Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
* indicates the dependency has a known exploited vulnerability
Dependencies
it-tidalwave-role-3.2-ALPHA-23.jar
Description:
Roles are a powerful way for designing complex behaviours while keeping good practices such as Single Responsibility, Dependency Inversion and
Interface Segregation.
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-role/3.2-ALPHA-23/it-tidalwave-role-3.2-ALPHA-23.jar MD5: 37f0daee422c452ebe1a056f3e33d566 SHA1: afcce55ee9a0a52285c6ab13a6f61c4e8f667db7 SHA256:dc43792db69cb53f1341d33d8517ef99c45ce356f55b105227f532c8012e7bd9 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile it-tidalwave-role-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-util/3.2-ALPHA-23/it-tidalwave-util-3.2-ALPHA-23.jar MD5: 021b41e778533aa2700c52873b0b0b75 SHA1: 1ed40423e696ec50058f9c3ccb3a468c05fcb5cf SHA256:4fea0bf9e195da5db90a3b675562dcdbfe98a058e04e324c846f31d6991e3327 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile it-tidalwave-util-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-base/11.0.1/javafx-base-11.0.1-mac.jar MD5: 94933060e439fba99478e14fcf2d1b02 SHA1: 2b9ca67aea06b0ea7aa0e740498fc97c822b307e SHA256:2d8052a08fd2e5d98e1d5a16d724ea5dd02102879de20a193225f57199803983 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-base-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-base@11.0.1
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-base/11.0.1/javafx-base-11.0.1.jar MD5: b85ce0631dae83fe643fbd32ccd08e4c SHA1: f1354a284f4151d20358e776f6ff68ee35bbb96d SHA256:c5084a74417a89c69a0c122fae96a4b70bf619fc3d6218ea102a4047ec85ad04 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-base-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-controls/11.0.1/javafx-controls-11.0.1-mac.jar MD5: f321c782b9bf158a630cb0a7bea73644 SHA1: 0538fd08a4ecd76788766a69c19e90b4cc0179f8 SHA256:148468742e957b765d5ac6d5ba66ce983e1acdf582c191bb35dbfe8cdefdb314 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-controls-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-controls@11.0.1
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-controls/11.0.1/javafx-controls-11.0.1.jar MD5: 2e18fc95e4aa7ce325cefa67b9f61f3d SHA1: 61cf91bf3494d0616216f49c9e1d183d170adf0a SHA256:71be28dc4d80744ba541fc50d933729e8703fe1e642ae92037f6fccc7f961971 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-controls-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-fxml/11.0.1/javafx-fxml-11.0.1-mac.jar MD5: a835057792b4fc1aa7d6c4bea9547add SHA1: 352a51a0f0cb13cf83a081b5dd5526acd4fbab30 SHA256:56f9a32b3a1fc76c761bd40c16917ed1675c8d5dcbe492a44ce9ee2391e27139 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-fxml-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-fxml@11.0.1
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-fxml/11.0.1/javafx-fxml-11.0.1.jar MD5: 6e4c64769d877a47edbdd0023d89a074 SHA1: f290c13d7e984d880c9f114f38c2da949ef18d54 SHA256:546fc449f01cd0bbe51a921f9d3f0e5d8764764480caca4a709e681e7ad0b6cf Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-fxml-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-graphics/11.0.1/javafx-graphics-11.0.1-mac.jar MD5: 64a05ff45e2ff0e9695817816284daf5 SHA1: 3c5014c500e6d308eca4ac9f952d4f7e7e8dfc7e SHA256:e0bcd295cae13c636f92911474acbab6bee836e6950d1696a02d79a041d61df2 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-graphics-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-controls@11.0.1
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-graphics/11.0.1/javafx-graphics-11.0.1.jar MD5: ff0579b2b89bfc26f6eb73f812076a1b SHA1: e062cb01783effc6413abbd94d1838f6b0add209 SHA256:f597c672a4337a75ba856f38cf548c524b039f452423c34b55653e56c306733d Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javafx-graphics-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-controls@11.0.1
CDDL + GPLv2 with classpath exception: https://github.com/javaee/javax.annotation/blob/master/LICENSE
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/annotation/javax.annotation-api/1.3.2/javax.annotation-api-1.3.2.jar MD5: 2ab1973eefffaa2aeec47d50b9e40b9d SHA1: 934c04d3cfef185a8008e7bf34331b79730a9d43 SHA256:e04ba5195bcd555dc95650f7cc614d151e4bcd52d29a10b8aa2197f3ab89ab9b Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javax.annotation-api-1.3.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/inject/javax.inject/1/javax.inject-1.jar MD5: 289075e48b909e9e74e6c915b3631d2e SHA1: 6975da39a7040257bd51d21a231b76c915872d38 SHA256:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile javax.inject-1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar MD5: dd83accb899363c32b07d7a1b2e4ce40 SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23
Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!
License:
The MIT License: https://projectlombok.org/LICENSE
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar MD5: a1651eaa9c999c61131d32feab16fcde SHA1: 13a394eed5c4f9efb2a6d956e2086f1d81e857d9 SHA256:d3584bc2db03f059f984fb0a9c119aac1fa0da578a448e69fc3f68b36584c749 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:provided lombok-1.18.24.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7.jar MD5: 403dffa46cdd2e3c82da19df4f394a4c SHA1: 41eb7184ea9d556f23e18b5cb99cad1f8581fc00 SHA256:5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile slf4j-api-2.0.7.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23
GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/github/spotbugs/spotbugs-annotations/3.1.9/spotbugs-annotations-3.1.9.jar MD5: 56a1a81d69b6a111161bbce0e6dea26a SHA1: 2ef5127efcc1a899aab8c66d449a631c9a99c469 SHA256:68c7c46b4299e94837e236ae742f399901a950fe910fe3ca710026753b5dd2e1 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile spotbugs-annotations-3.1.9.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar MD5: e34fafcb6ea7a2c9db80a686af31a27e SHA1: b255bb7389e582d24574f75bc0c880ffb8103dfa SHA256:94a64b38e9dfa22df3c67664aea08aed559110bed386a736cb02a01d0254b236 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile spring-core-4.3.30.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework/spring-context@4.3.30.RELEASE
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-expression/4.3.30.RELEASE/spring-expression-4.3.30.RELEASE.jar MD5: e9959f3eadbef7006c2721f27b324627 SHA1: 6ce0709c6899dde41a7213ccccfe2535e34c80fe SHA256:21f6d95c15e1b93675b958c69cd9309754c6909dd25c01f120a3934de7e37749 Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile spring-expression-4.3.30.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework/spring-context@4.3.30.RELEASE
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
Specifically, an application is vulnerable when the following is true:
* The application evaluates user-supplied SpEL expressions.
Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2024-38808 for details
CWE-770 Allocation of Resources Without Limits or Throttling