Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
Scan Information (
show all ):
dependency-check version : 12.1.8Report Generated On : Thu, 30 Oct 2025 10:12:03 GMTDependencies Scanned : 62 (22 unique)Vulnerable Dependencies : 4 Vulnerabilities Found : 12Vulnerabilities Suppressed : 0 ... NVD API Last Checked : 2025-10-30T10:11:54ZNVD API Last Modified : 2025-10-30T08:15:32ZSummary Summary of Vulnerable Dependencies (click to show all)
Description:
The bit array data structure is implemented in Java as the BitSet class. Unfortunately, this fails to scale without compression.
JavaEWAH is a word-aligned compressed variant of the Java bitset class. It uses a 64-bit run-length encoding (RLE) compression scheme.
The goal of word-aligned compression is not to achieve the best compression, but rather to improve query processing time. Hence, we try to save CPU cycles, maybe at the expense of storage. However, the EWAH scheme we implemented is always more efficient storage-wise than an uncompressed bitmap (implemented in Java as the BitSet class). Unlike some alternatives, javaewah does not rely on a patented scheme. License:
Apache 2: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/com/googlecode/javaewah/JavaEWAH/1.1.13/JavaEWAH-1.1.13.jar
MD5: a1eb305e5cc5bba238d4360e3139abb4
SHA1: 32cd724a42dc73f99ca08453d11a4bb83e0034c7
SHA256: 4c0fda2b1d317750d7ea324e36c70b2bc48310c0aaae67b98df0915d696d7111
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
JavaEWAH-1.1.13.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-provider-jgit@2.2.1
Evidence Type Source Name Value Confidence Vendor file name JavaEWAH High Vendor jar package name bitset Highest Vendor jar package name googlecode Highest Vendor jar package name javaewah Highest Vendor Manifest bundle-symbolicname com.googlecode.javaewah.JavaEWAH Medium Vendor pom artifactid JavaEWAH Highest Vendor pom artifactid JavaEWAH Low Vendor pom developer email lemire@gmail.com Low Vendor pom developer id lemire Medium Vendor pom developer name Daniel Lemire Medium Vendor pom developer org LICEF Research Center Medium Vendor pom developer org URL http://licef.ca Medium Vendor pom groupid com.googlecode.javaewah Highest Vendor pom name JavaEWAH High Vendor pom url lemire/javaewah Highest Product file name JavaEWAH High Product jar package name bitset Highest Product jar package name googlecode Highest Product jar package name javaewah Highest Product Manifest Bundle-Name JavaEWAH Medium Product Manifest bundle-symbolicname com.googlecode.javaewah.JavaEWAH Medium Product pom artifactid JavaEWAH Highest Product pom developer email lemire@gmail.com Low Product pom developer id lemire Low Product pom developer name Daniel Lemire Low Product pom developer org LICEF Research Center Low Product pom developer org URL http://licef.ca Low Product pom groupid com.googlecode.javaewah Highest Product pom name JavaEWAH High Product pom url lemire/javaewah High Version file version 1.1.13 High Version Manifest Bundle-Version 1.1.13 High Version pom version 1.1.13 Highest
pkg:maven/com.googlecode.javaewah/JavaEWAH@1.1.13 (Confidence :High) File Path: /home/runner/.m2/repository/org/ow2/asm/asm-all/5.0.1/asm-all-5.0.1.jarMD5: 279e80742ddff574fbc87244eb5c9d54SHA1: 2f7553f50b0d14ed811b849c282da8c1ffc32aaeSHA256: 94ecde163b4ca3a42425cd830c79197f22d0d1336d471ced6a8a83b07acbf7c8Referenced In Project/Scope: Close Editor Tabs Left and Right:compileasm-all-5.0.1.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name asm-all High Vendor jar package name asm Highest Vendor jar package name objectweb Highest Vendor Manifest bundle-docurl http://asm.objectweb.org Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.3 Low Vendor Manifest bundle-symbolicname org.objectweb.asm.all Medium Vendor Manifest Implementation-Vendor France Telecom R&D High Vendor pom artifactid asm-all Highest Vendor pom artifactid asm-all Low Vendor pom groupid org.ow2.asm Highest Vendor pom name ASM All High Vendor pom parent-artifactid asm-parent Low Product file name asm-all High Product jar package name asm Highest Product jar package name objectweb Highest Product Manifest bundle-docurl http://asm.objectweb.org Low Product Manifest Bundle-Name ASM all classes with debug info Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.3 Low Product Manifest bundle-symbolicname org.objectweb.asm.all Medium Product Manifest Implementation-Title ASM all classes High Product pom artifactid asm-all Highest Product pom groupid org.ow2.asm Highest Product pom name ASM All High Product pom parent-artifactid asm-parent Medium Version file version 5.0.1 High Version Manifest Bundle-Version 5.0.1 High Version Manifest Implementation-Version 5.0.1 High Version pom version 5.0.1 Highest
pkg:maven/org.ow2.asm/asm-all@5.0.1 (Confidence :High) Description:
The Apache Commons IO library contains utility classes, stream implementations, file filters,
file comparators, endian transformation classes, and much more.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar
MD5: 94e7e6b9b5fe82388687b584d3571081
SHA1: 36f3474daec2849c149e877614e7f979b2082cd2
SHA256: df90bba0fe3cb586b7f164e78fe8f8f4da3f2dd5c27fa645f888100ccc25dd72
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
commons-io-2.20.0.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-provider-gitexe@2.2.1
Evidence Type Source Name Value Confidence Vendor file name commons-io High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name file Highest Vendor jar package name io Highest Vendor Manifest automatic-module-name org.apache.commons.io Medium Vendor Manifest build-jdk-spec 21 Low Vendor Manifest bundle-docurl https://commons.apache.org/proper/commons-io/ Low Vendor Manifest bundle-symbolicname org.apache.commons.commons-io Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest multi-release true Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-io Highest Vendor pom artifactid commons-io Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email dion@apache.org Low Vendor pom developer email ggregory at apache.org Low Vendor pom developer email jeremias@apache.org Low Vendor pom developer email jochen.wiedmann@gmail.com Low Vendor pom developer email krosenvold@apache.org Low Vendor pom developer email martinc@apache.org Low Vendor pom developer email matth@apache.org Low Vendor pom developer email nicolaken@apache.org Low Vendor pom developer email roxspring@apache.org Low Vendor pom developer email sanders@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id dion Medium Vendor pom developer id ggregory Medium Vendor pom developer id jeremias Medium Vendor pom developer id jochen Medium Vendor pom developer id jukka Medium Vendor pom developer id krosenvold Medium Vendor pom developer id martinc Medium Vendor pom developer id matth Medium Vendor pom developer id niallp Medium Vendor pom developer id nicolaken Medium Vendor pom developer id roxspring Medium Vendor pom developer id sanders Medium Vendor pom developer id scolebourne Medium Vendor pom developer name dIon Gillard Medium Vendor pom developer name Gary Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name Jeremias Maerki Medium Vendor pom developer name Jochen Wiedmann Medium Vendor pom developer name Jukka Zitting Medium Vendor pom developer name Kristian Rosenvold Medium Vendor pom developer name Martin Cooper Medium Vendor pom developer name Matthew Hawthorne Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Nicola Ken Barozzi Medium Vendor pom developer name Rob Oxspring Medium Vendor pom developer name Scott Sanders Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom developer org The Apache Software Foundation Medium Vendor pom developer org URL https://www.apache.org/ Medium Vendor pom groupid commons-io Highest Vendor pom name Apache Commons IO High Vendor pom parent-artifactid commons-parent Low Vendor pom parent-groupid org.apache.commons Medium Vendor pom url https://commons.apache.org/proper/commons-io/ Highest Product file name commons-io High Product jar package name apache Highest Product jar package name commons Highest Product jar package name file Highest Product jar package name io Highest Product Manifest automatic-module-name org.apache.commons.io Medium Product Manifest build-jdk-spec 21 Low Product Manifest bundle-docurl https://commons.apache.org/proper/commons-io/ Low Product Manifest Bundle-Name Apache Commons IO Medium Product Manifest bundle-symbolicname org.apache.commons.commons-io Medium Product Manifest Implementation-Title Apache Commons IO High Product Manifest multi-release true Low Product Manifest specification-title Apache Commons IO Medium Product pom artifactid commons-io Highest Product pom developer email bayard@apache.org Low Product pom developer email dion@apache.org Low Product pom developer email ggregory at apache.org Low Product pom developer email jeremias@apache.org Low Product pom developer email jochen.wiedmann@gmail.com Low Product pom developer email krosenvold@apache.org Low Product pom developer email martinc@apache.org Low Product pom developer email matth@apache.org Low Product pom developer email nicolaken@apache.org Low Product pom developer email roxspring@apache.org Low Product pom developer email sanders@apache.org Low Product pom developer id bayard Low Product pom developer id dion Low Product pom developer id ggregory Low Product pom developer id jeremias Low Product pom developer id jochen Low Product pom developer id jukka Low Product pom developer id krosenvold Low Product pom developer id martinc Low Product pom developer id matth Low Product pom developer id niallp Low Product pom developer id nicolaken Low Product pom developer id roxspring Low Product pom developer id sanders Low Product pom developer id scolebourne Low Product pom developer name dIon Gillard Low Product pom developer name Gary Gregory Low Product pom developer name Henri Yandell Low Product pom developer name Jeremias Maerki Low Product pom developer name Jochen Wiedmann Low Product pom developer name Jukka Zitting Low Product pom developer name Kristian Rosenvold Low Product pom developer name Martin Cooper Low Product pom developer name Matthew Hawthorne Low Product pom developer name Niall Pemberton Low Product pom developer name Nicola Ken Barozzi Low Product pom developer name Rob Oxspring Low Product pom developer name Scott Sanders Low Product pom developer name Stephen Colebourne Low Product pom developer org The Apache Software Foundation Low Product pom developer org URL https://www.apache.org/ Low Product pom groupid commons-io Highest Product pom name Apache Commons IO High Product pom parent-artifactid commons-parent Medium Product pom parent-groupid org.apache.commons Medium Product pom url https://commons.apache.org/proper/commons-io/ Medium Version file version 2.20.0 High Version Manifest Bundle-Version 2.20.0 High Version Manifest Implementation-Version 2.20.0 High Version pom parent-version 2.20.0 Low Version pom version 2.20.0 Highest
Description:
Apache Commons Lang, a package of Java utility classes for the
classes that are in java.lang's hierarchy, or are considered to be so
standard as to justify existence in java.lang.
