Dependency-Check Report

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

Scan Information (show all):

dependency-check version: 1.4.5
Report Generated On: Mar 12, 2017 at 00:00:10 EST
Dependencies Scanned: 23 (22 unique)
Vulnerable Dependencies: 6
Vulnerabilities Found: 7
Vulnerabilities Suppressed: 0
...
CurrentEngineRelease:
NVD CVE 2002: 19/02/2017 03:25:58
NVD CVE 2003: 19/02/2017 03:24:25
NVD CVE 2004: 19/02/2017 03:23:59
NVD CVE 2005: 24/02/2017 03:12:32
NVD CVE 2006: 19/02/2017 03:20:36
NVD CVE 2007: 19/02/2017 03:18:20
NVD CVE 2008: 19/02/2017 03:16:18
NVD CVE 2009: 19/02/2017 03:14:03
NVD CVE 2010: 09/02/2017 03:09:26
NVD CVE 2011: 19/02/2017 03:11:57
NVD CVE 2012: 24/02/2017 03:11:07
NVD CVE 2013: 24/02/2017 03:09:00
NVD CVE 2014: 01/03/2017 03:07:38
NVD CVE 2015: 04/03/2017 03:06:02
NVD CVE 2016: 05/03/2017 03:02:53
NVD CVE 2017: 05/03/2017 03:00:24
NVD CVE Checked: 11/03/2017 23:34:50
NVD CVE Modified: 11/03/2017 20:00:24
VersionCheckOn: 1486838497071

Display: Showing Vulnerable Dependencies (click to show all)

Dependency	CPE	GAV	Highest Severity	CVE Count	CPE Confidence	Evidence Count
avalon-framework-4.1.3.jar		avalon-framework:avalon-framework:4.1.3		0		12
batik-awt-util-1.6.jar	cpe:/a:apache:batik:1.6	batik:batik-awt-util:1.6	Medium	1	LOW	16
batik-dom-1.6.jar	cpe:/a:apache:batik:1.6	batik:batik-dom:1.6	Medium	1	LOW	15
batik-svggen-1.6-1.jar	cpe:/a:apache:batik:1.6.1	batik:batik-svggen:1.6	Medium	1	LOW	15
batik-util-1.6.jar	cpe:/a:apache:batik:1.6	batik:batik-util:1.6	Medium	1	LOW	15
batik-xml-1.6.jar	cpe:/a:apache:batik:1.6	batik:batik-xml:1.6	Medium	1	LOW	15
cewolf-1.2.4-java7.jar		cewolf:cewolf:1.2.4-java7		0		14
commons-logging-1.1.jar		commons-logging:commons-logging:1.1		0		19
VectorGraphics2D-0.9.3.jar		de.erichseifert.vectorgraphics2d:VectorGraphics2D:0.9.3		0		14
geronimo-spec-j2ee-connector-1.5-rc4.jar	cpe:/a:apache:geronimo:1.5.rc4	geronimo-spec:geronimo-spec-j2ee-connector:1.5-rc4	High	2	LOW	14
activation-1.1.jar		javax.activation:activation:1.1		0		17
ejb-api-3.0.jar		javax.ejb:ejb-api:3.0		0		15
mail-1.4.7.jar	cpe:/a:sun:javamail:1.4.7	javax.mail:mail:1.4.7		0	LOW	26
servlet-api-2.5.jar		javax.servlet:servlet-api:2.5		0		11
log4j-1.2.17.jar		log4j:log4j:1.2.17		0		18
logkit-1.0.1.jar		logkit:logkit:1.0.1		0		11
commons-lang3-3.5.jar		org.apache.commons:commons-lang3:3.5		0		27
qpid-client-6.0.0.jar	cpe:/a:apache:qpid:6.0.0	org.apache.qpid:qpid-client:6.0.0		0	LOW	19
jcommon-1.0.23.jar		org.jfree:jcommon:1.0.23		0		15
jfreechart-1.0.19.jar		org.jfree:jfreechart:1.0.19		0		15
xchart-3.0.0.jar		org.knowm.xchart:xchart:3.0.0		0		16
slf4j-api-1.7.7.jar		org.slf4j:slf4j-api:1.7.7		0		20

