	JBoss Web Services - Framework services configuration
pom	parent-artifactid	jbossws-native
pom	parent-groupid	org.jboss.ws.native
pom	version	4.0.2.GA

Identifiers

maven: org.jboss.ws.native:jbossws-native-services:4.0.2.GA Confidence:HIGH

stax-ex-1.2.jar

Description: Extensions to JSR-173 StAX API.

License:

Common Development And Distribution License (CDDL) Version 1.0: http://www.sun.com/cddl/cddl.html

File Path: C:\Users\Dad\.m2\repository\org\jvnet\staxex\stax-ex\1.2\stax-ex-1.2.jar
MD5: e5b8a72a34f085b92ef54d8cd7a24a1c
SHA1: a0ad9319e140a1e5ddcc77f870ca67722bab8ff7
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	stax-ex
central	groupid	org.jvnet.staxex
central	version	1.2
file	name	stax-ex
file	version	1.2
jar	package name	jvnet
jar	package name	staxex
pom	artifactid	stax-ex
pom	description	Extensions to JSR-173 StAX API.
pom	groupid	jvnet.staxex
pom	groupid	org.jvnet.staxex
pom	name	Extended StAX API
pom	url	https://stax-ex.dev.java.net/
pom	version	1.2

Identifiers

maven: org.jvnet.staxex:stax-ex:1.2 Confidence:HIGHEST

stax-api-1.0.1.jar

Description: StAX API is the standard java XML processing API defined by JSR-173

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\stax\stax-api\1.0.1\stax-api-1.0.1.jar
MD5: 7d436a53c64490bee564c576babb36b4
SHA1: 49c100caf72d658aca8e58bd74a4ba90fa2b0d70
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	stax-api
central	groupid	stax
central	version	1.0.1
file	name	stax-api
file	version	1.0.1
Manifest	Implementation-Title	StAX 1.0 API
Manifest	Implementation-Vendor	JCP
Manifest	Implementation-Version	1.0.1
Manifest	specification-title	StAX
Manifest	specification-vendor	JCP-173
pom	artifactid	stax-api
pom	description	StAX API is the standard java XML processing API defined by JSR-173
pom	groupid	stax
pom	name	StAX API
pom	url	http://stax.codehaus.org/
pom	version	1.0.1

Identifiers

maven: stax:stax-api:1.0.1 Confidence:HIGHEST

wstx-asl-3.2.1.jar

File Path: C:\Users\Dad\.m2\repository\woodstox\wstx-asl\3.2.1\wstx-asl-3.2.1.jar
MD5: 94b4be97c785b3f4a6dada4d80a9779a
SHA1: bf92f1c71612d4aed212f9bc39c69716978aef5a
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	wstx-asl
central	groupid	org.codehaus.woodstox
central	groupid	woodstox
central	version	3.2.1
file	name	wstx-asl
file	version	3.2.1
Manifest	Implementation-Title	WoodSToX XML-processor
Manifest	Implementation-Vendor	woodstox.codehaus.org
Manifest	Implementation-Version	3.2.1
Manifest	specification-title	StAX 1.0 API
Manifest	specification-vendor	http://jcp.org/en/jsr/detail?id=173
pom	artifactid	wstx-asl
pom	groupid	woodstox
pom	version	3.2.1

Identifiers

maven: org.codehaus.woodstox:wstx-asl:3.2.1 Confidence:HIGHEST
maven: woodstox:wstx-asl:3.2.1 Confidence:HIGHEST

policy-1.0.jar

File Path: C:\Users\Dad\.m2\repository\ws-commons\policy\1.0\policy-1.0.jar
MD5: 9a1124152201aa6551f0aa8e302c3847
SHA1: eb4039347c7192511cb256492712d46d784e15c7
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	policy
central	groupid	ws-commons
central	version	1.0
file	name	policy
file	version	1.0
Manifest	extension-name	policy
Manifest	Implementation-Title	org.apache.ws.policy
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Version	1.0
Manifest	specification-title
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	policy
pom	groupid	ws-commons
pom	version	1.0

Identifiers

maven: ws-commons:policy:1.0 Confidence:HIGHEST

wsdl4j-1.6.2.jar

Description: Java stub generator for WSDL

License:

CPL: http://www.opensource.org/licenses/cpl1.0.txt

File Path: C:\Users\Dad\.m2\repository\wsdl4j\wsdl4j\1.6.2\wsdl4j-1.6.2.jar
MD5: 2608a8ea3f07b0c08de8a7d3d0d3fc09
SHA1: dec1669fb6801b7328e01ad72fc9e10b69ea06c1
Referenced In Project/Scope: fgsms JbossWS Native JAXWS Agent:provided