The code is tested using the latest revision of the JDK for supported
LTS releases: 8, 11, 17 and 21 currently.
See https://github.com/apache/commons-lang/blob/master/.github/workflows/maven.yml
Please ensure your build environment is up-to-date and kindly report any build issues.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/apache/commons/commons-lang3/3.19.0/commons-lang3-3.19.0.jar
MD5: 2ac2db154e365d55d167ec1215125a3a
SHA1: d6524b169a6574cd253760c472d419b47bfd37e6
SHA256: 32733ab4bc90b45b63eb72677d886961003fd4ed113e07b1028f9877cb2ac735
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
commons-lang3-3.19.0.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/de.funfried.netbeans.plugins/nb-editor-close-left-right@1.0.8-SNAPSHOT
Evidence Type Source Name Value Confidence Vendor file name commons-lang3 High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name lang3 Highest Vendor Manifest automatic-module-name org.apache.commons.lang3 Medium Vendor Manifest build-jdk-spec 17 Low Vendor Manifest bundle-docurl https://commons.apache.org/proper/commons-lang/ Low Vendor Manifest bundle-symbolicname org.apache.commons.lang3 Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest multi-release true Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-lang3 Highest Vendor pom artifactid commons-lang3 Low Vendor pom developer email bayard@apache.org Low Vendor pom developer email britter@apache.org Low Vendor pom developer email chtompki@apache.org Low Vendor pom developer email djones@apache.org Low Vendor pom developer email dlr@finemaltcoding.com Low Vendor pom developer email ggregory at apache.org Low Vendor pom developer email jcarman@apache.org Low Vendor pom developer email joerg.schaible@gmx.de Low Vendor pom developer email lguibert@apache.org Low Vendor pom developer email oheger@apache.org Low Vendor pom developer email pbenedict@apache.org Low Vendor pom developer email rdonkin@apache.org Low Vendor pom developer email scolebourne@joda.org Low Vendor pom developer email stevencaswell@apache.org Low Vendor pom developer id bayard Medium Vendor pom developer id britter Medium Vendor pom developer id chtompki Medium Vendor pom developer id djones Medium Vendor pom developer id dlr Medium Vendor pom developer id fredrik Medium Vendor pom developer id ggregory Medium Vendor pom developer id jcarman Medium Vendor pom developer id joehni Medium Vendor pom developer id lguibert Medium Vendor pom developer id mbenson Medium Vendor pom developer id niallp Medium Vendor pom developer id oheger Medium Vendor pom developer id pbenedict Medium Vendor pom developer id rdonkin Medium Vendor pom developer id scaswell Medium Vendor pom developer id scolebourne Medium Vendor pom developer name Benedikt Ritter Medium Vendor pom developer name Daniel Rall Medium Vendor pom developer name Duncan Jones Medium Vendor pom developer name Fredrik Westermarck Medium Vendor pom developer name Gary Gregory Medium Vendor pom developer name Henri Yandell Medium Vendor pom developer name James Carman Medium Vendor pom developer name Joerg Schaible Medium Vendor pom developer name Loic Guibert Medium Vendor pom developer name Matt Benson Medium Vendor pom developer name Niall Pemberton Medium Vendor pom developer name Oliver Heger Medium Vendor pom developer name Paul Benedict Medium Vendor pom developer name Rob Tompkins Medium Vendor pom developer name Robert Burrell Donkin Medium Vendor pom developer name Stephen Colebourne Medium Vendor pom developer name Steven Caswell Medium Vendor pom developer org Carman Consulting, Inc. Medium Vendor pom developer org CollabNet, Inc. Medium Vendor pom developer org SITA ATS Ltd Medium Vendor pom developer org The Apache Software Foundation Medium Vendor pom developer org URL https://www.apache.org/ Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Lang High Vendor pom parent-artifactid commons-parent Low Vendor pom url https://commons.apache.org/proper/commons-lang/ Highest Product file name commons-lang3 High Product jar package name apache Highest Product jar package name commons Highest Product jar package name lang3 Highest Product Manifest automatic-module-name org.apache.commons.lang3 Medium Product Manifest build-jdk-spec 17 Low Product Manifest bundle-docurl https://commons.apache.org/proper/commons-lang/ Low Product Manifest Bundle-Name Apache Commons Lang Medium Product Manifest bundle-symbolicname org.apache.commons.lang3 Medium Product Manifest Implementation-Title Apache Commons Lang High Product Manifest multi-release true Low Product Manifest specification-title Apache Commons Lang Medium Product pom artifactid commons-lang3 Highest Product pom developer email bayard@apache.org Low Product pom developer email britter@apache.org Low Product pom developer email chtompki@apache.org Low Product pom developer email djones@apache.org Low Product pom developer email dlr@finemaltcoding.com Low Product pom developer email ggregory at apache.org Low Product pom developer email jcarman@apache.org Low Product pom developer email joerg.schaible@gmx.de Low Product pom developer email lguibert@apache.org Low Product pom developer email oheger@apache.org Low Product pom developer email pbenedict@apache.org Low Product pom developer email rdonkin@apache.org Low Product pom developer email scolebourne@joda.org Low Product pom developer email stevencaswell@apache.org Low Product pom developer id bayard Low Product pom developer id britter Low Product pom developer id chtompki Low Product pom developer id djones Low Product pom developer id dlr Low Product pom developer id fredrik Low Product pom developer id ggregory Low Product pom developer id jcarman Low Product pom developer id joehni Low Product pom developer id lguibert Low Product pom developer id mbenson Low Product pom developer id niallp Low Product pom developer id oheger Low Product pom developer id pbenedict Low Product pom developer id rdonkin Low Product pom developer id scaswell Low Product pom developer id scolebourne Low Product pom developer name Benedikt Ritter Low Product pom developer name Daniel Rall Low Product pom developer name Duncan Jones Low Product pom developer name Fredrik Westermarck Low Product pom developer name Gary Gregory Low Product pom developer name Henri Yandell Low Product pom developer name James Carman Low Product pom developer name Joerg Schaible Low Product pom developer name Loic Guibert Low Product pom developer name Matt Benson Low Product pom developer name Niall Pemberton Low Product pom developer name Oliver Heger Low Product pom developer name Paul Benedict Low Product pom developer name Rob Tompkins Low Product pom developer name Robert Burrell Donkin Low Product pom developer name Stephen Colebourne Low Product pom developer name Steven Caswell Low Product pom developer org Carman Consulting, Inc. Low Product pom developer org CollabNet, Inc. Low Product pom developer org SITA ATS Ltd Low Product pom developer org The Apache Software Foundation Low Product pom developer org URL https://www.apache.org/ Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Lang High Product pom parent-artifactid commons-parent Medium Product pom url https://commons.apache.org/proper/commons-lang/ Medium Version file version 3.19.0 High Version Manifest Bundle-Version 3.19.0 High Version Manifest Implementation-Version 3.19.0 High Version pom parent-version 3.19.0 Low Version pom version 3.19.0 Highest
Description:
Apache Commons Text is a set of utility functions and reusable components for processing
and manipulating text in a Java environment.