Dependencies

avalon-framework-4.1.3.jar

File Path: C:\Users\Dad\.m2\repository\avalon-framework\avalon-framework\4.1.3\avalon-framework-4.1.3.jar
MD5: bef9f9be8ba066273fdef72b3503a307
SHA1: 92315ee1c4a4c90bee05055713811f28f8509075
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	avalon-framework
central	groupid	avalon-framework
central	version	4.1.3
file	name	avalon-framework
file	version	4.1.3
Manifest	extension-name	avalon-framework
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Version	4.1.3
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	avalon-framework
pom	groupid	avalon-framework
pom	version	4.1.3

Identifiers

maven: avalon-framework:avalon-framework:4.1.3 Confidence:HIGHEST

batik-awt-util-1.6.jar

Description: Batik AWT Utilities

File Path: C:\Users\Dad\.m2\repository\batik\batik-awt-util\1.6\batik-awt-util-1.6.jar
MD5: 04013947d519c13fd4d82355cb496552
SHA1: 590750cc8d6a1ba0189b437172b6444578d79c99
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	batik-awt-util
central	groupid	batik
central	groupid	john-test
central	version	1.6
central	version	1.6-1
file	name	batik-awt-util
file	version	1.6
jar	package name	apache
jar	package name	awt
jar	package name	batik
jar	package name	ext
pom	artifactid	batik-awt-util
pom	description	Batik AWT Utilities
pom	groupid	batik
pom	name	Batik AWT Utilities
pom	version	1.6

Identifiers

maven: batik:batik-awt-util:1.6 Confidence:HIGHEST
maven: batik:batik-awt-util:1.6-1 Confidence:HIGHEST
cpe: cpe:/a:apache:batik:1.6 Confidence:LOW
maven: john-test:batik-awt-util:1.6 Confidence:HIGHEST

Published Vulnerabilities

CVE-2015-0250

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

CONFIRM - http://advisories.mageia.org/MGASA-2015-0138.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21963275
CONFIRM - http://xmlgraphics.apache.org/security.html
FULLDISC - 20150322 [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection)
MANDRIVA - MDVSA-2015:203
MISC - http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
REDHAT - RHSA-2016:0041
REDHAT - RHSA-2016:0042
SECTRACK - 1032781
UBUNTU - USN-2548-1

Vulnerable Software & Versions: (show all)

cpe:/a:apache:batik:1.7 and all previous versions
...
cpe:/a:apache:batik:1.7 and all previous versions
cpe:/a:redhat:jboss_enterprise_brms_platform:6.1.2 and all previous versions

batik-dom-1.6.jar

Description: Batik DOM

File Path: C:\Users\Dad\.m2\repository\batik\batik-dom\1.6\batik-dom-1.6.jar
MD5: ce481d746c345a3d3046dab157c8468f
SHA1: 27983405f0871f28d3b9ab35b44e62610a60564a
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	batik-dom
central	groupid	batik
central	groupid	john-test
central	version	1.6
central	version	1.6-1
file	name	batik-dom
file	version	1.6
jar	package name	apache
jar	package name	batik
jar	package name	dom
pom	artifactid	batik-dom
pom	description	Batik DOM
pom	groupid	batik
pom	name	Batik DOM
pom	version	1.6

Identifiers

maven: batik:batik-dom:1.6 Confidence:HIGHEST
maven: batik:batik-dom:1.6-1 Confidence:HIGHEST
cpe: cpe:/a:apache:batik:1.6 Confidence:LOW
maven: john-test:batik-dom:1.6 Confidence:HIGHEST

Published Vulnerabilities

CVE-2015-0250

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CONFIRM - http://advisories.mageia.org/MGASA-2015-0138.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21963275
CONFIRM - http://xmlgraphics.apache.org/security.html
FULLDISC - 20150322 [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection)
MANDRIVA - MDVSA-2015:203
MISC - http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
REDHAT - RHSA-2016:0041
REDHAT - RHSA-2016:0042
SECTRACK - 1032781
UBUNTU - USN-2548-1

Vulnerable Software & Versions: (show all)

cpe:/a:apache:batik:1.7 and all previous versions
...
cpe:/a:apache:batik:1.7 and all previous versions
cpe:/a:redhat:jboss_enterprise_brms_platform:6.1.2 and all previous versions

batik-svggen-1.6-1.jar

Description: Batik SVG Generator

File Path: C:\Users\Dad\.m2\repository\batik\batik-svggen\1.6-1\batik-svggen-1.6-1.jar
MD5: 918e775580eb37b9d57ea37c79fc8610
SHA1: 983914d5e27957145e34b55ad7f48df96eb6d280
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	batik-svggen
central	groupid	batik
central	groupid	john-test
central	version	1.6
central	version	1.6-1
file	name	batik-svggen
file	version	1.6.1
jar	package name	apache
jar	package name	batik
jar	package name	svggen
pom	artifactid	batik-svggen
pom	description	Batik SVG Generator
pom	groupid	batik
pom	name	Batik SVG Generator
pom	version	1.6-1