Evidence

Source	Name	Value
central	artifactid	wsdl4j
central	groupid	wsdl4j
central	version	1.6.2
file	name	wsdl4j
file	version	1.6.2
Manifest	Implementation-Title	WSDL4J
Manifest	Implementation-Vendor	IBM
Manifest	specification-title	JWSDL
Manifest	specification-vendor	IBM (Java Community Process)
pom	artifactid	wsdl4j
pom	description	Java stub generator for WSDL
pom	groupid	wsdl4j
pom	name	WSDL4J
pom	url	http://sf.net/projects/wsdl4j
pom	version	1.6.2

Identifiers

maven: wsdl4j:wsdl4j:1.6.2 Confidence:HIGHEST

jaxb-impl-2.2.4.jar\META-INF/maven/com.sun.istack/istack-commons-runtime/pom.xml

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-impl\2.2.4\jaxb-impl-2.2.4.jar\META-INF/maven/com.sun.istack/istack-commons-runtime/pom.xml
MD5: 0513db028888d063debffae15fa93bef
SHA1: ada4f12799e180fadbe5a5695a7f048904c70877

Evidence

Source	Name	Value
pom	artifactid	istack-commons-runtime
pom	groupid	sun.istack
pom	name	istack common utility code runtime
pom	parent-artifactid	istack-commons
pom	parent-groupid	com.sun.istack
pom	version	2.4-SNAPSHOT

Identifiers

maven: com.sun.istack:istack-commons-runtime:2.4-SNAPSHOT Confidence:HIGH

jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.codemodel/codemodel/pom.xml

Description: The core functionality of the CodeModel java source code generation library

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.2.4\jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.codemodel/codemodel/pom.xml
MD5: 9495ef15cdb0deab7667dff4ce0f20ea
SHA1: ae6a933c80cda1d24c71b8d6e9ad592bace3f49c

Evidence

Source	Name	Value
pom	artifactid	codemodel
pom	description	The core functionality of the CodeModel java source code generation library
pom	groupid	sun.codemodel
pom	name	Codemodel Core
pom	parent-artifactid	codemodel-project
pom	parent-groupid	com.sun.codemodel
pom	version	2.5-SNAPSHOT

Identifiers

maven: com.sun.codemodel:codemodel:2.5-SNAPSHOT Confidence:HIGH

jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.istack/istack-commons-tools/pom.xml

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.2.4\jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.istack/istack-commons-tools/pom.xml
MD5: 0c26e1b7c5bbd02ec2af9851929d9c10
SHA1: 1ca6d67fb4f671058fe823f358fe8d91ee78e533

Evidence

Source	Name	Value
pom	artifactid	istack-commons-tools
pom	groupid	sun.istack
pom	name	istack common utility code tools
pom	parent-artifactid	istack-commons
pom	parent-groupid	com.sun.istack
pom	version	2.4-SNAPSHOT

Identifiers

maven: com.sun.istack:istack-commons-tools:2.4-SNAPSHOT Confidence:HIGH

jaxb-impl-2.2.4.jar\META-INF/maven/com.sun.xml.txw2/txw2/pom.xml

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-impl\2.2.4\jaxb-impl-2.2.4.jar\META-INF/maven/com.sun.xml.txw2/txw2/pom.xml
MD5: 6c05cadb7bf3dd648207868976943312
SHA1: 794bf6ca832e21187b15e8737ec1e6a3e3dc758a

Evidence

Source	Name	Value
pom	artifactid	txw2
pom	groupid	sun.xml.txw2
pom	name	TXW2 Runtime
pom	parent-artifactid	txw2-project
pom	parent-groupid	com.sun.xml.txw2
pom	version	201103-SNAPSHOT

Identifiers

maven: com.sun.xml.txw2:txw2:201103-SNAPSHOT Confidence:HIGH

jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.xml.dtd-parser/dtd-parser/pom.xml

Description: SAX-like API for parsing XML DTDs.