License:
https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/apache/commons/commons-text/1.14.0/commons-text-1.14.0.jar
MD5: 54960a12a82d52df3d5548d6934d87b2
SHA1: adcb0d4c67eabc79682604b47eb852aaff21138a
SHA256: 121fce2282910c8f0c3ba793a5436b31beb710423cbe2d574a3fb7a73c508e92
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
commons-text-1.14.0.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-provider-gitexe@2.2.1
Evidence Type Source Name Value Confidence Vendor file name commons-text High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name text Highest Vendor Manifest automatic-module-name org.apache.commons.text Medium Vendor Manifest build-jdk-spec 21 Low Vendor Manifest bundle-docurl https://commons.apache.org/proper/commons-text Low Vendor Manifest bundle-symbolicname org.apache.commons.text Medium Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest multi-release true Low Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid commons-text Highest Vendor pom artifactid commons-text Low Vendor pom developer email britter@apache.org Low Vendor pom developer email chtompki@apache.org Low Vendor pom developer email djones@apache.org Low Vendor pom developer email ggregory at apache.org Low Vendor pom developer email kinow@apache.org Low Vendor pom developer id britter Medium Vendor pom developer id chtompki Medium Vendor pom developer id djones Medium Vendor pom developer id ggregory Medium Vendor pom developer id kinow Medium Vendor pom developer name Benedikt Ritter Medium Vendor pom developer name Bruno P. Kinoshita Medium Vendor pom developer name Duncan Jones Medium Vendor pom developer name Gary Gregory Medium Vendor pom developer name Rob Tompkins Medium Vendor pom developer org The Apache Software Foundation Medium Vendor pom developer org URL https://www.apache.org/ Medium Vendor pom groupid org.apache.commons Highest Vendor pom name Apache Commons Text High Vendor pom parent-artifactid commons-parent Low Vendor pom url https://commons.apache.org/proper/commons-text Highest Product file name commons-text High Product jar package name apache Highest Product jar package name commons Highest Product jar package name text Highest Product Manifest automatic-module-name org.apache.commons.text Medium Product Manifest build-jdk-spec 21 Low Product Manifest bundle-docurl https://commons.apache.org/proper/commons-text Low Product Manifest Bundle-Name Apache Commons Text Medium Product Manifest bundle-symbolicname org.apache.commons.text Medium Product Manifest Implementation-Title Apache Commons Text High Product Manifest multi-release true Low Product Manifest specification-title Apache Commons Text Medium Product pom artifactid commons-text Highest Product pom developer email britter@apache.org Low Product pom developer email chtompki@apache.org Low Product pom developer email djones@apache.org Low Product pom developer email ggregory at apache.org Low Product pom developer email kinow@apache.org Low Product pom developer id britter Low Product pom developer id chtompki Low Product pom developer id djones Low Product pom developer id ggregory Low Product pom developer id kinow Low Product pom developer name Benedikt Ritter Low Product pom developer name Bruno P. Kinoshita Low Product pom developer name Duncan Jones Low Product pom developer name Gary Gregory Low Product pom developer name Rob Tompkins Low Product pom developer org The Apache Software Foundation Low Product pom developer org URL https://www.apache.org/ Low Product pom groupid org.apache.commons Highest Product pom name Apache Commons Text High Product pom parent-artifactid commons-parent Medium Product pom url https://commons.apache.org/proper/commons-text Medium Version file version 1.14.0 High Version Manifest Bundle-Version 1.14.0 High Version Manifest Implementation-Version 1.14.0 High Version pom parent-version 1.14.0 Low Version pom version 1.14.0 Highest
Description:
Implementation of EdDSA in Java License:
CC0 1.0 Universal: https://creativecommons.org/publicdomain/zero/1.0/ File Path: /home/runner/.m2/repository/net/i2p/crypto/eddsa/0.3.0/eddsa-0.3.0.jar
MD5: ee7de3b6f19de76a06e465efc978f669
SHA1: 1901c8d4d8bffb7d79027686cfb91e704217c3e1
SHA256: 4dda1120db856640dbec04140ed23242215a075fe127bdefa0dcfa29fb31267d
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
eddsa-0.3.0.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-provider-jgit@2.2.1
Evidence Type Source Name Value Confidence Vendor file name eddsa High Vendor jar package name crypto Highest Vendor jar package name eddsa Highest Vendor jar package name i2p Highest Vendor jar package name net Highest Vendor Manifest automatic-module-name net.i2p.crypto.eddsa Medium Vendor Manifest bundle-symbolicname net.i2p.crypto.eddsa Medium Vendor pom artifactid eddsa Highest Vendor pom artifactid eddsa Low Vendor pom developer email str4d@i2pmail.org Low Vendor pom developer id str4d Medium Vendor pom developer name str4d Medium Vendor pom groupid net.i2p.crypto Highest Vendor pom name EdDSA-Java High Vendor pom url str4d/ed25519-java Highest Product file name eddsa High Product jar package name crypto Highest Product jar package name eddsa Highest Product jar package name i2p Highest Product jar package name net Highest Product Manifest automatic-module-name net.i2p.crypto.eddsa Medium Product Manifest Bundle-Name EdDSA-Java Medium Product Manifest bundle-symbolicname net.i2p.crypto.eddsa Medium Product pom artifactid eddsa Highest Product pom developer email str4d@i2pmail.org Low Product pom developer id str4d Low Product pom developer name str4d Low Product pom groupid net.i2p.crypto Highest Product pom name EdDSA-Java High Product pom url str4d/ed25519-java High Version file version 0.3.0 High Version Manifest Bundle-Version 0.3.0 High Version pom version 0.3.0 Highest
pkg:maven/net.i2p.crypto/eddsa@0.3.0 (Confidence :High) cpe:2.3:a:4d:4d:0.3.0:*:*:*:*:*:*:* (Confidence :Low) suppress Description:
The javax.inject API License:
The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
SHA256: 91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
javax.inject-1.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-provider-gitexe@2.2.1
Evidence Type Source Name Value Confidence Vendor file name javax.inject-1 High Vendor jar package name inject Highest Vendor jar package name inject Low Vendor jar package name javax Highest Vendor jar package name javax Low Vendor pom artifactid javax.inject Highest Vendor pom artifactid javax.inject Low Vendor pom groupid javax.inject Highest Vendor pom name javax.inject High Vendor pom url http://code.google.com/p/atinject/ Highest Product file name javax.inject-1 High Product jar package name inject Highest Product jar package name inject Low Product jar package name javax Highest Product pom artifactid javax.inject Highest Product pom groupid javax.inject Highest Product pom name javax.inject High Product pom url http://code.google.com/p/atinject/ Medium Version file version 1 Medium Version pom version 1 Highest
pkg:maven/javax.inject/javax.inject@1 (Confidence :High) Description:
JCL 1.2 implemented over SLF4J License:
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.36/jcl-over-slf4j-1.7.36.jar
MD5: 8065610cde33ed9fd5d34367912c1938
SHA1: d877e195a05aca4a2f1ad2ff14bfec1393af4b5e
SHA256: ab57ca8fd223772c17365d121f59e94ecbf0ae59d08c03a3cb5b81071c019195
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
jcl-over-slf4j-1.7.36.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-provider-jgit@2.2.1
Evidence Type Source Name Value Confidence Vendor file name jcl-over-slf4j High Vendor jar package name apache Highest Vendor jar package name commons Highest Vendor jar package name logging Highest Vendor Manifest automatic-module-name org.apache.commons.logging Medium Vendor Manifest build-jdk-spec 1.8 Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname jcl.over.slf4j Medium Vendor pom artifactid jcl-over-slf4j Highest Vendor pom artifactid jcl-over-slf4j Low Vendor pom groupid org.slf4j Highest Vendor pom name JCL 1.2 implemented over SLF4J High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name jcl-over-slf4j High Product jar package name apache Highest Product jar package name commons Highest Product jar package name logging Highest Product Manifest automatic-module-name org.apache.commons.logging Medium Product Manifest build-jdk-spec 1.8 Low Product Manifest Bundle-Name jcl-over-slf4j Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname jcl.over.slf4j Medium Product Manifest Implementation-Title jcl-over-slf4j High Product pom artifactid jcl-over-slf4j Highest Product pom groupid org.slf4j Highest Product pom name JCL 1.2 implemented over SLF4J High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.36 High Version Manifest Bundle-Version 1.7.36 High Version Manifest Implementation-Version 1.7.36 High Version pom version 1.7.36 Highest
pkg:maven/org.slf4j/jcl-over-slf4j@1.7.36 (Confidence :High) Description:
The SCM API provides mechanisms to manage all SCM tools. File Path: /home/runner/.m2/repository/org/apache/maven/scm/maven-scm-api/2.2.1/maven-scm-api-2.2.1.jarMD5: 1ef6b239f79a41c52e4eb871ddaa3c13SHA1: 451345bd695fa717ec2ceb177d3543153cd3d77dSHA256: d843c0611a21191e4a34804152c8bd9ec364f41e076713df8db99f6df7f386d3Referenced In Project/Scope: Close Editor Tabs Left and Right:compilemaven-scm-api-2.2.1.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name maven-scm-api High Vendor jar package name apache Highest Vendor jar package name maven Highest Vendor jar package name scm Highest Vendor Manifest build-jdk-spec 11 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid maven-scm-api Highest Vendor pom artifactid maven-scm-api Low Vendor pom groupid org.apache.maven.scm Highest Vendor pom name Maven SCM API High Vendor pom parent-artifactid maven-scm Low Product file name maven-scm-api High Product jar package name apache Highest Product jar package name maven Highest Product jar package name scm Highest Product Manifest build-jdk-spec 11 Low Product Manifest Implementation-Title Maven SCM API High Product Manifest specification-title Maven SCM API Medium Product pom artifactid maven-scm-api Highest Product pom groupid org.apache.maven.scm Highest Product pom name Maven SCM API High Product pom parent-artifactid maven-scm Medium Version file version 2.2.1 High Version Manifest Implementation-Version 2.2.1 High Version pom version 2.2.1 Highest
pkg:maven/org.apache.maven.scm/maven-scm-api@2.2.1 (Confidence :High) Description:
Common library for SCM Git Provider. File Path: /home/runner/.m2/repository/org/apache/maven/scm/maven-scm-provider-git-commons/2.2.1/maven-scm-provider-git-commons-2.2.1.jarMD5: 27481c012ba069b900c3c8e7f2b4a79cSHA1: ecffb44a1ef2fedea19ea361a676364046679a69SHA256: 2002d91bf483d6ec6686c12f12a1cdcc21330d3547aa8cc15ed7e9eee543ae10Referenced In Project/Scope: Close Editor Tabs Left and Right:compilemaven-scm-provider-git-commons-2.2.1.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name maven-scm-provider-git-commons High Vendor jar package name apache Highest Vendor jar package name maven Highest Vendor jar package name provider Highest Vendor jar package name providers Highest Vendor jar package name scm Highest Vendor Manifest build-jdk-spec 11 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid maven-scm-provider-git-commons Highest Vendor pom artifactid maven-scm-provider-git-commons Low Vendor pom groupid org.apache.maven.scm Highest Vendor pom name Maven SCM Git Provider - Common library High Vendor pom parent-artifactid maven-scm-providers-git Low Product file name maven-scm-provider-git-commons High Product jar package name apache Highest Product jar package name maven Highest Product jar package name provider Highest Product jar package name providers Highest Product jar package name scm Highest Product Manifest build-jdk-spec 11 Low Product Manifest Implementation-Title Maven SCM Git Provider - Common library High Product Manifest specification-title Maven SCM Git Provider - Common library Medium Product pom artifactid maven-scm-provider-git-commons Highest Product pom groupid org.apache.maven.scm Highest Product pom name Maven SCM Git Provider - Common library High Product pom parent-artifactid maven-scm-providers-git Medium Version file version 2.2.1 High Version Manifest Implementation-Version 2.2.1 High Version pom version 2.2.1 Highest
pkg:maven/org.apache.maven.scm/maven-scm-provider-git-commons@2.2.1 (Confidence :High) Description:
SCM Git Provider relying on the Git CLI File Path: /home/runner/.m2/repository/org/apache/maven/scm/maven-scm-provider-gitexe/2.2.1/maven-scm-provider-gitexe-2.2.1.jarMD5: d2d9bd2231cb02449f93274809d98754SHA1: fcf03560d007dc1c4c9da27ee481933bae7ed274SHA256: e39b2dbc6e7c2c678648aeee3e7698c0f67678b938d05bf9b14c7826a5458adbReferenced In Project/Scope: Close Editor Tabs Left and Right:compilemaven-scm-provider-gitexe-2.2.1.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name maven-scm-provider-gitexe High Vendor jar package name apache Highest Vendor jar package name maven Highest Vendor jar package name provider Highest Vendor jar package name scm Highest Vendor Manifest build-jdk-spec 11 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid maven-scm-provider-gitexe Highest Vendor pom artifactid maven-scm-provider-gitexe Low Vendor pom groupid org.apache.maven.scm Highest Vendor pom name Maven SCM Git Provider - Git Executable Impl. High Vendor pom parent-artifactid maven-scm-providers-git Low Product file name maven-scm-provider-gitexe High Product jar package name apache Highest Product jar package name maven Highest Product jar package name provider Highest Product jar package name scm Highest Product Manifest build-jdk-spec 11 Low Product Manifest Implementation-Title Maven SCM Git Provider - Git Executable Impl. High Product Manifest specification-title Maven SCM Git Provider - Git Executable Impl. Medium Product pom artifactid maven-scm-provider-gitexe Highest Product pom groupid org.apache.maven.scm Highest Product pom name Maven SCM Git Provider - Git Executable Impl. High Product pom parent-artifactid maven-scm-providers-git Medium Version file version 2.2.1 High Version Manifest Implementation-Version 2.2.1 High Version pom version 2.2.1 Highest
pkg:maven/org.apache.maven.scm/maven-scm-provider-gitexe@2.2.1 (Confidence :High) Description:
JGIT implementation for SCM Git Provider.
see http://eclipse.org/jgit/ File Path: /home/runner/.m2/repository/org/apache/maven/scm/maven-scm-provider-jgit/2.2.1/maven-scm-provider-jgit-2.2.1.jarMD5: e97c61467207996d7f472cca4600d223SHA1: 7bcf1817d07349affbfbc3434fb17dfd336a229cSHA256: 390d3d0a0ec09cd5d9ce4260351bd23b54e36b24770332ab67621fb51ee30172Referenced In Project/Scope: Close Editor Tabs Left and Right:compilemaven-scm-provider-jgit-2.2.1.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name maven-scm-provider-jgit High Vendor jar package name apache Highest Vendor jar package name maven Highest Vendor jar package name provider Highest Vendor jar package name scm Highest Vendor Manifest build-jdk-spec 11 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid maven-scm-provider-jgit Highest Vendor pom artifactid maven-scm-provider-jgit Low Vendor pom groupid org.apache.maven.scm Highest Vendor pom name Maven SCM Git Provider - JGit Impl. High Vendor pom parent-artifactid maven-scm-providers-git Low Product file name maven-scm-provider-jgit High Product jar package name apache Highest Product jar package name maven Highest Product jar package name provider Highest Product jar package name scm Highest Product Manifest build-jdk-spec 11 Low Product Manifest Implementation-Title Maven SCM Git Provider - JGit Impl. High Product Manifest specification-title Maven SCM Git Provider - JGit Impl. Medium Product pom artifactid maven-scm-provider-jgit Highest Product pom groupid org.apache.maven.scm Highest Product pom name Maven SCM Git Provider - JGit Impl. High Product pom parent-artifactid maven-scm-providers-git Medium Version file version 2.2.1 High Version Manifest Implementation-Version 2.2.1 High Version pom version 2.2.1 Highest
pkg:maven/org.apache.maven.scm/maven-scm-provider-jgit@2.2.1 (Confidence :High) File Path: /home/runner/.m2/repository/org/netbeans/modules/org-netbeans-bootstrap/RELEASE110/org-netbeans-bootstrap-RELEASE110.jarMD5: c955d38a30cf09a3e7dad7092a2bc4feSHA1: 4cae8a69b95b74d2bfb1944de7a08088fa908aa9SHA256: 84d5c5a955d5d8639baf32ac9958b3d150c1001076b96563fec820371c8c2e55Referenced In Project/Scope: Close Editor Tabs Left and Right:compileorg-netbeans-bootstrap-RELEASE110.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name org-netbeans-bootstrap-RELEASE110 High Vendor jar package name netbeans Highest Vendor Manifest autoupdate-show-in-client false Low Vendor Manifest openide-module org.netbeans.bootstrap/1 Low Vendor Manifest openide-module-java-dependencies Java > 1.7 Low Vendor Manifest openide-module-localizing-bundle org/netbeans/Bundle.properties Low Vendor Manifest openide-module-module-dependencies org.openide.modules > 7.44, org.openide.util.ui > 9.3, org.openide.util > 9.3, org.openide.util.lookup > 8.0 Low Vendor Manifest openide-module-public-packages org.netbeans.* Low Vendor pom artifactid org-netbeans-bootstrap Highest Vendor pom artifactid org-netbeans-bootstrap Low Vendor pom groupid org.netbeans.modules Highest Vendor pom parent-artifactid netbeans-parent Low Vendor pom parent-groupid org.apache.netbeans Medium Product file name org-netbeans-bootstrap-RELEASE110 High Product jar package name java Highest Product jar package name netbeans Highest Product jar package name util Highest Product Manifest autoupdate-show-in-client false Low Product Manifest openide-module org.netbeans.bootstrap/1 Low Product Manifest openide-module-java-dependencies Java > 1.7 Low Product Manifest openide-module-localizing-bundle org/netbeans/Bundle.properties Low Product Manifest openide-module-module-dependencies org.openide.modules > 7.44, org.openide.util.ui > 9.3, org.openide.util > 9.3, org.openide.util.lookup > 8.0 Low Product Manifest openide-module-public-packages org.netbeans.* Low Product pom artifactid org-netbeans-bootstrap Highest Product pom groupid org.netbeans.modules Highest Product pom parent-artifactid netbeans-parent Medium Product pom parent-groupid org.apache.netbeans Medium Version pom parent-version RELEASE110 Low Version pom version RELEASE110 Highest