Identifiers

maven: batik:batik-svggen:1.6 Confidence:HIGHEST
maven: batik:batik-svggen:1.6-1 Confidence:HIGHEST
cpe: cpe:/a:apache:batik:1.6.1 Confidence:LOW
maven: john-test:batik-svggen:1.6 Confidence:HIGHEST

Published Vulnerabilities

CVE-2015-0250

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CONFIRM - http://advisories.mageia.org/MGASA-2015-0138.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21963275
CONFIRM - http://xmlgraphics.apache.org/security.html
FULLDISC - 20150322 [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection)
MANDRIVA - MDVSA-2015:203
MISC - http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
REDHAT - RHSA-2016:0041
REDHAT - RHSA-2016:0042
SECTRACK - 1032781
UBUNTU - USN-2548-1

Vulnerable Software & Versions: (show all)

cpe:/a:apache:batik:1.7 and all previous versions
...
cpe:/a:apache:batik:1.7 and all previous versions
cpe:/a:redhat:jboss_enterprise_brms_platform:6.1.2 and all previous versions

batik-util-1.6.jar

Description: Batik Utilities

File Path: C:\Users\Dad\.m2\repository\batik\batik-util\1.6\batik-util-1.6.jar
MD5: 4a137ce0ce2f8eb24823b55ebb26cb24
SHA1: 7bea0185bb630bca235ffa904b1a03e8a4786a45
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	batik-util
central	groupid	batik
central	groupid	john-test
central	version	1.6
central	version	1.6-1
file	name	batik-util
file	version	1.6
jar	package name	apache
jar	package name	batik
jar	package name	util
pom	artifactid	batik-util
pom	description	Batik Utilities
pom	groupid	batik
pom	name	Batik Utilities
pom	version	1.6

Identifiers

maven: batik:batik-util:1.6 Confidence:HIGHEST
maven: batik:batik-util:1.6-1 Confidence:HIGHEST
cpe: cpe:/a:apache:batik:1.6 Confidence:LOW
maven: john-test:batik-util:1.6 Confidence:HIGHEST

Published Vulnerabilities

CVE-2015-0250

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CONFIRM - http://advisories.mageia.org/MGASA-2015-0138.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21963275
CONFIRM - http://xmlgraphics.apache.org/security.html
FULLDISC - 20150322 [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection)
MANDRIVA - MDVSA-2015:203
MISC - http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
REDHAT - RHSA-2016:0041
REDHAT - RHSA-2016:0042
SECTRACK - 1032781
UBUNTU - USN-2548-1

Vulnerable Software & Versions: (show all)

cpe:/a:apache:batik:1.7 and all previous versions
...
cpe:/a:apache:batik:1.7 and all previous versions
cpe:/a:redhat:jboss_enterprise_brms_platform:6.1.2 and all previous versions

batik-xml-1.6.jar

Description: Batik XML

File Path: C:\Users\Dad\.m2\repository\batik\batik-xml\1.6\batik-xml-1.6.jar
MD5: d4d0b431411f67662618f9b87dbcddab
SHA1: 4f2c18a0d41b8804e6fd24f183a567b41c928ed0
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	batik-xml
central	groupid	batik
central	groupid	john-test
central	version	1.6
central	version	1.6-1
file	name	batik-xml
file	version	1.6
jar	package name	apache
jar	package name	batik
jar	package name	xml
pom	artifactid	batik-xml
pom	description	Batik XML
pom	groupid	batik
pom	name	Batik XML
pom	version	1.6

Identifiers

maven: batik:batik-xml:1.6 Confidence:HIGHEST
maven: batik:batik-xml:1.6-1 Confidence:HIGHEST
cpe: cpe:/a:apache:batik:1.6 Confidence:LOW
maven: john-test:batik-xml:1.6 Confidence:HIGHEST

Published Vulnerabilities

CVE-2015-0250

Severity: Medium
CVSS Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CONFIRM - http://advisories.mageia.org/MGASA-2015-0138.html
CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21963275
CONFIRM - http://xmlgraphics.apache.org/security.html
FULLDISC - 20150322 [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection)
MANDRIVA - MDVSA-2015:203
MISC - http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html
REDHAT - RHSA-2016:0041
REDHAT - RHSA-2016:0042
SECTRACK - 1032781
UBUNTU - USN-2548-1

Vulnerable Software & Versions: (show all)

cpe:/a:apache:batik:1.7 and all previous versions
...
cpe:/a:apache:batik:1.7 and all previous versions
cpe:/a:redhat:jboss_enterprise_brms_platform:6.1.2 and all previous versions

cewolf-1.2.4-java7.jar

Description: Cewolf is a tag library for JfreeChart. JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots.

