Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

Project: TheseFoolishThings

it.tidalwave.thesefoolishthings:thesefoolishthings:3.2-ALPHA-19

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
HikariCP-4.0.3.jarpkg:maven/com.zaxxer/HikariCP@4.0.3 036
antlr-2.7.7.jarpkg:maven/antlr/antlr@2.7.7 023
aspectjrt-1.9.19.jarpkg:maven/org.aspectj/aspectjrt@1.9.19 025
betterbeansbinding-core-1.3.0.jarpkg:maven/it.tidalwave.betterbeansbinding/betterbeansbinding-core@1.3.0 020
betterbeansbinding-el-1.3.0.jarpkg:maven/it.tidalwave.betterbeansbinding/betterbeansbinding-el@1.3.0 022
betterbeansbinding-swingbinding-1.3.0.jarpkg:maven/it.tidalwave.betterbeansbinding/betterbeansbinding-swingbinding@1.3.0 022
byte-buddy-1.12.16.jarpkg:maven/net.bytebuddy/byte-buddy@1.12.16 028
byte-buddy-1.12.20.jarpkg:maven/net.bytebuddy/byte-buddy@1.12.20 028
byte-buddy-agent-1.12.16.jarpkg:maven/net.bytebuddy/byte-buddy-agent@1.12.16 034
classmate-1.5.1.jarpkg:maven/com.fasterxml/classmate@1.5.1 047
h2-2.1.214.jarcpe:2.3:a:h2database:h2:2.1.214:*:*:*:*:*:*:*pkg:maven/com.h2database/h2@2.1.214HIGH2Highest38
h2-2.1.214.jar: data.zip: table.js 00
h2-2.1.214.jar: data.zip: tree.js 00
hamcrest-core-1.3.jarpkg:maven/org.hamcrest/hamcrest-core@1.3 026
hibernate-commons-annotations-5.1.2.Final.jarpkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final 039
hibernate-core-5.6.14.Final.jarcpe:2.3:a:hibernate:hibernate_orm:5.6.14:*:*:*:*:*:*:*pkg:maven/org.hibernate/hibernate-core@5.6.14.Final 0Low40
istack-commons-runtime-3.0.12.jarcpe:2.3:a:oracle:java_se:3.0.12:*:*:*:*:*:*:*pkg:maven/com.sun.istack/istack-commons-runtime@3.0.12 0Low37
it-tidalwave-messagebus-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-messagebus@3.2-ALPHA-19 023
it-tidalwave-role-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role@3.2-ALPHA-19 023
it-tidalwave-role-spring-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role-spring@3.2-ALPHA-19 025
it-tidalwave-thesefoolishthings-examples-data-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-thesefoolishthings-examples-data@3.2-ALPHA-19 025
it-tidalwave-thesefoolishthings-examples-finderexample1-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-thesefoolishthings-examples-finderexample1@3.2-ALPHA-19 025
it-tidalwave-util-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-19 023
it-tidalwave-util-test-3.2-ALPHA-19.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util-test@3.2-ALPHA-19 025
jakarta.activation-1.2.2.jarcpe:2.3:a:oracle:java_se:1.2.2:*:*:*:*:*:*:*pkg:maven/com.sun.activation/jakarta.activation@1.2.2 0Low37
jakarta.annotation-api-1.3.5.jarpkg:maven/jakarta.annotation/jakarta.annotation-api@1.3.5 032
jakarta.inject-api-2.0.0.jarpkg:maven/jakarta.inject/jakarta.inject-api@2.0.0 031
jakarta.persistence-api-2.2.3.jarpkg:maven/jakarta.persistence/jakarta.persistence-api@2.2.3 031
jakarta.transaction-api-1.3.3.jarcpe:2.3:a:oracle:projects:1.3.3:*:*:*:*:*:*:*pkg:maven/jakarta.transaction/jakarta.transaction-api@1.3.3 0Low39
jakarta.xml.bind-api-2.3.3.jarpkg:maven/jakarta.xml.bind/jakarta.xml.bind-api@2.3.3 034
jandex-2.4.2.Final.jarpkg:maven/org.jboss/jandex@2.4.2.Final 045
java-diff-utils-4.12.jarcpe:2.3:a:utils_project:utils:4.12:*:*:*:*:*:*:*pkg:maven/io.github.java-diff-utils/java-diff-utils@4.12MEDIUM1Highest22
javax.activation-api-1.2.0.jarpkg:maven/javax.activation/javax.activation-api@1.2.0 038
javax.annotation-api-1.3.2.jarpkg:maven/javax.annotation/javax.annotation-api@1.3.2 039
javax.inject-1.jarpkg:maven/javax.inject/javax.inject@1 019
javax.persistence-api-2.2.jarcpe:2.3:a:oracle:java_se:2.2:*:*:*:*:*:*:*pkg:maven/javax.persistence/javax.persistence-api@2.2 0Low33
jaxb-api-2.3.1.jarcpe:2.3:a:oracle:java_se:2.3.1:*:*:*:*:*:*:*pkg:maven/javax.xml.bind/jaxb-api@2.3.1 0Low36
jaxb-runtime-2.3.7.jarcpe:2.3:a:eclipse:glassfish:2.3.7:*:*:*:*:*:*:*pkg:maven/org.glassfish.jaxb/jaxb-runtime@2.3.7 0Highest48
jboss-logging-3.4.3.Final.jarpkg:maven/org.jboss.logging/jboss-logging@3.4.3.Final 046
jboss-transaction-api_1.2_spec-1.1.1.Final.jarpkg:maven/org.jboss.spec.javax.transaction/jboss-transaction-api_1.2_spec@1.1.1.Final 042
jcl-over-slf4j-2.0.6.jarcpe:2.3:a:qos:slf4j:2.0.6:*:*:*:*:*:*:*pkg:maven/org.slf4j/jcl-over-slf4j@2.0.6 0Low33
jcommander-1.82.jarpkg:maven/com.beust/jcommander@1.82 020
jquery-3.6.1.jarpkg:maven/org.webjars/jquery@3.6.1 013
jquery-3.6.1.jar: jquery.js 00
jquery-3.6.1.jar: jquery.min.js 00
jquery-3.6.1.jar: jquery.slim.js 00
jquery-3.6.1.jar: jquery.slim.min.js 00
jquery-3.6.1.jar: webjars-requirejs.js 00
jsr305-3.0.2.jarpkg:maven/com.google.code.findbugs/jsr305@3.0.2 017
jul-to-slf4j-2.0.6.jarcpe:2.3:a:qos:slf4j:2.0.6:*:*:*:*:*:*:*pkg:maven/org.slf4j/jul-to-slf4j@2.0.6 0Low38
junit-4.12.jarpkg:maven/junit/junit@4.12MEDIUM124
log4j-api-2.17.2.jarcpe:2.3:a:apache:log4j:2.17.2:*:*:*:*:*:*:*pkg:maven/org.apache.logging.log4j/log4j-api@2.17.2 0Highest48
logback-core-1.4.5.jarcpe:2.3:a:qos:logback:1.4.5:*:*:*:*:*:*:*pkg:maven/ch.qos.logback/logback-core@1.4.5 0Highest37
lombok-1.18.24.jarpkg:maven/org.projectlombok/lombok@1.18.24 024
lombok-1.18.24.jar: mavenEcjBootstrapAgent.jar 07
mockito-core-4.8.1.jarpkg:maven/org.mockito/mockito-core@4.8.1 027
mxparser-1.2.2.jarcpe:2.3:a:xstream_project:xstream:1.2.2:*:*:*:*:*:*:*pkg:maven/io.github.x-stream/mxparser@1.2.2CRITICAL37Low53
objenesis-3.2.jarpkg:maven/org.objenesis/objenesis@3.2 031
slf4j-api-2.0.6.jarcpe:2.3:a:qos:slf4j:2.0.6:*:*:*:*:*:*:*pkg:maven/org.slf4j/slf4j-api@2.0.6 0Low37
snakeyaml-1.30.jarcpe:2.3:a:snakeyaml_project:snakeyaml:1.30:*:*:*:*:*:*:*
cpe:2.3:a:yaml_project:yaml:1.30:*:*:*:*:*:*:*
pkg:maven/org.yaml/snakeyaml@1.30CRITICAL9Highest28
spotbugs-annotations-3.1.9.jarpkg:maven/com.github.spotbugs/spotbugs-annotations@3.1.9 021
spring-boot-2.7.7.jarcpe:2.3:a:vmware:spring_boot:2.7.7:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:2.7.7:*:*:*:*:*:*:*
pkg:maven/org.springframework.boot/spring-boot@2.7.7CRITICAL13Highest30
spring-core-5.3.24.jarcpe:2.3:a:pivotal_software:spring_framework:5.3.24:*:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:5.3.24:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:5.3.24:*:*:*:*:*:*:*
pkg:maven/org.springframework/spring-core@5.3.24CRITICAL3Highest31
spring-data-commons-2.7.6.jarcpe:2.3:a:pivotal_software:spring_data_commons:2.7.6:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:2.7.6:*:*:*:*:*:*:*
pkg:maven/org.springframework.data/spring-data-commons@2.7.6CRITICAL13Highest30
spring-data-jpa-2.7.6.jarcpe:2.3:a:pivotal_software:spring_data_jpa:2.7.6:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:2.7.6:*:*:*:*:*:*:*
pkg:maven/org.springframework.data/spring-data-jpa@2.7.6CRITICAL13Highest32
spring-expression-5.3.24.jarcpe:2.3:a:pivotal_software:spring_framework:5.3.24:*:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:5.3.24:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:5.3.24:*:*:*:*:*:*:*
pkg:maven/org.springframework/spring-expression@5.3.24CRITICAL4Highest31
testng-7.7.1.jarcpe:2.3:a:testng_project:testng:7.7.1:*:*:*:*:*:*:*pkg:maven/org.testng/testng@7.7.1 0Highest29
testng-7.7.1.jar: jquery-3.6.0.min.js 00
testng-7.7.1.jar: testng-reports.js 00
testng-7.7.1.jar: testng-reports2.js 00
txw2-2.3.7.jarcpe:2.3:a:eclipse:glassfish:2.3.7:*:*:*:*:*:*:*pkg:maven/org.glassfish.jaxb/txw2@2.3.7 0Highest35
xmlpull-1.1.3.1.jarpkg:maven/xmlpull/xmlpull@1.1.3.1 017
xstream-1.4.20.jarcpe:2.3:a:xstream_project:xstream:1.4.20:*:*:*:*:*:*:*pkg:maven/com.thoughtworks.xstream/xstream@1.4.20 0Highest57