License:

CDDL v1.1 / GPL v2 dual license: http://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.2.4\jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.xml.dtd-parser/dtd-parser/pom.xml
MD5: 9f9d4028fcdf2317f36754dc5f07d266
SHA1: 9fbfbbb92d69781183abb5f59ba68193619917d3

Evidence

Source	Name	Value
pom	artifactid	dtd-parser
pom	description	SAX-like API for parsing XML DTDs.
pom	groupid	sun.xml.dtd-parser
pom	name	DTD Parser
pom	organization name	http://www.oracle.com/
pom	url	http://dtd-parser.java.net/
pom	version	1.2-SNAPSHOT

Identifiers

maven: com.sun.xml.dtd-parser:dtd-parser:1.2-SNAPSHOT Confidence:HIGH

jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.xsom/xsom/pom.xml

Description: XML Schema Object Model (XSOM) is a Java library that allows applications to easily parse XML Schema documents and inspect information in them. It is expected to be useful for applications that need to take XML Schema as an input.

License:

CDDL v1.1 / GPL v2 dual license: http://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.2.4\jaxb-xjc-2.2.4.jar\META-INF/maven/com.sun.xsom/xsom/pom.xml
MD5: 005644c5218bcaa801dddcbca695bce4
SHA1: 8ac483d3c7211ad2d32caac3e6957c3776e04d4c

Evidence

Source	Name	Value
pom	artifactid	xsom
pom	description	XML Schema Object Model (XSOM) is a Java library that allows applications to easily parse XML Schema documents and inspect information in them. It is expected to be useful for applications that need to take XML Schema as an input.
pom	groupid	sun.xsom
pom	name	XSOM
pom	organization name	http://www.oracle.com/
pom	url	http://xsom.java.net/
pom	version	20110101-SNAPSHOT

Identifiers

maven: com.sun.xsom:xsom:20110101-SNAPSHOT Confidence:HIGH

jaxb-xjc-2.2.4.jar\META-INF/maven/org.kohsuke.rngom/rngom/pom.xml

Description: RNGOM is an open-source Java library for parsing RELAX NG grammars.

License:

The MIT License: http://www.opensource.org/licenses/mit-license.php

File Path: C:\Users\Dad\.m2\repository\com\sun\xml\bind\jaxb-xjc\2.2.4\jaxb-xjc-2.2.4.jar\META-INF/maven/org.kohsuke.rngom/rngom/pom.xml
MD5: a384e4166825dc6aea901acc5be90a4c
SHA1: 5cf801bf40bfdd2925eaf6e40e6b167fd2967eb7

Evidence

Source	Name	Value
pom	artifactid	rngom
pom	description	RNGOM is an open-source Java library for parsing RELAX NG grammars.
pom	groupid	kohsuke.rngom
pom	name	RELAX NG Object Model / Parser
pom	url	http://rngom.java.net/
pom	version	201103-SNAPSHOT

Identifiers

maven: org.kohsuke.rngom:rngom:201103-SNAPSHOT Confidence:HIGH

How to read the report | Suppressing false positives | Getting Help: google group | github issues

Project: fgsms JbossWS Native JAXWS Agent

Dependencies

avalon-framework-4.1.3.jar

Evidence

Identifiers

resolver-20050927.jar

Evidence

Identifiers

jaxb-impl-2.2.4.jar

Evidence

Identifiers

jaxb-xjc-2.2.4.jar

Evidence

Identifiers

FastInfoset-1.2.7.jar

Evidence

Identifiers

streambuffer-1.0.jar

Evidence

Identifiers

txw2-20090102.jar

Evidence

Identifiers

jaxws-rt-2.2.jar

Evidence

Identifiers

jaxws-tools-2.2.jar

Evidence

Identifiers

policy-2.0-b01.jar

Evidence

Identifiers

commons-beanutils-1.8.0.jar

Evidence

Identifiers

Published Vulnerabilities

commons-logging-1.1.jar

Evidence

Identifiers

getopt-1.0.13.jar

Evidence

Identifiers

activation-1.1.jar

Evidence

Identifiers

jsr181-api-1.0-MR1.jar

Evidence

Identifiers

mail-1.4.7.jar

Evidence

Identifiers

servlet-api-2.5.jar

Evidence

Identifiers

jaxb-api-2.2.3.jar

Evidence

Identifiers

stax-api-1.0-2.jar

Evidence

Identifiers

jboss-jaxb-intros-1.0.2.GA.jar

Evidence

Identifiers

log4j-1.2.17.jar

Evidence

Identifiers

logkit-1.0.1.jar

Evidence

Identifiers

commons-lang3-3.5.jar

Evidence

Identifiers

xmlsec-1.5.1.jar

Evidence

Identifiers

Published Vulnerabilities

jettison-1.3.4.jar

Evidence

Identifiers