License:

GNU Lesser General Public License version 2.1 (LGPLv2.1): http://www.gnu.org/licenses/lgpl-2.1.txt

File Path: C:\Users\Dad\.m2\repository\cewolf\cewolf\1.2.4-java7\cewolf-1.2.4-java7.jar
MD5: 52336ab381cc46d082b893873707e011
SHA1: ceec652622da825768aa19f960021548fa6d0768
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	cewolf
central	groupid	cewolf
central	version	1.2.4-java7
file	name	cewolf
file	version	1.2.4
jar	package name	cewolf
jar	package name	de
jar	package name	laures
pom	artifactid	cewolf
pom	description	Cewolf is a tag library for JfreeChart. JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots.
pom	groupid	cewolf
pom	name	cewolf
pom	url	http://cewolf.sourceforge.net
pom	version	1.2.4-java7

Identifiers

maven: cewolf:cewolf:1.2.4-java7 Confidence:HIGHEST

commons-logging-1.1.jar

Description: Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.

License:

The Apache Software License, Version 2.0: /LICENSE.txt

File Path: C:\Users\Dad\.m2\repository\commons-logging\commons-logging\1.1\commons-logging-1.1.jar
MD5: 6b62417e77b000a87de66ee3935edbf5
SHA1: ba24d5de831911b684c92cd289ed5ff826271824
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	commons-logging
central	groupid	commons-logging
central	version	1.1
file	name	commons-logging
file	version	1.1
Manifest	extension-name	org.apache.commons.logging
Manifest	Implementation-Title	Jakarta Commons Logging
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	1.1
Manifest	specification-title	Jakarta Commons Logging
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	commons-logging
pom	description	Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.
pom	groupid	commons-logging
pom	name	Logging
pom	organization name	http://jakarta.apache.org
pom	url	http://jakarta.apache.org/commons/${pom.artifactId.substring(8)}/
pom	version	1.1

Identifiers

maven: commons-logging:commons-logging:1.1 Confidence:HIGHEST

VectorGraphics2D-0.9.3.jar

Description: A library for adding vector export to Java(R) Graphics2D.

License:

GNU Library or Lesser General Public License (LGPL): http://www.gnu.org/licenses/lgpl.txt

File Path: C:\Users\Dad\.m2\repository\de\erichseifert\vectorgraphics2d\VectorGraphics2D\0.9.3\VectorGraphics2D-0.9.3.jar
MD5: 71a405d7f54cc94df0711d516abeca52
SHA1: 221c9d68940b9ff48cd88cdc0c4943d3710d8af1
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	VectorGraphics2D
central	groupid	de.erichseifert.vectorgraphics2d
central	version	0.9.3
file	name	VectorGraphics2D
file	version	0.9.3
jar	package name	de
jar	package name	erichseifert
jar	package name	vectorgraphics2d
pom	artifactid	VectorGraphics2D
pom	description	A library for adding vector export to Java(R) Graphics2D.
pom	groupid	de.erichseifert.vectorgraphics2d
pom	name	VectorGraphics2D Library
pom	url	https://github.com/eseifert/vectorgraphics2d
pom	version	0.9.3

Identifiers

maven: de.erichseifert.vectorgraphics2d:VectorGraphics2D:0.9.3 Confidence:HIGHEST

geronimo-spec-j2ee-connector-1.5-rc4.jar

File Path: C:\Users\Dad\.m2\repository\geronimo-spec\geronimo-spec-j2ee-connector\1.5-rc4\geronimo-spec-j2ee-connector-1.5-rc4.jar
MD5: 6a2ccbc1d0af6329c00b2089ae1a31d7
SHA1: 2f5310631817f11c5b170d3a0084a58766d49269
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	geronimo-spec-j2ee-connector
central	groupid	geronimo-spec
central	version	1.5-rc4
file	name	geronimo-spec-j2ee-connector
file	version	1.5.rc4
Manifest	extension-name	geronimo-spec-j2ee-connector
Manifest	Implementation-Title	javax.resource
Manifest	Implementation-Vendor	Apache Software Foundation
Manifest	Implementation-Version	1.5-rc4
Manifest	specification-title	J2EE Connector Architecture
Manifest	specification-vendor	Apache Software Foundation
pom	artifactid	geronimo-spec-j2ee-connector
pom	groupid	geronimo-spec
pom	version	1.5-rc4