Dependencies

HikariCP-4.0.3.jar

Description:

Ultimate JDBC Connection Pool

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/zaxxer/HikariCP/4.0.3/HikariCP-4.0.3.jar
MD5: e725642926105cd1bbf4ad7fdff5d5a9
SHA1: 107cbdf0db6780a065f895ae9d8fbf3bb0e1c21f
SHA256:7c024aeff1c1063576d74453513f9de6447d8e624d17f8e27f30a2e97688c6c9
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

antlr-2.7.7.jar

Description:

    A framework for constructing recognizers, compilers,
    and translators from grammatical descriptions containing
    Java, C#, C++, or Python actions.
  

License:

BSD License: http://www.antlr.org/license.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar
MD5: f8f1352c52a4c6a500b597596501fc64
SHA1: 83cd2cd674a217ade95a4bb83a8a14f351f48bd0
SHA256:88fbda4b912596b9f56e8e12e580cc954bacfb51776ecfddd3e18fc1cf56dc4c
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

aspectjrt-1.9.19.jar

Description:

The AspectJ runtime is a small library necessary to run Java programs enhanced by AspectJ aspects during a previous
		compile-time or post-compile-time (binary weaving) build step.

License:

Eclipse Public License - v 2.0: https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/aspectj/aspectjrt/1.9.19/aspectjrt-1.9.19.jar
MD5: 249f23aacbb08a0b4ab60fd92c9ef1e8
SHA1: d6d4ccdb1318b19c85e8c1c2227941c32a4253a9
SHA256:87fcab9b5f01a2bbddc13db7b439bd55a786f85bfac4872d25c911c91e23c45b
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

betterbeansbinding-core-1.3.0.jar

Description:

Keeping JavaBeans in sync.

License:

http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/betterbeansbinding/betterbeansbinding-core/1.3.0/betterbeansbinding-core-1.3.0.jar
MD5: a4ed4664612ece2fdff12bf5f21accc8
SHA1: ba454e7173845a67ba7f9e9478af4a9e43700b7b
SHA256:da366781ce264f2facefc922b858382dc1b82b551a777c6df6106a9349763080
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Swing:compile

Identifiers

betterbeansbinding-el-1.3.0.jar

Description:

Keeping JavaBeans in sync.

License:

http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/betterbeansbinding/betterbeansbinding-el/1.3.0/betterbeansbinding-el-1.3.0.jar
MD5: 63cad21fb9a2b5a837b11e881eeeda22
SHA1: f285f3cd2b41cbde08a45095ca3be862d7ef7adf
SHA256:b19e603cc5e959f2bde777f9f992ea63e59fef211c650d3bf4bf707ed741a84f
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Swing:compile

Identifiers

betterbeansbinding-swingbinding-1.3.0.jar

Description:

Keeping JavaBeans in sync.