CVE-2009-2412 suppress
Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information. CWE-189 Numeric Errors
CVSSv2:
Base Score: HIGH (10.0) Vector: /AV:N/AC:L/Au:N/C:C/I:C/A:C References:
Vulnerable Software & Versions: (show all )
CVE-2009-1955 suppress
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564. CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVSSv3:
Base Score: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY cve@mitre.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY cve@mitre.org - EXPLOIT,VDB_ENTRY cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - PATCH cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY Vulnerable Software & Versions: (show all )
CVE-2009-1956 suppress
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input. CWE-189 Numeric Errors
CVSSv2:
Base Score: MEDIUM (6.4) Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:P References:
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,MAILING_LIST,PATCH af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - BROKEN_LINK cve@mitre.org - EXPLOIT,ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY cve@mitre.org - EXPLOIT,MAILING_LIST,PATCH cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY cve@mitre.org - PERMISSIONS_REQUIRED cve@mitre.org - PERMISSIONS_REQUIRED cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY cve@mitre.org - VENDOR_ADVISORY Vulnerable Software & Versions: (show all )
CVE-2010-1623 suppress
Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSSv2:
Base Score: MEDIUM (5.0) Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P References:
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - URL_REPURPOSED af854a3a-2127-422b-91ae-364da2661108 - URL_REPURPOSED af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - PATCH secalert@redhat.com - PATCH secalert@redhat.com - PATCH secalert@redhat.com - PATCH secalert@redhat.com - PATCH secalert@redhat.com - PATCH,VENDOR_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY secalert@redhat.com - URL_REPURPOSED secalert@redhat.com - URL_REPURPOSED secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY secalert@redhat.com - VENDOR_ADVISORY Vulnerable Software & Versions: (show all )
CVE-2009-0023 suppress
The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow. CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P References:
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY secalert@redhat.com - ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY secalert@redhat.com - PATCH,THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY secalert@redhat.com - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY secalert@redhat.com - THIRD_PARTY_ADVISORY,VENDOR_ADVISORY Vulnerable Software & Versions: (show all )
CVE-2011-1928 suppress
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419. CWE-399 Resource Management Errors
CVSSv2:
Base Score: MEDIUM (4.3) Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P References:
Vulnerable Software & Versions: (show all )
File Path: /home/runner/.m2/repository/org/netbeans/api/org-netbeans-modules-projectapi/RELEASE110/org-netbeans-modules-projectapi-RELEASE110.jarMD5: 49976d13e55ee444c17bd32665a47247SHA1: f313397dc63baeb2f2b16fc95c73df935476f2d1SHA256: d97b1beb5d25825a1956675465c70f0ab5e5db267a4d19bdaa02c196cfc5bc54Referenced In Project/Scope: Close Editor Tabs Left and Right:compileorg-netbeans-modules-projectapi-RELEASE110.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name org-netbeans-modules-projectapi-RELEASE110 High Vendor jar package name api Highest Vendor jar package name modules Highest Vendor jar package name netbeans Highest Vendor jar package name projectapi Highest Vendor Manifest autoupdate-show-in-client false Low Vendor Manifest openide-module org.netbeans.modules.projectapi/1 Low Vendor Manifest openide-module-java-dependencies Java > 1.8 Low Vendor Manifest openide-module-layer org/netbeans/modules/projectapi/layer.xml Low Vendor Manifest openide-module-localizing-bundle org/netbeans/modules/projectapi/Bundle.properties Low Vendor Manifest openide-module-module-dependencies org.netbeans.api.annotations.common/1 > 1.13, org.netbeans.modules.queries/1 > 1.27, org.openide.filesystems > 9.10, org.openide.modules > 7.29, org.openide.util > 9.3, org.openide.util.lookup > 8.0 Low Vendor pom artifactid org-netbeans-modules-projectapi Highest Vendor pom artifactid org-netbeans-modules-projectapi Low Vendor pom groupid org.netbeans.api Highest Vendor pom parent-artifactid netbeans-parent Low Vendor pom parent-groupid org.apache.netbeans Medium Product file name org-netbeans-modules-projectapi-RELEASE110 High Product jar package name api Highest Product jar package name modules Highest Product jar package name netbeans Highest Product jar package name projectapi Highest Product Manifest autoupdate-show-in-client false Low Product Manifest openide-module org.netbeans.modules.projectapi/1 Low Product Manifest openide-module-java-dependencies Java > 1.8 Low Product Manifest openide-module-layer org/netbeans/modules/projectapi/layer.xml Low Product Manifest openide-module-localizing-bundle org/netbeans/modules/projectapi/Bundle.properties Low Product Manifest openide-module-module-dependencies org.netbeans.api.annotations.common/1 > 1.13, org.netbeans.modules.queries/1 > 1.27, org.openide.filesystems > 9.10, org.openide.modules > 7.29, org.openide.util > 9.3, org.openide.util.lookup > 8.0 Low Product pom artifactid org-netbeans-modules-projectapi Highest Product pom groupid org.netbeans.api Highest Product pom parent-artifactid netbeans-parent Medium Product pom parent-groupid org.apache.netbeans Medium Version pom parent-version RELEASE110 Low Version pom version RELEASE110 Highest
Related Dependencies File Path: /home/runner/.m2/repository/org/netbeans/api/org-netbeans-modules-projectuiapi-base/RELEASE110/org-netbeans-modules-projectuiapi-base-RELEASE110.jarMD5: 2a665f1cfe3b4b956e47fa05decd75d6SHA1: 62b39080e1d70b968b2cf02675dc69762550db8fSHA256: a6d78ec80abc46f714ed84e9b1608a203abf551cb056496a67f434b9e0599ce8Referenced In Project/Scope: Close Editor Tabs Left and Right:compileorg-netbeans-modules-projectuiapi-base-RELEASE110.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name org-netbeans-modules-projectuiapi-base-RELEASE110 High Vendor jar package name api Highest Vendor jar package name modules Highest Vendor jar package name netbeans Highest Vendor Manifest autoupdate-show-in-client false Low Vendor Manifest openide-module org.netbeans.modules.projectuiapi.base/1 Low Vendor Manifest openide-module-java-dependencies Java > 1.7 Low Vendor Manifest openide-module-localizing-bundle org/netbeans/spi/project/ui/Bundle.properties Low Vendor Manifest openide-module-module-dependencies org.netbeans.api.annotations.common/1 > 1.10, org.netbeans.modules.projectapi/1 > 1.56, org.netbeans.modules.queries/1 > 1.27, org.openide.filesystems > 9.0, org.openide.util > 9.3, org.openide.util.lookup > 8.0 Low Vendor pom artifactid org-netbeans-modules-projectuiapi-base Highest Vendor pom artifactid org-netbeans-modules-projectuiapi-base Low Vendor pom groupid org.netbeans.api Highest Vendor pom parent-artifactid netbeans-parent Low Vendor pom parent-groupid org.apache.netbeans Medium Product file name org-netbeans-modules-projectuiapi-base-RELEASE110 High Product jar package name api Highest Product jar package name modules Highest Product jar package name netbeans Highest Product jar package name project Highest Product jar package name spi Highest Product jar package name ui Highest Product Manifest autoupdate-show-in-client false Low Product Manifest openide-module org.netbeans.modules.projectuiapi.base/1 Low Product Manifest openide-module-java-dependencies Java > 1.7 Low Product Manifest openide-module-localizing-bundle org/netbeans/spi/project/ui/Bundle.properties Low Product Manifest openide-module-module-dependencies org.netbeans.api.annotations.common/1 > 1.10, org.netbeans.modules.projectapi/1 > 1.56, org.netbeans.modules.queries/1 > 1.27, org.openide.filesystems > 9.0, org.openide.util > 9.3, org.openide.util.lookup > 8.0 Low Product pom artifactid org-netbeans-modules-projectuiapi-base Highest Product pom groupid org.netbeans.api Highest Product pom parent-artifactid netbeans-parent Medium Product pom parent-groupid org.apache.netbeans Medium Version pom parent-version RELEASE110 Low Version pom version RELEASE110 Highest