Identifiers

cpe: cpe:/a:apache:geronimo:1.5.rc4 Confidence:LOW
maven: geronimo-spec:geronimo-spec-j2ee-connector:1.5-rc4 Confidence:HIGHEST

Published Vulnerabilities

CVE-2011-5034

Severity: High
CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CWE: CWE-20 Improper Input Validation

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.

Vulnerable Software & Versions: (show all)

cpe:/a:apache:geronimo:2.2.1 and all previous versions
...
cpe:/a:apache:geronimo:1.0
cpe:/a:apache:geronimo:1.1
cpe:/a:apache:geronimo:1.1.1
cpe:/a:apache:geronimo:1.2
cpe:/a:apache:geronimo:2.0.1
cpe:/a:apache:geronimo:2.0.2
cpe:/a:apache:geronimo:2.1
cpe:/a:apache:geronimo:2.1.1
cpe:/a:apache:geronimo:2.1.2
cpe:/a:apache:geronimo:2.1.3
cpe:/a:apache:geronimo:2.1.4
cpe:/a:apache:geronimo:2.1.5
cpe:/a:apache:geronimo:2.1.6
cpe:/a:apache:geronimo:2.1.7
cpe:/a:apache:geronimo:2.1.8
cpe:/a:apache:geronimo:2.2
cpe:/a:apache:geronimo:2.2.1 and all previous versions

CVE-2008-0732

Severity: Low
CVSS Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-59 Improper Link Resolution Before File Access ('Link Following')

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.

SUSE - SUSE-SR:2008:003

Vulnerable Software & Versions:

cpe:/a:apache:geronimo

activation-1.1.jar

Description: JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).

License:

Common Development and Distribution License (CDDL) v1.0: https://glassfish.dev.java.net/public/CDDLv1.0.html

File Path: C:\Users\Dad\.m2\repository\javax\activation\activation\1.1\activation-1.1.jar
MD5: 8ae38e87cd4f86059c0294a8fe3e0b18
SHA1: e6cb541461c2834bdea3eb920f1884d1eb508b50
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	activation
central	groupid	javax.activation
central	version	1.1
file	name	activation
file	version	1.1
Manifest	extension-name	javax.activation
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.1
Manifest	specification-title	JavaBeans(TM) Activation Framework Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	activation
pom	description	JavaBeans Activation Framework (JAF) is a standard extension to the Java platform that lets you take advantage of standard services to: determine the type of an arbitrary piece of data; encapsulate access to it; discover the operations available on it; and instantiate the appropriate bean to perform the operation(s).
pom	groupid	javax.activation
pom	name	JavaBeans Activation Framework (JAF)
pom	url	http://java.sun.com/products/javabeans/jaf/index.jsp
pom	version	1.1

Identifiers

maven: javax.activation:activation:1.1 Confidence:HIGHEST

ejb-api-3.0.jar

File Path: C:\Users\Dad\.m2\repository\javax\ejb\ejb-api\3.0\ejb-api-3.0.jar
MD5: bf9716b5dd34838c272aa44dfbab5fbc
SHA1: d4855ba9a1ecd993b751880567ec06ffcbd6fe06
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	ejb-api
central	groupid	javax.ejb
central	version	3.0
file	name	ejb-api
file	version	3.0
Manifest	extension-name	javax.ejb
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	3.0
Manifest	sccs-id	@(#)Manifest 1.1 00/10/19
Manifest	specification-title	Enterprise JavaBeans(TM) Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	ejb-api
pom	groupid	javax.ejb
pom	version	3.0

Identifiers

maven: javax.ejb:ejb-api:3.0 Confidence:HIGHEST

mail-1.4.7.jar

Description: JavaMail API (compat)