License:

http://www.gnu.org/licenses/lgpl-2.1.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/betterbeansbinding/betterbeansbinding-swingbinding/1.3.0/betterbeansbinding-swingbinding-1.3.0.jar
MD5: 73e42607d80f5e24e9be17e4e3952184
SHA1: d865d0482b48bd900099fc5c84c02892766ff375
SHA256:053cdb906c0d366df9e4851ce2528f200ba97fda2d7d6769dabe7012dcc83d29
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Swing:compile

Identifiers

byte-buddy-1.12.16.jar

Description:

        Byte Buddy is a Java library for creating Java classes at run time.
        This artifact is a build of Byte Buddy with all ASM dependencies repackaged into its own name space.
    

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/net/bytebuddy/byte-buddy/1.12.16/byte-buddy-1.12.16.jar
MD5: 2327dfe368f76ae200fd353425f56ed0
SHA1: 7817a8128b38ff8cb8570c8f3c85c1a41002a09d
SHA256:e2a59ccffe107e83b355eb81dd8e9f3c82d0753c4b9a0e20bc64b0811d76795b
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

byte-buddy-1.12.20.jar

Description:

        Byte Buddy is a Java library for creating Java classes at run time.
        This artifact is a build of Byte Buddy with all ASM dependencies repackaged into its own name space.
    

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/net/bytebuddy/byte-buddy/1.12.20/byte-buddy-1.12.20.jar
MD5: a23f0b0ec5a590835f7bb6a10f5df42d
SHA1: 6ec3b8bccc4c988790d8cde5baad3b95609ef136
SHA256:0a9b2795e0e2391117062f0fc7f6ae98fa3c2a7c927847ff1e01bb7cffcd9167
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

byte-buddy-agent-1.12.16.jar

Description:

The Byte Buddy agent offers convenience for attaching an agent to the local or a remote VM.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/net/bytebuddy/byte-buddy-agent/1.12.16/byte-buddy-agent-1.12.16.jar
MD5: 9dd6d33539be0e5aa8a4004499eb33e3
SHA1: c2d5dd150c17028c494e7f02a17f4a995dcb4e9f
SHA256:38e258787665ac95e4f42ff1ca5b7550093762d289a61d436a26b6a25386358e
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

classmate-1.5.1.jar

Description:

Library for introspecting types with full generic information
        including resolving of field and method types.
    

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/fasterxml/classmate/1.5.1/classmate-1.5.1.jar
MD5: e91fcd30ba329fd1b0b6dc5321fd067c
SHA1: 3fe0bed568c62df5e89f4f174c101eab25345b6c
SHA256:aab4de3006808c09d25dd4ff4a3611cfb63c95463cfd99e73d2e1680d229a33b
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

h2-2.1.214.jar

Description:

H2 Database Engine

License:

MPL 2.0: https://www.mozilla.org/en-US/MPL/2.0/
EPL 1.0: https://opensource.org/licenses/eclipse-1.0.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar
MD5: 93628fb706e682dd989f697394039025
SHA1: d5c2005c9e3279201e12d4776c948578b16bf8b2
SHA256:d623cdc0f61d218cf549a8d09f1c391ff91096116b22e2475475fce4fbe72bd0
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2018-14335 (OSSINDEX)  

h2database - Improper Link Resolution Before File Access

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-59 Improper Link Resolution Before File Access ('Link Following')

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:L/AC:L/Au:/C:H/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:com.h2database:h2:2.1.214:*:*:*:*:*:*:*

CVE-2022-45868  

The web-based admin console in H2 Database Engine through 2.1.214 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Consequently, a local user (or an attacker that has obtained local access through some means) would be able to discover the password by listing processes and their arguments. NOTE: the vendor states "This is not a vulnerability of H2 Console ... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that."
CWE-312 Cleartext Storage of Sensitive Information

CVSSv3:
  • Base Score: HIGH (7.8)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

h2-2.1.214.jar: data.zip: table.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar/org/h2/util/data.zip/org/h2/server/web/res/table.js
MD5: 1c37e9e03787c821410ce684efa8feb7
SHA1: 3377bc4afb4fa0aeaa4fff9098ebb4446fa5be99
SHA256:07e1b3fc6feb8a8713b6659fc047cd9177d85b22f4bb0fa857be1c81786db701
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

  • None

h2-2.1.214.jar: data.zip: tree.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/h2database/h2/2.1.214/h2-2.1.214.jar/org/h2/util/data.zip/org/h2/server/web/res/tree.js
MD5: 4303428a5a49c1ae6c87a5dde9b4c9c3
SHA1: 9bca06117ddee5657dbe89eea197372128fe56e9
SHA256:1d5c4ba3b1a5dfcfe250fba716b55a9a7d0ffe624fc480713ff782c4d671836f
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

  • None

hamcrest-core-1.3.jar

Description:

    This is the core API of hamcrest matcher framework to be used by third-party framework providers. This includes the a foundation set of matcher implementations for common operations.
  

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
MD5: 6393363b47ddcbba82321110c3e07519
SHA1: 42a25dc3219429f0e5d060061f71acb49bf010a0
SHA256:66fdef91e9739348df7a096aa384a5685f4e875584cce89386a7a47251c4d8e9
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

hibernate-commons-annotations-5.1.2.Final.jar

Description:

Common reflection code used in support of annotation processing

License:

GNU Library General Public License v2.1 or later: http://www.opensource.org/licenses/LGPL-2.1
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/hibernate/common/hibernate-commons-annotations/5.1.2.Final/hibernate-commons-annotations-5.1.2.Final.jar
MD5: 2a2490b3eb8e7585a6a899d27d7ed43f
SHA1: e59ffdbc6ad09eeb33507b39ffcf287679a498c8
SHA256:1c7ce712b2679fea0a5441eb02a04144297125b768944819be0765befb996275
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

hibernate-core-5.6.14.Final.jar

Description:

Hibernate's core ORM functionality

License:

GNU Library General Public License v2.1 or later: https://www.opensource.org/licenses/LGPL-2.1
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/hibernate/hibernate-core/5.6.14.Final/hibernate-core-5.6.14.Final.jar
MD5: ec54e7703232f55bdf9e340309ef6556
SHA1: 71e407089b71ed7c6e99385fd851c308fed7be44
SHA256:eba7f97b5e6c382b235ca263cb55dad6efd482054dc090eaf6d44bc7d9690336
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

istack-commons-runtime-3.0.12.jar

Description:

istack common utility code

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/sun/istack/istack-commons-runtime/3.0.12/istack-commons-runtime-3.0.12.jar
MD5: 1952bd76321f8580cfaa57e332a68287
SHA1: cbbe1a62b0cc6c85972e99d52aaee350153dc530
SHA256:27d85fc134c9271d5c79d3300fc4669668f017e72409727c428f54f2417f04cd
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

it-tidalwave-messagebus-3.2-ALPHA-19.jar

Description:

        An abstract description of a simple message bus to be used within an application.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-messagebus/3.2-ALPHA-19/it-tidalwave-messagebus-3.2-ALPHA-19.jar
MD5: 23f61c245b7b763e8d20dbb5044435d1
SHA1: 305d8fab4eb44ba0ec7ea99671faf3c8be9d7d74
SHA256:b7d599ad7c5731d902868247aac8984ebb316277c9f384826192dc6219e7a161
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: MessageBus :: Spring:compile

Identifiers

it-tidalwave-role-3.2-ALPHA-19.jar

Description:

        Roles are a powerful way for designing complex behaviours while keeping good practices such as Single Responsibility, Dependency Inversion and
        Interface Segregation.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-role/3.2-ALPHA-19/it-tidalwave-role-3.2-ALPHA-19.jar
MD5: 51fad8e3ac7ff605e06bece409725e94
SHA1: f66260aaf15b9e358a57facddd93f7e2a8244d17
SHA256:e5c56c2045d45139ce00f906e5bc87e9a1c6e2d94b4f7f41c082ddf3cf4584eb
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

it-tidalwave-role-spring-3.2-ALPHA-19.jar

Description:

        Specific Spring support for DCI roles.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-role-spring/3.2-ALPHA-19/it-tidalwave-role-spring-3.2-ALPHA-19.jar
MD5: 8154ed3ce875de46383b381a71beec6a
SHA1: dfc2c997e489a344e9ecf4eeee3f2f0a0793bd5c
SHA256:219df1933a8d32de95911ae97999ba5a136c2398d0b9b8b9cd7b3528b7f6e5f8
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

it-tidalwave-thesefoolishthings-examples-data-3.2-ALPHA-19.jar

Description:

        This module provides sample data structures used by other examples.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-thesefoolishthings-examples-data/3.2-ALPHA-19/it-tidalwave-thesefoolishthings-examples-data-3.2-ALPHA-19.jar
MD5: 727c3fa3c18f90b5ee2a7c22cd10e31c
SHA1: fa047687b447500c2b8ad0ea9f675befc33365bc
SHA256:4cbf31b53b72d61830f6a49c78f208beb0cf23b9ce35b144ddb3c53eef54f27e
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

it-tidalwave-thesefoolishthings-examples-finderexample1-3.2-ALPHA-19.jar

Description:

        A simple example of Finder usage.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-thesefoolishthings-examples-finderexample1/3.2-ALPHA-19/it-tidalwave-thesefoolishthings-examples-finderexample1-3.2-ALPHA-19.jar
MD5: 1fa7bf529d6c6bf72e6ec6456dd23a1b
SHA1: 4b4f0b8be768768907825cc28efbd1d7e94d8484
SHA256:ece068bda93f4df8d0d5b9e777c036a3b31e1bc33496b537456bf6dfd1480721
Referenced In Project/Scope:TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile

Identifiers

it-tidalwave-util-3.2-ALPHA-19.jar

Description:

        A collection of common utilities.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-util/3.2-ALPHA-19/it-tidalwave-util-3.2-ALPHA-19.jar
MD5: 178f1750e74a342311d08fa760f59235
SHA1: 518f6bf67ee2acea060bef41d60db7d587875a6c
SHA256:1a11f019886dce06521d9b2d9d8a4201612096f43f7520246ef8769e25b83032
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

it-tidalwave-util-test-3.2-ALPHA-19.jar

Description:

        Miscellaneous utilities for testing.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-util-test/3.2-ALPHA-19/it-tidalwave-util-test-3.2-ALPHA-19.jar
MD5: f5f74d2ca5b835f041c25156c523f68f
SHA1: 6c9d2b86898afd84eb9dc942adbd0ef45b2f4cee
SHA256:17018d1e51232ef01d4f57cde7d1da1fd4dcd4f63dbb12c4b61724e4106fdab6
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jakarta.activation-1.2.2.jar

Description:

Jakarta Activation

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/sun/activation/jakarta.activation/1.2.2/jakarta.activation-1.2.2.jar
MD5: 0b8bee3bf29b9a015f8b992035581a7c
SHA1: 74548703f9851017ce2f556066659438019e7eb5
SHA256:02156773e4ae9d048d14a56ad35d644bee9f1052a791d072df3ded3c656e6e1a
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:runtime
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:runtime

Identifiers

jakarta.annotation-api-1.3.5.jar

Description:

Jakarta Annotations API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/jakarta/annotation/jakarta.annotation-api/1.3.5/jakarta.annotation-api-1.3.5.jar
MD5: 8b165cf58df5f8c2a222f637c0a07c97
SHA1: 59eb84ee0d616332ff44aba065f3888cf002cd2d
SHA256:85fb03fc054cdf4efca8efd9b6712bbb418e1ab98241c4539c8585bbc23e1b8a
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jakarta.inject-api-2.0.0.jar

Description:

Jakarta Dependency Injection

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/jakarta/inject/jakarta.inject-api/2.0.0/jakarta.inject-api-2.0.0.jar
MD5: 6dcba3a46ee8556a4d4312c1c2bd4d79
SHA1: 46fc8560b6fd17b78396d88f39c1a730457671f0
SHA256:842ccf3b892aca3fbd384c99d1516a8b7c448c55cee560ab2724488016198706
Referenced In Project/Scope:TheseFoolishThings :: Utilities:provided

Identifiers

jakarta.persistence-api-2.2.3.jar

Description:

Jakarta Persistence 2.2 API jar

License:

Eclipse Public License v. 2.0: http://www.eclipse.org/legal/epl-2.0
Eclipse Distribution License v. 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/jakarta/persistence/jakarta.persistence-api/2.2.3/jakarta.persistence-api-2.2.3.jar
MD5: e0a655f398f8e68e0afebb0f71fba4e5
SHA1: 8f6ea5daedc614f07a3654a455660145286f024e
SHA256:0c2d73ab36ad24eeed6e0bea928e9d0ef771de8df689e23b7754d366dda27c53
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jakarta.transaction-api-1.3.3.jar

Description:

Jakarta Transactions

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/jakarta/transaction/jakarta.transaction-api/1.3.3/jakarta.transaction-api-1.3.3.jar
MD5: cc45726045cc9a0728f803f9db4c90c4
SHA1: c4179d48720a1e87202115fbed6089bdc4195405
SHA256:0b02a194dd04ee2e192dc9da9579e10955dd6e8ac707adfc91d92f119b0e67ab
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jakarta.xml.bind-api-2.3.3.jar

Description:

Jakarta XML Binding API 2.3 Design Specification

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/jakarta/xml/bind/jakarta.xml.bind-api/2.3.3/jakarta.xml.bind-api-2.3.3.jar
MD5: 61286918ca0192e9f87d1358aef718dd
SHA1: 48e3b9cfc10752fba3521d6511f4165bea951801
SHA256:c04539f472e9a6dd0c7685ea82d677282269ab8e7baca2e14500e381e0c6cec5
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jandex-2.4.2.Final.jar

Description:

Parent POM for JBoss projects. Provides default project build configuration.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/jboss/jandex/2.4.2.Final/jandex-2.4.2.Final.jar
MD5: 489f7a97d2ed7ae34ea56d01b3566d57
SHA1: 1e1c385990b258ff1a24c801e84aebbacf70eb39
SHA256:3f2ce55c7d71e744581488dc5105806aa8084c08e6e916a019bab8f8698994f0
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

java-diff-utils-4.12.jar

Description:

The DiffUtils library for computing diffs, applying patches, generationg side-by-side view in Java.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/io/github/java-diff-utils/java-diff-utils/4.12/java-diff-utils-4.12.jar
MD5: 2bab3395dcfe2ea5b092ad646ca899d3
SHA1: 1a712a91324d566eef39817fc5c9980eb10c21db
SHA256:9990a2039778f6b4cc94790141c2868864eacee0620c6c459451121a901cd5b5
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

CVE-2021-4277  

A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is dbab1b66955eeb3d76b34612b358307f5c4e3944. It is recommended to apply a patch to fix this issue. The identifier VDB-216749 was assigned to this vulnerability.
CWE-330 Use of Insufficiently Random Values

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Vulnerable Software & Versions:

javax.activation-api-1.2.0.jar

Description:

JavaBeans Activation Framework API jar

License:

https://github.com/javaee/activation/blob/master/LICENSE.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/activation/javax.activation-api/1.2.0/javax.activation-api-1.2.0.jar
MD5: 5e50e56bcf4a3ef3bc758f69f7643c3b
SHA1: 85262acf3ca9816f9537ca47d5adeabaead7cb16
SHA256:43fdef0b5b6ceb31b0424b208b930c74ab58fac2ceeb7b3f6fd3aeb8b5ca4393
Referenced In Project/Scope:TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile

Identifiers

javax.annotation-api-1.3.2.jar

Description:

Common Annotations for the JavaTM Platform API

License:

CDDL + GPLv2 with classpath exception: https://github.com/javaee/javax.annotation/blob/master/LICENSE
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/annotation/javax.annotation-api/1.3.2/javax.annotation-api-1.3.2.jar
MD5: 2ab1973eefffaa2aeec47d50b9e40b9d
SHA1: 934c04d3cfef185a8008e7bf34331b79730a9d43
SHA256:e04ba5195bcd555dc95650f7cc614d151e4bcd52d29a10b8aa2197f3ab89ab9b
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings (modules):compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: MessageBus:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Utilities:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

javax.inject-1.jar

Description:

The javax.inject API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
SHA256:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Utilities:provided
  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

javax.persistence-api-2.2.jar

Description:

Java(TM) Persistence API

License:

Eclipse Public License v1.0: http://www.eclipse.org/legal/epl-v10.html
Eclipse Distribution License v. 1.0: http://www.eclipse.org/org/documents/edl-v10.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/persistence/javax.persistence-api/2.2/javax.persistence-api-2.2.jar
MD5: e6520b3435f5b6d58eee415b5542abf8
SHA1: 25665ac8c0b62f50e6488173233239120fc52c96
SHA256:5578b71b37999a5eaed3fea0d14aa61c60c6ec6328256f2b63472f336318baf4
Referenced In Project/Scope:TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile

Identifiers

jaxb-api-2.3.1.jar

Description:

JAXB (JSR 222) API

License:

https://oss.oracle.com/licenses/CDDL+GPL-1.1, https://oss.oracle.com/licenses/CDDL+GPL-1.1
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/xml/bind/jaxb-api/2.3.1/jaxb-api-2.3.1.jar
MD5: bcf270d320f645ad19f5edb60091e87f
SHA1: 8531ad5ac454cc2deb9d4d32c40c4d7451939b5d
SHA256:88b955a0df57880a26a74708bc34f74dcaf8ebf4e78843a28b50eae945732b06
Referenced In Project/Scope:TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile

Identifiers

jaxb-runtime-2.3.7.jar

Description:

JAXB (JSR 222) Reference Implementation

License:

http://www.eclipse.org/org/documents/edl-v10.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/glassfish/jaxb/jaxb-runtime/2.3.7/jaxb-runtime-2.3.7.jar
MD5: 4fb00614ad222cfdfc2204ceae827fb5
SHA1: ebcde6a44159eb9e3db721dfe6b45f26e6272341
SHA256:c048d9edde5d5d67bca4f66921ef1315b8e20b1a978b757d54cea0ea5ce1c907
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jboss-logging-3.4.3.Final.jar

Description:

The JBoss Logging Framework

License:

Apache License, version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/jboss/logging/jboss-logging/3.4.3.Final/jboss-logging-3.4.3.Final.jar
MD5: b298d4b79e591843c1eb1458ea79f070
SHA1: c4bd7e12a745c0e7f6cf98c45cdcdf482fd827ea
SHA256:0b324cca4d550060e51e70cc0045a6cce62f264278ec1f5082aafeb670fcac49
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jboss-transaction-api_1.2_spec-1.1.1.Final.jar

Description:

The Java Transaction 1.2 API classes

License:

Common Development and Distribution License: http://repository.jboss.org/licenses/cddl.txt
GNU General Public License, Version 2 with the Classpath Exception: http://repository.jboss.org/licenses/gpl-2.0-ce.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/jboss/spec/javax/transaction/jboss-transaction-api_1.2_spec/1.1.1.Final/jboss-transaction-api_1.2_spec-1.1.1.Final.jar
MD5: 1e633c47138aba999d39692a31a1a124
SHA1: a8485cab9484dda36e9a8c319e76b5cc18797b58
SHA256:a310a50b9bdc44aaf36362dc9bb212235a147ffa8ef72dc9544a39c329eabbc3
Referenced In Project/Scope:TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile

Identifiers

jcl-over-slf4j-2.0.6.jar

Description:

JCL 1.2 implemented over SLF4J

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/slf4j/jcl-over-slf4j/2.0.6/jcl-over-slf4j-2.0.6.jar
MD5: 39ab1cc1376b4c2d1ba706a98cca83de
SHA1: 839ff57e112f2e28ef372e96d135696a6896b9ad
SHA256:7aee1e1a12f4e2b3b42af9453a098132339d419056c178105543f23e79633a69
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

jcommander-1.82.jar

Description:

Command line parsing library for Java

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/beust/jcommander/1.82/jcommander-1.82.jar
MD5: c350dc0db8aa038e6bbaf0050720d69c
SHA1: 0a7c5fef184d238065de38f81bbc6ee50cca2e21
SHA256:deeac157c8de6822878d85d0c7bc8467a19cc8484d37788f7804f039dde280b1
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

jquery-3.6.1.jar

Description:

WebJar for jQuery

License:

MIT License: https://github.com/jquery/jquery/blob/master/MIT-LICENSE.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/webjars/jquery/3.6.1/jquery-3.6.1.jar
MD5: da81e8f13bfc953d51a79fc035efe721
SHA1: d08df6250157cd2db3d9b01b11b76e9b7225083a
SHA256:da2381fbee4799631ba44d1f4d6487b886b22450c7fc85842c5fdfa03429b817
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

jquery-3.6.1.jar: jquery.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/webjars/jquery/3.6.1/jquery-3.6.1.jar/META-INF/resources/webjars/jquery/3.6.1/jquery.js
MD5: 7e26506326a182c4175e54acda7ef15e
SHA1: 01ee1a965e756292430031c46f258d6e2d3a961d
SHA256:df3941e6cdaec28533ad72b7053ec05f7172be88ecada345c42736bc2ffba4d2
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

  • None

jquery-3.6.1.jar: jquery.min.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/webjars/jquery/3.6.1/jquery-3.6.1.jar/META-INF/resources/webjars/jquery/3.6.1/jquery.min.js
MD5: 00727d1d5d9c90f7de826f1a4a9cc632
SHA1: ea61688671d0c3044f2c5b2f2c4af0a6620ac6c2
SHA256:a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

  • None

jquery-3.6.1.jar: jquery.slim.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/webjars/jquery/3.6.1/jquery-3.6.1.jar/META-INF/resources/webjars/jquery/3.6.1/jquery.slim.js
MD5: 047263837daa9552f4cf919d22be3b3d
SHA1: 78b5bad67fe75cce3842287ffd497b1f8e3ad89c
SHA256:b579beb1ad6ecec6c59db5edf0626ab208b64f0fa6e012c60e87fa7943e36ed9
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

  • None

jquery-3.6.1.jar: jquery.slim.min.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/webjars/jquery/3.6.1/jquery-3.6.1.jar/META-INF/resources/webjars/jquery/3.6.1/jquery.slim.min.js
MD5: 6bb2d76bc531993f8368cef389e88b04
SHA1: 50504dd95e37488eb9871bee661c588f84e04c9c
SHA256:c3c0af845b3b88735552d9d23f460a120d34a7d221d77ae52fdcc6aaf2dd78f0
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

  • None

jquery-3.6.1.jar: webjars-requirejs.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/webjars/jquery/3.6.1/jquery-3.6.1.jar/META-INF/resources/webjars/jquery/3.6.1/webjars-requirejs.js
MD5: 30e1a7f167b667001f50e32ea87bf7b5
SHA1: d18dc733350ad3549af2df096599e824c10f777e
SHA256:daca7b23bc4d8302a8961373b92b78d36d5c85d730fc14130e29d55d976aa420
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

  • None

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings (modules):compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: MessageBus:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Utilities:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

jul-to-slf4j-2.0.6.jar

Description:

JUL to SLF4J bridge

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/slf4j/jul-to-slf4j/2.0.6/jul-to-slf4j-2.0.6.jar
MD5: 5a22f4776707e517ff1da17a98b3918c
SHA1: c4d348977a83a0bfcf42fd6fd1fee6e7904f1a0c
SHA256:6466a327c5ac59fc41c98437e248b9052a4fad6fae9f83a7f723eae297990017
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

junit-4.12.jar

Description:

JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.

License:

Eclipse Public License 1.0: http://www.eclipse.org/legal/epl-v10.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/junit/junit/4.12/junit-4.12.jar
MD5: 5b38c40c97fbd0adee29f91e60405584
SHA1: 2973d150c0dc1fefe998f834810d68f278ea58ec
SHA256:59721f0805e223d84b90677887d9ff567dc534d7c502ca903c0c2b17f05c116a
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

CVE-2020-15250 (OSSINDEX)  

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.
CWE-732 Incorrect Permission Assignment for Critical Resource

CVSSv2:
  • Base Score: MEDIUM (5.5)
  • Vector: /AV:L/AC:L/Au:/C:H/I:N/A:N

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:junit:junit:4.12:*:*:*:*:*:*:*

log4j-api-2.17.2.jar

Description:

The Apache Log4j API

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/apache/logging/log4j/log4j-api/2.17.2/log4j-api-2.17.2.jar
MD5: 0c39d90e7819c92c111e447bdf786a90
SHA1: f42d6afa111b4dec5d2aea0fe2197240749a4ea6
SHA256:09351b5a03828f369cdcff76f4ed39e6a6fc20f24f046935d0b28ef5152f8ce4
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

logback-core-1.4.5.jar

Description:

logback-core module

License:

http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/ch/qos/logback/logback-core/1.4.5/logback-core-1.4.5.jar
MD5: baf749c68aacc6d719f3ce3d7345af38
SHA1: e9bb2ea70f84401314da4300343b0a246c8954da
SHA256:8604e7c327556b097590701fba88dae84c581167f2746378f736b37269452380
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:runtime
  • TheseFoolishThings :: Examples :: DCI :: Swing:runtime
  • TheseFoolishThings :: Examples :: Data:runtime
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:runtime
  • TheseFoolishThings :: Examples :: DCI :: Displayable:runtime
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:runtime
  • TheseFoolishThings :: Examples (master):runtime
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:runtime
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:runtime

Identifiers

lombok-1.18.24.jar

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar
MD5: a1651eaa9c999c61131d32feab16fcde
SHA1: 13a394eed5c4f9efb2a6d956e2086f1d81e857d9
SHA256:d3584bc2db03f059f984fb0a9c119aac1fa0da578a448e69fc3f68b36584c749
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Roles:provided
  • TheseFoolishThings :: MessageBus:provided
  • TheseFoolishThings :: Examples :: DCI :: Swing:provided
  • TheseFoolishThings :: Test Utilities:provided
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:provided
  • TheseFoolishThings :: MessageBus :: Spring:provided
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:provided
  • TheseFoolishThings :: Roles :: Spring:provided
  • TheseFoolishThings :: Examples (master):provided
  • TheseFoolishThings :: Examples :: Data:provided
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:provided
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:provided
  • TheseFoolishThings (modules):provided
  • TheseFoolishThings :: Utilities:provided
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:provided
  • TheseFoolishThings :: Examples :: DCI :: Displayable:provided
  • TheseFoolishThings :: Actors:provided