Related Dependencies org-netbeans-core-startup-base-RELEASE110.jarFile Path: /home/runner/.m2/repository/org/netbeans/modules/org-netbeans-core-startup-base/RELEASE110/org-netbeans-core-startup-base-RELEASE110.jar MD5: 2698a447642ff167eeba639a65430f30 SHA1: 8f24a881af6139cf723df60b65cacab332193c92 SHA256: e2be10d6dfa818960743540b2dd8b128f061941f2ea8f52ff67c737bf8ddbfce pkg:maven/org.netbeans.modules/org-netbeans-core-startup-base@RELEASE110 CVE-2018-6557 suppress
The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled. CWE-59 Improper Link Resolution Before File Access ('Link Following')
CVSSv3:
Base Score: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.0/RC:R/MAV:A CVSSv2:
Base Score: MEDIUM (4.4) Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P References:
Vulnerable Software & Versions:
File Path: /home/runner/.m2/repository/org/netbeans/api/org-openide-util-lookup/RELEASE110/org-openide-util-lookup-RELEASE110.jarMD5: 7081cbb64509a795a2f6be7aafdd7f04SHA1: afcde9aa1fd6132b77f3d4e0ae89012c8324694aSHA256: b70f8ef33437b6bf4525002f5374f560b980e5a5f74c9f3733a5b1fca792ad59Referenced In Project/Scope: Close Editor Tabs Left and Right:compileorg-openide-util-lookup-RELEASE110.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name org-openide-util-lookup-RELEASE110 High Vendor jar package name lookup Highest Vendor jar package name netbeans Highest Vendor jar package name openide Highest Vendor jar package name util Highest Vendor Manifest autoupdate-show-in-client false Low Vendor Manifest openide-module-java-dependencies Java > 1.7 Low Vendor Manifest openide-module-localizing-bundle org/openide/util/lookup/Bundle.properties Low Vendor pom artifactid org-openide-util-lookup Highest Vendor pom artifactid org-openide-util-lookup Low Vendor pom groupid org.netbeans.api Highest Vendor pom parent-artifactid netbeans-parent Low Vendor pom parent-groupid org.apache.netbeans Medium Product file name org-openide-util-lookup-RELEASE110 High Product jar package name lookup Highest Product jar package name netbeans Highest Product jar package name openide Highest Product jar package name util Highest Product Manifest autoupdate-show-in-client false Low Product Manifest openide-module-java-dependencies Java > 1.7 Low Product Manifest openide-module-localizing-bundle org/openide/util/lookup/Bundle.properties Low Product pom artifactid org-openide-util-lookup Highest Product pom groupid org.netbeans.api Highest Product pom parent-artifactid netbeans-parent Medium Product pom parent-groupid org.apache.netbeans Medium Version pom parent-version RELEASE110 Low Version pom version RELEASE110 Highest
pkg:maven/org.netbeans.api/org-openide-util-lookup@RELEASE110 (Confidence :High) Description:
Repository access and algorithms
File Path: /home/runner/.m2/repository/org/eclipse/jgit/org.eclipse.jgit/5.13.3.202401111512-r/org.eclipse.jgit-5.13.3.202401111512-r.jarMD5: 37a213f59c76b11db423c37a1bfe084fSHA1: 7949cce60ba913f99259a0f421ab5ebf6c2524b4SHA256: dacb74c28b089bc378f8c2a1dcda5110c20f52124f5a020aef2684d70ef7f1bbReferenced In Project/Scope: Close Editor Tabs Left and Right:compileorg.eclipse.jgit-5.13.3.202401111512-r.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name org.eclipse.jgit High Vendor jar package name eclipse Highest Vendor jar package name jgit Highest Vendor jar package name repository Highest Vendor Manifest automatic-module-name org.eclipse.jgit Medium Vendor Manifest build-jdk-spec 1.8 Low Vendor Manifest bundle-localization plugin Low Vendor Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Vendor Manifest bundle-symbolicname org.eclipse.jgit Medium Vendor Manifest eclipse-extensibleapi true Low Vendor Manifest Implementation-Vendor Eclipse.org - JGit High Vendor Manifest Implementation-Vendor-Id org.eclipse.jgit Medium Vendor Manifest implementation-vendor-url https://www.eclipse.org/jgit/ Medium Vendor pom artifactid eclipse.jgit Low Vendor pom artifactid org.eclipse.jgit Highest Vendor pom groupid org.eclipse.jgit Highest Vendor pom name JGit - Core High Vendor pom parent-artifactid org.eclipse.jgit-parent Low Product file name org.eclipse.jgit High Product jar package name eclipse Highest Product jar package name jgit Highest Product jar package name repository Highest Product Manifest automatic-module-name org.eclipse.jgit Medium Product Manifest build-jdk-spec 1.8 Low Product Manifest bundle-localization plugin Low Product Manifest Bundle-Name %Bundle-Name Medium Product Manifest bundle-requiredexecutionenvironment JavaSE-1.8 Low Product Manifest bundle-symbolicname org.eclipse.jgit Medium Product Manifest eclipse-extensibleapi true Low Product Manifest Implementation-Title JGit org.eclipse.jgit High Product pom artifactid eclipse.jgit Highest Product pom artifactid org.eclipse.jgit Highest Product pom groupid org.eclipse.jgit Highest Product pom name JGit - Core High Product pom parent-artifactid org.eclipse.jgit-parent Medium Version Manifest Bundle-Version 5.13.3.202401111512-r High Version Manifest Implementation-Version 5.13.3.202401111512-r High Version pom version 5.13.3.202401111512-r Highest
Related Dependencies org.eclipse.jgit.ssh.apache-5.13.3.202401111512-r.jarFile Path: /home/runner/.m2/repository/org/eclipse/jgit/org.eclipse.jgit.ssh.apache/5.13.3.202401111512-r/org.eclipse.jgit.ssh.apache-5.13.3.202401111512-r.jar MD5: 9ef2fb9de8764177dbd5169682b765fc SHA1: c7603dae536aa086cccbac433d953b83154b7427 SHA256: b89de5f791712efb07cf22be871de65b22645be5296233b6cadbcc6f2cd8eb4d pkg:maven/org.eclipse.jgit/org.eclipse.jgit.ssh.apache@5.13.3.202401111512-r CVE-2023-4759 suppress
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0
In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.
This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.
The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.
Setting git configuration option core.symlinks = false before checking out avoids the problem.
The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.
The JGit maintainers would like to thank RyotaK for finding and reporting this issue.
CWE-59 Improper Link Resolution Before File Access ('Link Following'), CWE-178 Improper Handling of Case Sensitivity
CVSSv3:
Base Score: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:2.8/RC:R/MAV:A References:
Vulnerable Software & Versions: (show all )
CVE-2025-4949 suppress
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues. CWE-611 Improper Restriction of XML External Entity Reference, CWE-827 Improper Control of Document Type Definition
CVSSv4:
Base Score: MEDIUM (6.8) Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A References:
Vulnerable Software & Versions: (show all )
File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-interactivity-api/1.4/plexus-interactivity-api-1.4.jarMD5: 786445feb10c620690d33af22773e556SHA1: 089039c8d54a2dc00524274d98fb5183818099f7SHA256: 3d82c3b8afb0ac42d0087adbb6d9aa77e7253beb6e8b31f9159a3fcd74d5ee3cReferenced In Project/Scope: Close Editor Tabs Left and Right:compileplexus-interactivity-api-1.4.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name plexus-interactivity-api High Vendor jar package name codehaus Highest Vendor jar package name interactivity Highest Vendor jar package name plexus Highest Vendor Manifest build-jdk-spec 23 Low Vendor Manifest Implementation-Vendor Codehaus Plexus High Vendor Manifest specification-vendor Codehaus Plexus Low Vendor pom artifactid plexus-interactivity-api Highest Vendor pom artifactid plexus-interactivity-api Low Vendor pom groupid org.codehaus.plexus Highest Vendor pom name Plexus Default Interactivity Handler High Vendor pom parent-artifactid plexus-interactivity Low Product file name plexus-interactivity-api High Product jar package name codehaus Highest Product jar package name interactivity Highest Product jar package name plexus Highest Product Manifest build-jdk-spec 23 Low Product Manifest Implementation-Title Plexus Default Interactivity Handler High Product Manifest specification-title Plexus Default Interactivity Handler Medium Product pom artifactid plexus-interactivity-api Highest Product pom groupid org.codehaus.plexus Highest Product pom name Plexus Default Interactivity Handler High Product pom parent-artifactid plexus-interactivity Medium Version file version 1.4 High Version Manifest Implementation-Version 1.4 High Version pom version 1.4 Highest
pkg:maven/org.codehaus.plexus/plexus-interactivity-api@1.4 (Confidence :High) Description:
A collection of various utility classes to ease working with strings, files, command lines and
more. License:
Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-utils/4.0.2/plexus-utils-4.0.2.jar
MD5: 4cfdd73e436702d319d551a44fcea500
SHA1: 9526a9548b302572f23337fcc217fb4cc713b9c3
SHA256: 8957274e75fe2c278b1428dd16a0daeee1dd38152cb6eff816177ac28fccb697
Referenced In Project/Scope: Close Editor Tabs Left and Right:compile
plexus-utils-4.0.2.jar is in the transitive dependency tree of the listed items. Included by: pkg:maven/org.apache.maven.scm/maven-scm-api@2.2.1