License:

http://www.sun.com/cddl, https://glassfish.java.net/public/CDDL+GPL_1_1.html

File Path: C:\Users\Dad\.m2\repository\javax\mail\mail\1.4.7\mail-1.4.7.jar
MD5: 77f53ff0c78ba43c4812ecc9f53e20f8
SHA1: 9add058589d5d85adeb625859bf2c5eeaaedf12d
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	mail
central	groupid	javax.mail
central	version	1.4.7
file	name	mail
file	version	1.4.7
manifest	Bundle-Description	JavaMail API (compat)
Manifest	bundle-docurl	http://www.oracle.com
Manifest	Bundle-Name	JavaMail API (compat)
Manifest	bundle-symbolicname	javax.mail
Manifest	extension-name	javax.mail
Manifest	Implementation-Title	javax.mail
Manifest	Implementation-Vendor	Oracle
Manifest	Implementation-Vendor-Id	com.sun
Manifest	Implementation-Version	1.4.7
Manifest	originally-created-by	1.7.0_15 (Oracle Corporation)
Manifest	probe-provider-xml-file-names	META-INF/gfprobe-provider.xml
Manifest	specification-title	JavaMail(TM) API Design Specification
Manifest	specification-vendor	Oracle
Manifest (hint)	Implementation-Vendor	sun
Manifest (hint)	specification-vendor	sun
pom	artifactid	mail
pom	groupid	javax.mail
pom	name	JavaMail API (compat)
pom	parent-artifactid	all
pom	parent-groupid	com.sun.mail
pom	version	1.4.7

Identifiers

cpe: cpe:/a:sun:javamail:1.4.7 Confidence:LOW
maven: javax.mail:mail:1.4.7 Confidence:HIGHEST

servlet-api-2.5.jar

File Path: C:\Users\Dad\.m2\repository\javax\servlet\servlet-api\2.5\servlet-api-2.5.jar
MD5: 116fc16f3f700d756a57a2b8ea7c1044
SHA1: e69999122202bb1c275a80ad3281c4f69f2ea0b2
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
file	name	servlet-api
file	version	2.5
Manifest	extension-name	javax.servlet
Manifest	Implementation-Vendor	Sun Microsystems, Inc.
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	2.5
Manifest	specification-title	JavaServlet(TM) Specification
Manifest	specification-vendor	Sun Microsystems, Inc.
pom	artifactid	servlet-api
pom	groupid	javax.servlet
pom	version	2.5

Identifiers

maven: javax.servlet:servlet-api:2.5 Confidence:HIGH

log4j-1.2.17.jar

Description: Apache Log4j 1.2

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\log4j\log4j\1.2.17\log4j-1.2.17.jar
MD5: 04a41f0a068986f0f73485cf507c0f40
SHA1: 5af35056b4d257e4b64b9e8069c0746e8b08629f
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	log4j
central	groupid	log4j
central	version	1.2.17
file	name	log4j
file	version	1.2.17
manifest	Bundle-Description	Apache Log4j 1.2
Manifest	bundle-docurl	http://logging.apache.org/log4j/1.2
Manifest	Bundle-Name	Apache Log4j
Manifest	bundle-symbolicname	log4j
manifest: org.apache.log4j	Implementation-Title	log4j
manifest: org.apache.log4j	Implementation-Vendor	"Apache Software Foundation"
pom	artifactid	log4j
pom	description	Apache Log4j 1.2
pom	groupid	log4j
pom	name	Apache Log4j
pom	organization name	http://www.apache.org
pom	url	http://logging.apache.org/log4j/1.2/
pom	version	1.2.17

Identifiers

maven: log4j:log4j:1.2.17 Confidence:HIGHEST

logkit-1.0.1.jar

File Path: C:\Users\Dad\.m2\repository\logkit\logkit\1.0.1\logkit-1.0.1.jar
MD5: 32240100a5c15d53f00392fae4b0aab7
SHA1: aaf5649b523c5ffc925e746074979150bb74bfdc
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	logkit
central	groupid	logkit
central	version	1.0.1
file	name	logkit
file	version	1.0.1
jar	package name	apache
jar	package name	log
jar	package name	output
pom	artifactid	logkit
pom	groupid	logkit
pom	version	1.0.1