Identifiers

lombok-1.18.24.jar: mavenEcjBootstrapAgent.jar

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar/lombok/launch/mavenEcjBootstrapAgent.jar
MD5: 7196a24381121bf3a7c93dcdd5575fff
SHA1: 3cfed1579d718ac3dcf78bceba9ed668eb025bee
SHA256:d034830e1d8615a9d0e4afdaee693687c6e61e041cc905608bba60efb04744d6
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Roles:provided
  • TheseFoolishThings :: MessageBus:provided
  • TheseFoolishThings :: Examples :: DCI :: Swing:provided
  • TheseFoolishThings :: Test Utilities:provided
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:provided
  • TheseFoolishThings :: MessageBus :: Spring:provided
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:provided
  • TheseFoolishThings :: Roles :: Spring:provided
  • TheseFoolishThings :: Examples (master):provided
  • TheseFoolishThings :: Examples :: Data:provided
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:provided
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:provided
  • TheseFoolishThings (modules):provided
  • TheseFoolishThings :: Utilities:provided
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:provided
  • TheseFoolishThings :: Examples :: DCI :: Displayable:provided
  • TheseFoolishThings :: Actors:provided

Identifiers

  • None

mockito-core-4.8.1.jar

Description:

Mockito mock objects library core API and implementation

License:

The MIT License: https://github.com/mockito/mockito/blob/main/LICENSE
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/mockito/mockito-core/4.8.1/mockito-core-4.8.1.jar
MD5: 98a99e5f8fae1dcfb107b09f9d97eb30
SHA1: d8eb9dec8747d08645347bb8c69088ac83197975
SHA256:1327bd8e0fab61be72d2cbe8b7b72f789f88644c9d5da5be23f9ec2a47c476ce
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

mxparser-1.2.2.jar

Description:

    MXParser is a fork of xpp3_min 1.1.7 containing only the parser with merged changes of the Plexus fork.
  

License:

Indiana University Extreme! Lab Software License: https://raw.githubusercontent.com/x-stream/mxparser/master/LICENSE.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/io/github/x-stream/mxparser/1.2.2/mxparser-1.2.2.jar
MD5: 9d7e42409dfdcee9bd17903015bdeae2
SHA1: 476fb3b3bb3716cad797cd054ce45f89445794e9
SHA256:aeeee23a3303d811bca8790ea7f25b534314861c03cff36dafdcc2180969eb97
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

CVE-2013-7285  

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2016-3674  

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
CWE-200 Information Exposure

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2017-7957  

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
CWE-20 Improper Input Validation

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2020-26217  

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv2:
  • Base Score: HIGH (9.3)
  • Vector: /AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSSv3:
  • Base Score: HIGH (8.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-26258  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CWE-918 Server-Side Request Forgery (SSRF)

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.7)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References:

Vulnerable Software & Versions:

CVE-2020-26259  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv2:
  • Base Score: MEDIUM (6.4)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:P
CVSSv3:
  • Base Score: MEDIUM (6.8)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

References:

Vulnerable Software & Versions:

CVE-2021-21341  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion'), CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.1)
  • Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:C
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21342  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-502 Deserialization of Untrusted Data, CWE-918 Server-Side Request Forgery (SSRF)

CVSSv2:
  • Base Score: MEDIUM (5.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21343  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-502 Deserialization of Untrusted Data, CWE-73 External Control of File Name or Path

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21344  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21345  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv2:
  • Base Score: MEDIUM (6.5)
  • Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.9)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21346  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21347  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21348  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv2:
  • Base Score: HIGH (7.8)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21349  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-502 Deserialization of Untrusted Data, CWE-918 Server-Side Request Forgery (SSRF)

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (8.6)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21350  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-21351  

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.5)
  • Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-29505  

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
CWE-502 Deserialization of Untrusted Data, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: MEDIUM (6.5)
  • Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39139  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.5)
  • Vector: /AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39140  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-502 Deserialization of Untrusted Data, CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv2:
  • Base Score: MEDIUM (6.3)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:C
CVSSv3:
  • Base Score: MEDIUM (6.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39141  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39144  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-502 Deserialization of Untrusted Data, CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39145  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39146  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39147  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39148  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39149  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39150  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
CWE-502 Deserialization of Untrusted Data, CWE-918 Server-Side Request Forgery (SSRF)

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39151  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39152  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
CWE-502 Deserialization of Untrusted Data, CWE-918 Server-Side Request Forgery (SSRF)

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39153  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-39154  

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CWE-434 Unrestricted Upload of File with Dangerous Type, CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: MEDIUM (6.0)
  • Vector: /AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSSv3:
  • Base Score: HIGH (8.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2021-43859  

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-40151  

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-40152  

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-40153  

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-41966  

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
CWE-502 Deserialization of Untrusted Data, CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), CWE-121 Stack-based Buffer Overflow

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

objenesis-3.2.jar

Description:

A library for instantiating Java objects

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/objenesis/objenesis/3.2/objenesis-3.2.jar
MD5: 5c1ee20481a06561af295034ea89c4b4
SHA1: 7fadf57620c8b8abdf7519533e5527367cb51f09
SHA256:03d960bd5aef03c653eb000413ada15eb77cdd2b8e4448886edf5692805e35f3
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:runtime

Identifiers

slf4j-api-2.0.6.jar

Description:

The slf4j API

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/slf4j/slf4j-api/2.0.6/slf4j-api-2.0.6.jar
MD5: 0dd65c386e8c5f4e6e014de3f7a7ae60
SHA1: 88c40d8b4f33326f19a7d3c0aaf2c7e8721d4953
SHA256:2f2a92d410b268139d7d63b75ed25e21995cfe4100c19bf23577cfdbc8077bda
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: MessageBus:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Utilities:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

snakeyaml-1.30.jar

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar
MD5: ba063b8ef3a8bfd591a1b56451166b14
SHA1: 8fde7fe2586328ac3c68db92045e1c8759125000
SHA256:f43a4e40a946b8cdfd0321bc1c9a839bc3f119c57e4ca84fb87c367f51c8b2b3
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2021-4235  

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-1471  

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.
CWE-502 Deserialization of Untrusted Data

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2022-25857  

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-3064  

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38749  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38750  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38751  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-38752  

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

CVE-2022-41854  

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions:

spotbugs-annotations-3.1.9.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/github/spotbugs/spotbugs-annotations/3.1.9/spotbugs-annotations-3.1.9.jar
MD5: 56a1a81d69b6a111161bbce0e6dea26a
SHA1: 2ef5127efcc1a899aab8c66d449a631c9a99c469
SHA256:68c7c46b4299e94837e236ae742f399901a950fe910fe3ca710026753b5dd2e1
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings (modules):compile
  • TheseFoolishThings :: Roles:compile
  • TheseFoolishThings :: Actors:compile
  • TheseFoolishThings :: Examples (master):compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: MessageBus:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: Data:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile
  • TheseFoolishThings :: Examples :: Finder :: In-memory Finder:compile
  • TheseFoolishThings :: Utilities:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Examples :: Finder :: Extended Finder:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

spring-boot-2.7.7.jar

Description:

Spring Boot

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/boot/spring-boot/2.7.7/spring-boot-2.7.7.jar
MD5: 75e5a70f351a7b64d9e7af866bfe75a9
SHA1: 1fa59eb2fce0363bdf152d7660b784257bfac99b
SHA256:57cb88b88ff9b8b75fa65f1d85a209065e75fe1e28e4403c165633f16579dfb7
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2013-4152  

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-7315  

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0054  

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2016-1000027  

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2018-11039  

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11040  

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-1257  

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-5421  

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: LOW (3.6)
  • Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22965  

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

spring-core-5.3.24.jar

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-core/5.3.24/spring-core-5.3.24.jar
MD5: c5a7205d5d58105713aa9f033ae01dd9
SHA1: d095c329f30baf2b6d44eccbd2352d7a2f840c72
SHA256:7d513957395e6a354b80e714b31a52b765dd6c771b50a26419d277a06d13ea68
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2016-1000027  

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2023-20860  

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

spring-data-commons-2.7.6.jar

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/data/spring-data-commons/2.7.6/spring-data-commons-2.7.6.jar
MD5: f17351668836c0395932bb5539abf9cf
SHA1: e3d15a8f4d5ef0d2323569445c66903d0188cb68
SHA256:8903f08719c8a220fbbb502ebad23c7f5694ad382493e3ce0e7fcf6bedaccae1
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2013-4152  

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-7315  

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0054  

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2016-1000027  

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2018-11039  

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11040  

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-1257  

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-5421  

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: LOW (3.6)
  • Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22965  

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

spring-data-jpa-2.7.6.jar

Description:

Spring Data module for JPA repositories.

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/data/spring-data-jpa/2.7.6/spring-data-jpa-2.7.6.jar
MD5: f5a576a6fe2ddde2b2db47e9b437695d
SHA1: 8d0414f5cca5e31509943cd5f97cacdddd7c7384
SHA256:40b5de0a77874250ef906a0cd5ab2607e9e8412c12b6c6df4c2a4c0f6814e2db
Referenced In Project/Scope:TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2013-4152  

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2013-7315  

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2014-0054  

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2016-1000027  

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2018-11039  

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-11040  

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

CVSSv2:
  • Base Score: MEDIUM (4.3)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2018-1257  

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2020-5421  

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: LOW (3.6)
  • Vector: /AV:N/AC:H/Au:S/C:P/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22965  

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

spring-expression-5.3.24.jar

Description:

Spring Expression Language (SpEL)

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-expression/5.3.24/spring-expression-5.3.24.jar
MD5: b4a867204a73ba1450c463bc0a45d9b8
SHA1: ae7410418e7b4bd27a01e3fb1c2fed35b2bc1e84
SHA256:05b0117e9bfb269a1803f08020787591930a8c79ec0363e5081a1df8ebe26c7b
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Swing:compile
  • TheseFoolishThings :: Roles :: Spring:compile
  • TheseFoolishThings :: MessageBus :: Spring:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile
  • TheseFoolishThings :: Test Utilities:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

CVE-2016-1000027  

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions:

CVE-2023-20860  

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20863 (OSSINDEX)  

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.springframework:spring-expression:5.3.24:*:*:*:*:*:*:*

testng-7.7.1.jar

Description:

Testing framework for Java

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/testng/testng/7.7.1/testng-7.7.1.jar
MD5: 1fc551f029944108de5026b097622598
SHA1: 8e96c60d4967a8df6dc06c3c7cf22392e3a51794
SHA256:9f6901a112a692efd05654a8b924927aeaf35c7f1a7b2f18955a2f5160064cae
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

testng-7.7.1.jar: jquery-3.6.0.min.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/testng/testng/7.7.1/testng-7.7.1.jar/org/testng/jquery-3.6.0.min.js
MD5: 8fb8fee4fcc3cc86ff6c724154c49c42
SHA1: b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
SHA256:ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

  • None

testng-7.7.1.jar: testng-reports.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/testng/testng/7.7.1/testng-7.7.1.jar/org/testng/testng-reports.js
MD5: e18bdeef11d95e4802ca1e74ce8f4813
SHA1: 8e530ffd7c6528b0a47b4405b241181c09ed3534
SHA256:88d2a0988765ed96e51e5b0c5c63d6b9d25169a12d3c49003c2e87d98d0bdee2
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

  • None

testng-7.7.1.jar: testng-reports2.js

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/testng/testng/7.7.1/testng-7.7.1.jar/org/testng/testng-reports2.js
MD5: b45815e612fdfbeeffd1909e6551c84d
SHA1: 99dc7548ca6d9add4cc8d1022f392ccac385583b
SHA256:0cd0609bd983faf69e9eec6091de6a6e45400292a4f182fb9aa35a12acb7e852
Referenced In Project/Scope:TheseFoolishThings :: Test Utilities:compile

Identifiers

  • None

txw2-2.3.7.jar

Description:

        TXW is a library that allows you to write XML documents.
    

File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/glassfish/jaxb/txw2/2.3.7/txw2-2.3.7.jar
MD5: d7d7c63bc636c072394334c85cb6d49f
SHA1: 55cddcac1945150e09b09b0f89d86799652eee82
SHA256:4a52d7c42a7e6270c8d72554eb994059f53d69c2545fb2daa02c6e9bfbda8b22
Referenced In Projects/Scopes:

  • TheseFoolishThings :: Examples :: Finder :: JPA Finder:compile
  • TheseFoolishThings :: Examples :: DCI :: Persistence JPA:compile

Identifiers

xmlpull-1.1.3.1.jar

License:

Public Domain: http://www.xmlpull.org/v1/download/unpacked/LICENSE.txt
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/xmlpull/xmlpull/1.1.3.1/xmlpull-1.1.3.1.jar
MD5: cc57dacc720eca721a50e78934b822d2
SHA1: 2b8e230d2ab644e4ecaa94db7cdedbc40c805dfa
SHA256:34e08ee62116071cbb69c0ed70d15a7a5b208d62798c59f2120bb8929324cb63
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers

xstream-1.4.20.jar

Description:

XStream is a serialization library from Java objects to XML and back.

License:

BSD-3-Clause
File Path: /Volumes/Users/fritz/LocalData/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/thoughtworks/xstream/xstream/1.4.20/xstream-1.4.20.jar
MD5: 1e816f33b1eb780a309789478051faeb
SHA1: 0e2315b8b2e95e9f21697833c8e56cdd9c98a5ee
SHA256:87df0f0be57c92037d0110fbb225a30b651702dc275653d285afcfef31bc2e81
Referenced In Projects/Scopes:
  • TheseFoolishThings :: Examples :: DCI :: Marshal XStream:compile
  • TheseFoolishThings :: Examples :: DCI :: Displayable:compile

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the NPM Public Advisories.
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.