Evidence Type Source Name Value Confidence Vendor file name plexus-utils High Vendor jar package name codehaus Highest Vendor jar package name org Highest Vendor jar package name plexus Highest Vendor Manifest build-jdk-spec 21 Low Vendor Manifest Implementation-Vendor Codehaus Plexus High Vendor Manifest multi-release true Low Vendor Manifest specification-vendor Codehaus Plexus Low Vendor pom artifactid plexus-utils Highest Vendor pom artifactid plexus-utils Low Vendor pom developer email 1983-01-06@gmx.net Low Vendor pom developer email agudian@apache.org Low Vendor pom developer email andy@handyande.co.uk Low Vendor pom developer email apache@kav.dk Low Vendor pom developer email belingueres@gmail.com Low Vendor pom developer email brett@codehaus.org Low Vendor pom developer email bwalding@codehaus.org Low Vendor pom developer email carlos@codehaus.org Low Vendor pom developer email dan@envoisolutions.com Low Vendor pom developer email evenisse@codehaus.org Low Vendor pom developer email gnodet@apache.org Low Vendor pom developer email hboutemy@apache.org Low Vendor pom developer email james@jamestaylor.org Low Vendor pom developer email jason@maven.org Low Vendor pom developer email jdcasey@codehaus.org Low Vendor pom developer email joakim@erdfelt.com Low Vendor pom developer email kenney@codehaus.org Low Vendor pom developer email khmarbaise@apache.org Low Vendor pom developer email krosenvold@apache.org Low Vendor pom developer email kwin@apache.org Low Vendor pom developer email mhw@kremvax.net Low Vendor pom developer email mmaczka@interia.pl Low Vendor pom developer email olamy@codehaus.org Low Vendor pom developer email olegy@codehaus.org Low Vendor pom developer email rahul.thakur.xdev@gmail.com Low Vendor pom developer email sjaranowski@apache.org Low Vendor pom developer email slachiewicz@apache.org Low Vendor pom developer email trygvis@codehaus.org Low Vendor pom developer email vsiveton@codehaus.org Low Vendor pom developer id agudian Medium Vendor pom developer id belingueres Medium Vendor pom developer id brett Medium Vendor pom developer id bwalding Medium Vendor pom developer id carlos Medium Vendor pom developer id dandiep Medium Vendor pom developer id evenisse Medium Vendor pom developer id gnodet Medium Vendor pom developer id handyande Medium Vendor pom developer id hboutemy Medium Vendor pom developer id jdcasey Medium Vendor pom developer id joakime Medium Vendor pom developer id jtaylor Medium Vendor pom developer id jvanzyl Medium Vendor pom developer id kasper Medium Vendor pom developer id kaz Medium Vendor pom developer id kenney Medium Vendor pom developer id khmarbaise Medium Vendor pom developer id krosenvold Medium Vendor pom developer id kwin Medium Vendor pom developer id mhw Medium Vendor pom developer id michael-o Medium Vendor pom developer id michal Medium Vendor pom developer id olamy Medium Vendor pom developer id oleg Medium Vendor pom developer id rahul Medium Vendor pom developer id sjaranowski Medium Vendor pom developer id slachiewicz Medium Vendor pom developer id trygvis Medium Vendor pom developer id vsiveton Medium Vendor pom developer name Andreas Gudian Medium Vendor pom developer name Andrew Williams Medium Vendor pom developer name Ben Walding Medium Vendor pom developer name Brett Porter Medium Vendor pom developer name Carlos Sanchez Medium Vendor pom developer name Dan Diephouse Medium Vendor pom developer name Emmanuel Venisse Medium Vendor pom developer name Gabriel Belingueres Medium Vendor pom developer name Guillaume Nodet Medium Vendor pom developer name Hervé Boutemy Medium Vendor pom developer name James Taylor Medium Vendor pom developer name Jason van Zyl Medium Vendor pom developer name Joakim Erdfelt Medium Vendor pom developer name John Casey Medium Vendor pom developer name Karl Heinz Marbaise Medium Vendor pom developer name Kasper Nielsen Medium Vendor pom developer name Kenney Westerhof Medium Vendor pom developer name Konrad Windszus Medium Vendor pom developer name Kristian Rosenvold Medium Vendor pom developer name Mark Wilkinson Medium Vendor pom developer name Michael Osipov Medium Vendor pom developer name Michal Maczka Medium Vendor pom developer name Oleg Gusakov Medium Vendor pom developer name Olivier Lamy Medium Vendor pom developer name Pete Kazmier Medium Vendor pom developer name Rahul Thakur Medium Vendor pom developer name Slawomir Jaranowski Medium Vendor pom developer name Sylwester Lachiewicz Medium Vendor pom developer name Trygve Laugstøl Medium Vendor pom developer name Vincent Siveton Medium Vendor pom developer org ASF Medium Vendor pom developer org Envoi solutions Medium Vendor pom developer org Walding Consulting Services Medium Vendor pom groupid org.codehaus.plexus Highest Vendor pom name Plexus Common Utilities High Vendor pom organization name Codehaus Plexus High Vendor pom organization url https://codehaus-plexus.github.io/ Medium Vendor pom parent-artifactid plexus Low Vendor pom url https://codehaus-plexus.github.io/plexus-utils/ Highest Product file name plexus-utils High Product jar package name codehaus Highest Product jar package name org Highest Product jar package name plexus Highest Product Manifest build-jdk-spec 21 Low Product Manifest Implementation-Title Plexus Common Utilities High Product Manifest multi-release true Low Product Manifest specification-title Plexus Common Utilities Medium Product pom artifactid plexus-utils Highest Product pom developer email 1983-01-06@gmx.net Low Product pom developer email agudian@apache.org Low Product pom developer email andy@handyande.co.uk Low Product pom developer email apache@kav.dk Low Product pom developer email belingueres@gmail.com Low Product pom developer email brett@codehaus.org Low Product pom developer email bwalding@codehaus.org Low Product pom developer email carlos@codehaus.org Low Product pom developer email dan@envoisolutions.com Low Product pom developer email evenisse@codehaus.org Low Product pom developer email gnodet@apache.org Low Product pom developer email hboutemy@apache.org Low Product pom developer email james@jamestaylor.org Low Product pom developer email jason@maven.org Low Product pom developer email jdcasey@codehaus.org Low Product pom developer email joakim@erdfelt.com Low Product pom developer email kenney@codehaus.org Low Product pom developer email khmarbaise@apache.org Low Product pom developer email krosenvold@apache.org Low Product pom developer email kwin@apache.org Low Product pom developer email mhw@kremvax.net Low Product pom developer email mmaczka@interia.pl Low Product pom developer email olamy@codehaus.org Low Product pom developer email olegy@codehaus.org Low Product pom developer email rahul.thakur.xdev@gmail.com Low Product pom developer email sjaranowski@apache.org Low Product pom developer email slachiewicz@apache.org Low Product pom developer email trygvis@codehaus.org Low Product pom developer email vsiveton@codehaus.org Low Product pom developer id agudian Low Product pom developer id belingueres Low Product pom developer id brett Low Product pom developer id bwalding Low Product pom developer id carlos Low Product pom developer id dandiep Low Product pom developer id evenisse Low Product pom developer id gnodet Low Product pom developer id handyande Low Product pom developer id hboutemy Low Product pom developer id jdcasey Low Product pom developer id joakime Low Product pom developer id jtaylor Low Product pom developer id jvanzyl Low Product pom developer id kasper Low Product pom developer id kaz Low Product pom developer id kenney Low Product pom developer id khmarbaise Low Product pom developer id krosenvold Low Product pom developer id kwin Low Product pom developer id mhw Low Product pom developer id michael-o Low Product pom developer id michal Low Product pom developer id olamy Low Product pom developer id oleg Low Product pom developer id rahul Low Product pom developer id sjaranowski Low Product pom developer id slachiewicz Low Product pom developer id trygvis Low Product pom developer id vsiveton Low Product pom developer name Andreas Gudian Low Product pom developer name Andrew Williams Low Product pom developer name Ben Walding Low Product pom developer name Brett Porter Low Product pom developer name Carlos Sanchez Low Product pom developer name Dan Diephouse Low Product pom developer name Emmanuel Venisse Low Product pom developer name Gabriel Belingueres Low Product pom developer name Guillaume Nodet Low Product pom developer name Hervé Boutemy Low Product pom developer name James Taylor Low Product pom developer name Jason van Zyl Low Product pom developer name Joakim Erdfelt Low Product pom developer name John Casey Low Product pom developer name Karl Heinz Marbaise Low Product pom developer name Kasper Nielsen Low Product pom developer name Kenney Westerhof Low Product pom developer name Konrad Windszus Low Product pom developer name Kristian Rosenvold Low Product pom developer name Mark Wilkinson Low Product pom developer name Michael Osipov Low Product pom developer name Michal Maczka Low Product pom developer name Oleg Gusakov Low Product pom developer name Olivier Lamy Low Product pom developer name Pete Kazmier Low Product pom developer name Rahul Thakur Low Product pom developer name Slawomir Jaranowski Low Product pom developer name Sylwester Lachiewicz Low Product pom developer name Trygve Laugstøl Low Product pom developer name Vincent Siveton Low Product pom developer org ASF Low Product pom developer org Envoi solutions Low Product pom developer org Walding Consulting Services Low Product pom groupid org.codehaus.plexus Highest Product pom name Plexus Common Utilities High Product pom organization name Codehaus Plexus Low Product pom organization url https://codehaus-plexus.github.io/ Low Product pom parent-artifactid plexus Medium Product pom url https://codehaus-plexus.github.io/plexus-utils/ Medium Version file version 4.0.2 High Version Manifest Implementation-Version 4.0.2 High Version pom parent-version 4.0.2 Low Version pom version 4.0.2 Highest