Identifiers

maven: logkit:logkit:1.0.1 Confidence:HIGHEST

commons-lang3-3.5.jar

Description: Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Dad\.m2\repository\org\apache\commons\commons-lang3\3.5\commons-lang3-3.5.jar
MD5: 780b5a8b72eebe6d0dbff1c11b5658fa
SHA1: 6c6c702c89bfff3cd9e80b04d668c5e190d588c6
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	commons-lang3
central	groupid	org.apache.commons
central	version	3.5
file	name	commons-lang3
file	version	3.5
manifest	Bundle-Description	Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
Manifest	bundle-docurl	http://commons.apache.org/proper/commons-lang/
Manifest	Bundle-Name	Apache Commons Lang
Manifest	bundle-symbolicname	org.apache.commons.lang3
Manifest	implementation-build	release@r36f98d87b24c2f542b02abbf6ec1ee742f1b158b; 2016-10-13 19:52:17+0000
Manifest	Implementation-Title	Apache Commons Lang
Manifest	implementation-url	http://commons.apache.org/proper/commons-lang/
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache
Manifest	Implementation-Version	3.5
Manifest	require-capability	osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.6))"
Manifest	specification-title	Apache Commons Lang
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	commons-lang3
pom	description	Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.
pom	groupid	apache.commons
pom	groupid	org.apache.commons
pom	name	Apache Commons Lang
pom	parent-artifactid	commons-parent
pom	parent-groupid	org.apache.commons
pom	url	http://commons.apache.org/proper/commons-lang/
pom	version	3.5

Identifiers

maven: org.apache.commons:commons-lang3:3.5 Confidence:HIGHEST

qpid-client-6.0.0.jar

Description: JMS client supporting AMQP 0-8, 0-9, 0-9-1 and 0-10.

File Path: C:\Users\Dad\.m2\repository\org\apache\qpid\qpid-client\6.0.0\qpid-client-6.0.0.jar
MD5: 244a004182de831f2ff3774dbac2741f
SHA1: 0a4c3e81e2c4777bf3d50c293391831a5dd1acf9
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	qpid-client
central	groupid	org.apache.qpid
central	version	6.0.0
file	name	qpid-client
file	version	6.0.0
Manifest	Implementation-Title	Qpid AMQP 0-x JMS Client
Manifest	Implementation-Vendor	The Apache Software Foundation
Manifest	Implementation-Vendor-Id	org.apache.qpid
Manifest	Implementation-Version	6.0.0
Manifest	specification-title	Qpid AMQP 0-x JMS Client
Manifest	specification-vendor	The Apache Software Foundation
pom	artifactid	qpid-client
pom	description	JMS client supporting AMQP 0-8, 0-9, 0-9-1 and 0-10.
pom	groupid	apache.qpid
pom	groupid	org.apache.qpid
pom	name	Qpid AMQP 0-x JMS Client
pom	parent-artifactid	qpid-java-build
pom	parent-groupid	org.apache.qpid
pom	version	6.0.0

Related Dependencies

Identifiers

cpe: cpe:/a:apache:qpid:6.0.0 Confidence:LOW
maven: org.apache.qpid:qpid-client:6.0.0 Confidence:HIGHEST

jcommon-1.0.23.jar

Description: JCommon is a free general purpose Java class library that is used in several projects at www.jfree.org, including JFreeChart and JFreeReport.

License:

GNU Lesser General Public Licence: http://www.gnu.org/licenses/lgpl.txt

File Path: C:\Users\Dad\.m2\repository\org\jfree\jcommon\1.0.23\jcommon-1.0.23.jar
MD5: 1b059adc60fef2da40b7130f9a67f977
SHA1: a316f336ca996e0c6bec4e4fbd49be8f5e1c3968
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	jcommon
central	groupid	org.jfree
central	version	1.0.23
file	name	jcommon
file	version	1.0.23
jar	package name	jfree
jar	package name	ui
pom	artifactid	jcommon
pom	description	JCommon is a free general purpose Java class library that is used in several projects at www.jfree.org, including JFreeChart and JFreeReport.
pom	groupid	jfree
pom	groupid	org.jfree
pom	name	JCommon
pom	organization name	http://www.jfree.org/
pom	url	http://www.jfree.org/jcommon/
pom	version	1.0.23

Identifiers

maven: org.jfree:jcommon:1.0.23 Confidence:HIGHEST

jfreechart-1.0.19.jar

Description: JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots.

License:

GNU Lesser General Public Licence: http://www.gnu.org/licenses/lgpl.txt

File Path: C:\Users\Dad\.m2\repository\org\jfree\jfreechart\1.0.19\jfreechart-1.0.19.jar
MD5: 4ff3762bd04a7239cfb98de542134bec
SHA1: ba9ee7dbb2e4c57a6901c79f614ed2dea9cc0e20
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	jfreechart
central	groupid	org.jfree
central	version	1.0.19
file	name	jfreechart
file	version	1.0.19
jar	package name	chart
jar	package name	jfree
pom	artifactid	jfreechart
pom	description	JFreeChart is a class library, written in Java, for generating charts. Utilising the Java2D APIs, it currently supports bar charts, pie charts, line charts, XY-plots and time series plots.
pom	groupid	jfree
pom	groupid	org.jfree
pom	name	JFreeChart
pom	organization name	http://www.jfree.org/
pom	url	http://www.jfree.org/jfreechart/
pom	version	1.0.19

Identifiers

maven: org.jfree:jfreechart:1.0.19 Confidence:HIGHEST

xchart-3.0.0.jar

Description: The core XChart library

File Path: C:\Users\Dad\.m2\repository\org\knowm\xchart\xchart\3.0.0\xchart-3.0.0.jar
MD5: a0fa77ed0eeb3e8c7c5801b2d0b9c545
SHA1: 83f605b9d59f9e860e85c8c53cb6ed736eb99e85
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	xchart
central	groupid	org.knowm.xchart
central	version	3.0.0
file	name	xchart
file	version	3.0.0
jar	package name	internal
jar	package name	knowm
jar	package name	xchart
pom	artifactid	xchart
pom	description	The core XChart library
pom	groupid	knowm.xchart
pom	groupid	org.knowm.xchart
pom	name	XChart
pom	parent-artifactid	xchart-parent
pom	parent-groupid	org.knowm.xchart
pom	version	3.0.0

Identifiers

maven: org.knowm.xchart:xchart:3.0.0 Confidence:HIGHEST

slf4j-api-1.7.7.jar

Description: The slf4j API

File Path: C:\Users\Dad\.m2\repository\org\slf4j\slf4j-api\1.7.7\slf4j-api-1.7.7.jar
MD5: ca4280bf93d64367723ae5c8d42dd0b9
SHA1: 2b8019b6249bb05d81d3a3094e468753e2b21311
Referenced In Project/Scope: fgsms Automated Reporting Service:compile

Evidence

Source	Name	Value
central	artifactid	slf4j-api
central	groupid	org.slf4j
central	version	1.7.7
file	name	slf4j-api
file	version	1.7.7
manifest	Bundle-Description	The slf4j API
Manifest	Bundle-Name	slf4j-api
Manifest	bundle-requiredexecutionenvironment	J2SE-1.3
Manifest	bundle-symbolicname	slf4j.api
Manifest	Implementation-Title	slf4j-api
Manifest	Implementation-Version	1.7.7
pom	artifactid	slf4j-api
pom	description	The slf4j API
pom	groupid	org.slf4j
pom	groupid	slf4j
pom	name	SLF4J API Module
pom	parent-artifactid	slf4j-parent
pom	parent-groupid	org.slf4j
pom	url	http://www.slf4j.org
pom	version	1.7.7

Identifiers

maven: org.slf4j:slf4j-api:1.7.7 Confidence:HIGHEST

How to read the report | Suppressing false positives | Getting Help: google group | github issues

Project: fgsms Automated Reporting Service

Dependencies

avalon-framework-4.1.3.jar

Evidence

Identifiers

batik-awt-util-1.6.jar

Evidence

Identifiers

Published Vulnerabilities

batik-dom-1.6.jar

Evidence

Identifiers

Published Vulnerabilities

batik-svggen-1.6-1.jar

Evidence

Identifiers

Published Vulnerabilities

batik-util-1.6.jar

Evidence

Identifiers

Published Vulnerabilities

batik-xml-1.6.jar

Evidence

Identifiers

Published Vulnerabilities

cewolf-1.2.4-java7.jar

Evidence

Identifiers

commons-logging-1.1.jar

Evidence

Identifiers

VectorGraphics2D-0.9.3.jar

Evidence

Identifiers

geronimo-spec-j2ee-connector-1.5-rc4.jar

Evidence

Identifiers

Published Vulnerabilities

activation-1.1.jar

Evidence

Identifiers

ejb-api-3.0.jar

Evidence

Identifiers

mail-1.4.7.jar

Evidence

Identifiers

servlet-api-2.5.jar

Evidence

Identifiers

log4j-1.2.17.jar

Evidence

Identifiers

logkit-1.0.1.jar

Evidence

Identifiers

commons-lang3-3.5.jar

Evidence

Identifiers

qpid-client-6.0.0.jar

Evidence

Related Dependencies

Identifiers

jcommon-1.0.23.jar

Evidence

Identifiers

jfreechart-1.0.19.jar

Evidence

Identifiers

xchart-3.0.0.jar

Evidence

Identifiers

slf4j-api-1.7.7.jar

Evidence

Identifiers