Description:
A collection of various utility classes to ease working with XML in Maven 3. File Path: /home/runner/.m2/repository/org/codehaus/plexus/plexus-xml/3.0.1/plexus-xml-3.0.1.jarMD5: cd868918ebc742350840124ea4422ab0SHA1: b0e73c21402f03c2765674b8dede21673b3288cfSHA256: c1a510a87a62bd2d74ac1472dd31c3f9e9b0b8b8568f37d77c0f135415bebd05Referenced In Project/Scope: Close Editor Tabs Left and Right:compileplexus-xml-3.0.1.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name plexus-xml High Vendor jar package name codehaus Highest Vendor jar package name plexus Highest Vendor jar package name xml Highest Vendor Manifest build-jdk-spec 21 Low Vendor Manifest Implementation-Vendor Codehaus Plexus High Vendor Manifest specification-vendor Codehaus Plexus Low Vendor pom artifactid plexus-xml Highest Vendor pom artifactid plexus-xml Low Vendor pom groupid org.codehaus.plexus Highest Vendor pom name Plexus XML Utilities High Vendor pom parent-artifactid plexus Low Vendor pom url https://codehaus-plexus.github.io/plexus-xml/ Highest Product file name plexus-xml High Product jar package name codehaus Highest Product jar package name plexus Highest Product jar package name xml Highest Product Manifest build-jdk-spec 21 Low Product Manifest Implementation-Title Plexus XML Utilities High Product Manifest specification-title Plexus XML Utilities Medium Product pom artifactid plexus-xml Highest Product pom groupid org.codehaus.plexus Highest Product pom name Plexus XML Utilities High Product pom parent-artifactid plexus Medium Product pom url https://codehaus-plexus.github.io/plexus-xml/ Medium Version file version 3.0.1 High Version Manifest Implementation-Version 3.0.1 High Version pom parent-version 3.0.1 Low Version pom version 3.0.1 Highest
pkg:maven/org.codehaus.plexus/plexus-xml@3.0.1 (Confidence :High) Description:
The slf4j API File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jarMD5: 872da51f5de7f3923da4de871d57fd85SHA1: 6c62681a2f655b49963a5983b8b0950a6120ae14SHA256: d3ef575e3e4979678dc01bf1dcce51021493b4d11fb7f1be8ad982877c16a1c0Referenced In Project/Scope: Close Editor Tabs Left and Right:compileslf4j-api-1.7.36.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name slf4j-api High Vendor jar package name slf4j Highest Vendor Manifest automatic-module-name org.slf4j Medium Vendor Manifest build-jdk-spec 1.8 Low Vendor Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Vendor Manifest bundle-symbolicname slf4j.api Medium Vendor pom artifactid slf4j-api Highest Vendor pom artifactid slf4j-api Low Vendor pom groupid org.slf4j Highest Vendor pom name SLF4J API Module High Vendor pom parent-artifactid slf4j-parent Low Vendor pom url http://www.slf4j.org Highest Product file name slf4j-api High Product jar package name slf4j Highest Product Manifest automatic-module-name org.slf4j Medium Product Manifest build-jdk-spec 1.8 Low Product Manifest Bundle-Name slf4j-api Medium Product Manifest bundle-requiredexecutionenvironment J2SE-1.5 Low Product Manifest bundle-symbolicname slf4j.api Medium Product Manifest Implementation-Title slf4j-api High Product pom artifactid slf4j-api Highest Product pom groupid org.slf4j Highest Product pom name SLF4J API Module High Product pom parent-artifactid slf4j-parent Medium Product pom url http://www.slf4j.org Medium Version file version 1.7.36 High Version Manifest Bundle-Version 1.7.36 High Version Manifest Implementation-Version 1.7.36 High Version pom version 1.7.36 Highest
pkg:maven/org.slf4j/slf4j-api@1.7.36 (Confidence :High) File Path: /home/runner/.m2/repository/org/apache/sshd/sshd-core/2.7.0/sshd-core-2.7.0.jarMD5: 38d8a9c37469025340a1f5bfa68c7f86SHA1: 6059f31f67f82b815e334faf3758037f473c59bcSHA256: 2f23d666dd1fd3317891d784f324542e236d89658c02adc7c02d137aa556e636Referenced In Project/Scope: Close Editor Tabs Left and Right:compilesshd-core-2.7.0.jar is in the transitive dependency tree of the listed items. Included by:
Evidence Type Source Name Value Confidence Vendor file name sshd-core High Vendor jar package name apache Highest Vendor jar package name core Highest Vendor jar package name sshd Highest Vendor Manifest build-jdk-spec 1.8 Low Vendor Manifest Implementation-Vendor The Apache Software Foundation High Vendor Manifest specification-vendor The Apache Software Foundation Low Vendor pom artifactid sshd-core Highest Vendor pom artifactid sshd-core Low Vendor pom groupid org.apache.sshd Highest Vendor pom name Apache Mina SSHD :: Core High Vendor pom parent-artifactid sshd Low Product file name sshd-core High Product jar package name apache Highest Product jar package name core Highest Product jar package name sshd Highest Product Manifest build-jdk-spec 1.8 Low Product Manifest Implementation-Title Apache Mina SSHD :: Core High Product Manifest specification-title Apache Mina SSHD :: Core Medium Product pom artifactid sshd-core Highest Product pom groupid org.apache.sshd Highest Product pom name Apache Mina SSHD :: Core High Product pom parent-artifactid sshd Medium Version file version 2.7.0 High Version Manifest Implementation-Version 2.7.0 High Version pom version 2.7.0 Highest
Related Dependencies sshd-common-2.7.0.jarFile Path: /home/runner/.m2/repository/org/apache/sshd/sshd-common/2.7.0/sshd-common-2.7.0.jar MD5: 727f0f3106d5ad14ee8bd0b71266abf0 SHA1: 468c0ccd0947287e6eb4c23e1d8e40a3c66bc245 SHA256: bbd38821c00f4b0d20271d8a4cd89336d7e7ac57458486c1c9c3798a6e4b873d pkg:maven/org.apache.sshd/sshd-common@2.7.0 sshd-osgi-2.7.0.jarFile Path: /home/runner/.m2/repository/org/apache/sshd/sshd-osgi/2.7.0/sshd-osgi-2.7.0.jar MD5: 19b45a04d902be3e1a8ab0692ad0d7ed SHA1: a101aad0f79ad424498098f7e91c39d3d92177c1 SHA256: 17195d9df825d8c04286df1e2184f1e830bd8e9b5b7f788cb567eb3de65275d5 pkg:maven/org.apache.sshd/sshd-osgi@2.7.0 sshd-sftp-2.7.0.jarFile Path: /home/runner/.m2/repository/org/apache/sshd/sshd-sftp/2.7.0/sshd-sftp-2.7.0.jar MD5: 5c941a20eeb43c2ae7dda61de46e75bf SHA1: 0c9eff7145e20b338c1dd6aca36ba93ed7c0147c SHA256: 90692aaedbc6a1d7f5e61a03d811dd0cc6058b424a86e82d96843e2f5287b70c pkg:maven/org.apache.sshd/sshd-sftp@2.7.0 CVE-2022-45047 suppress
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server. CWE-502 Deserialization of Untrusted Data
CVSSv3:
Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A References:
Vulnerable Software & Versions:
CVE-2023-48795 suppress
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. CWE-354 Improper Validation of Integrity Check Value
CVSSv3:
Base Score: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:2.2/RC:R/MAV:A References:
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - MITIGATION af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PATCH af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE af854a3a-2127-422b-91ae-364da2661108 - PRESS/MEDIA_COVERAGE af854a3a-2127-422b-91ae-364da2661108 - PRODUCT af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY cve@mitre.org - EXPLOIT cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - ISSUE_TRACKING cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST cve@mitre.org - MAILING_LIST,MITIGATION cve@mitre.org - MAILING_LIST,MITIGATION cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MAILING_LIST,THIRD_PARTY_ADVISORY cve@mitre.org - MITIGATION cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PATCH cve@mitre.org - PRESS/MEDIA_COVERAGE cve@mitre.org - PRESS/MEDIA_COVERAGE cve@mitre.org - PRESS/MEDIA_COVERAGE cve@mitre.org - PRESS/MEDIA_COVERAGE cve@mitre.org - PRESS/MEDIA_COVERAGE cve@mitre.org - PRODUCT cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - RELEASE_NOTES cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY cve@mitre.org - VENDOR_ADVISORY cve@mitre.org - VENDOR_ADVISORY cve@mitre.org - VENDOR_ADVISORY cve@mitre.org - VENDOR_ADVISORY cve@mitre.org - VENDOR_ADVISORY cve@mitre.org - VENDOR_ADVISORY Vulnerable Software & Versions: (show all )
CVE-2023-35887 suppress
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.
In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.
This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv3:
Base Score: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:2.8/RC:R/MAV:A References:
Vulnerable Software & Versions: